TGI HUNT Suspicious ntds.dit Filename in SMB Request (UTF-16LE)

SID: 2610684Rev: 221 views
History
Sourcetgreen/hunting
CreatedMarch 19, 2025
UpdatedMay 7, 2026
Classificationattempted-admin
alert smb any any -> $HOME_NET any (msg:"TGI HUNT Suspicious ntds.dit Filename in SMB Request (UTF-16LE)"; flow:established,to_server; content:"n|00|t|00|d|00|s|00|.|00|d|00|i|00|t"; fast_pattern; reference:url,stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file; classtype:attempted-admin; sid:2610684; rev:2;)

References

urlstealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!