TGI HUNT Suspicious ntds.dit Filename in SMB (ASCII)

SID: 2610680Rev: 116 views
History
Sourcetgreen/hunting
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationbad-unknown
alert smb any any -> $HOME_NET any (msg:"TGI HUNT Suspicious ntds.dit Filename in SMB (ASCII)"; flow:established; content:"ntds.dit"; reference:url,stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file; classtype:bad-unknown; sid:2610680; rev:1;)

References

urlstealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!