Skip to content

Instantly share code, notes, and snippets.

@besimorhino

besimorhino/include_ntdsutil.xml

Created August 11, 2022 18:38
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save besimorhino/cbee284f532eaba45396973ffd268080 to your computer and use it in GitHub Desktop.
Save besimorhino/cbee284f532eaba45396973ffd268080 to your computer and use it in GitHub Desktop.
Download ZIP
sysmon xml filter to monitor use of ntdsutil.exe
Raw
include_ntdsutil.xml
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ProcessCreate onmatch="include">
<OriginalFileName name="technique_id=T1003.003,technique_name=OS Credential Dumping: NTDS" condition="is">ntdsutil.exe</OriginalFileName>
</ProcessCreate>
</RuleGroup>
</EventFiltering>
</Sysmon>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment