223. Akira Abuses Wbadmin to Obtain a Copy of NTDS.dit
Hello everyone! Today the technique we are going to look at is OS Credential Dumping: NTDS (T1003.003). I'm sure you've seen adversaries abuse esentutl to get a copy of NTDS.dit , but what about wbadmin ? I think you've lots of reports on Akira ransomware attacks involving SonicWall recently. According to this report , the adversary leveraged wbadmin to dump NTDS.dit as well as SYSTEM and SECURUTY registry files: "C:\Windows\system32\wbadmin.exe" start backup -backupTarget:\\localhost\c$\ProgramData\ -include:C:\Windows\NTDS\NTDS.dit C:\Windows\System32\config\SYSTEM C:\Windows\System32\config\SECURITY -quiet If we want to look for NTDS.dit dumping attempts, we can run the following query: event_type: "processcreatewin" AND proc_file_path: "wbadmin.exe" AND cmdline: "ntds.dit" See you tomorrow!