Rule name: "Skopnix: NTDS.dit copy via ntdsutil IFM (T1003.003)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'ntdsutil.exe' AND "Process CommandLine" ILIKE '%ifm%' AND "Process CommandLine" ILIKE '%create%'
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1003.003".
FP-safety: Matches only ntdsutil with both 'ifm' and 'create'; routine ntdsutil maintenance (metadata cleanup, snapshot listing) does not match.