Azure ATP posibilities to detect NTDS.dit dump

Question

Hello,&nbsp;Does Azure ATP detect activities related with getting a copy of the file NTDS.dit?For example when dumping the file with native&nbsp;built in tools when Administrator is logged on to DC:Leverage the NTDSUtil diagnostic tool available as part of Active DirectoryVSSAdmin - Use Volume Shadow Copies via the VSSAdmin commandThanks&nbsp;

david caddick · Answer

Daugirdas_Sinkevicius&nbsp;yes it does - and boy did it cause some angst...&nbsp;&nbsp;

daugirdas_sinkevicius · Answer

David Caddick, just want to clarify...have you ever tested this?

I've deployed fresh new AATP 2 month ago, and once we dumped NTDS.dit on DC, ATP did not show any alert 😞

Double checked - ATP sensors were working fine on all DCs during the test.

david caddick · Answer

Daugirdas_Sinkevicius&nbsp;specifically this is what we saw:https://docs.microsoft.com/en-us/azure-advanced-threat-protection/exfiltration-alerts#data-exfiltration-over-smb-external-id-2030Might check using SMB maybe?

Forum Discussion

Azure ATP posibilities to detect NTDS.dit dump

3 Replies