Rule Info
Name
Sensitive File Dump Via Wbadmin.EXE
Author
Nasreddine Bencherchali (Nextron Systems), frack113
Description
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Date
2024-05-10 00:00:00
Modified
None
Id
8b93a509-1cb8-42e1-97aa-ee24224cdc15
Tags
attack.credential-access attack.t1003.003
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
github-actions[bot]
Merge PR #5249 from @nasbench - Promote older rules status from `experimental` to `test`
2025-04-17
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Scan your endpoints, forensic images or collected files with our portable scanner THOR