Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

NTDS.dit copy via ntdsutil IFM (T1003.003)

SIGhighconfidence 85/100generated 2026-10-18

ntdsutil creating Install-From-Media output, which writes a copy of NTDS.dit and the SYSTEM hive — the domain's password hashes — to disk. Observed for: APT10, APT15, APT28, Chimera, ENERGETIC BEAR, FIN13 and 10 more.

ATT&CK
T1003.003 mitre ↗
Linked actors
APT10 · APT15 · APT28 · Chimera · ENERGETIC BEAR · FIN13 · FIN6 · Fox Kitten · HAFNIUM · LAPSUS · Medusa Group · MirrorFace · Sandworm · Scattered Spider · Volt Typhoon · WIZARD SPIDER
False positives
Matches only ntdsutil with both 'ifm' and 'create'; routine ntdsutil maintenance (metadata cleanup, snapshot listing) does not match.

Sigma rule

skopnix-sigma-ttp-t1003-003-bbd4e2b2.ymldownload .yml ↓
title: Skopnix - NTDS.dit copy via ntdsutil IFM (T1003.003)
id: 49c708a6-ad97-5d5e-ae91-b2e4c64cae97
status: experimental
description: 'ntdsutil creating Install-From-Media output, which writes a copy of NTDS.dit and the SYSTEM hive — the domain''s password hashes — to disk. Observed for: APT10, APT15, APT28, Chimera, ENERGETIC BEAR, FIN13 and 10 more.'
references:
  - https://attack.mitre.org/techniques/T1003/003/
  - https://skopnix.com/actors/apt10
  - https://skopnix.com/actors/apt15
  - https://skopnix.com/actors/apt28
  - https://skopnix.com/actors/chimera
  - https://skopnix.com/actors/energetic-bear
  - https://skopnix.com/actors/fin13
  - https://skopnix.com/actors/fin6
  - https://skopnix.com/actors/fox-kitten
  - https://skopnix.com/actors/hafnium
  - https://skopnix.com/actors/lapsus
author: skopnix
date: '2026-10-18'
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ntdsutil.exe
    CommandLine|contains|all:
      - ifm
      - create
  condition: selection
falsepositives:
  - Planned domain controller promotion from IFM media (change-managed; whitelist the admin account and host)
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References