Cortex XDR
#Scenario
Hunt down and intercept attackers using the native 'Install from Media' feature to clone your Active Directory database for offline credential cracking.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet - Offline NTDS Harvesting via IFM
## Scenario:
An actor with domain-controller access uses `ntdsutil` with the Install From Media (`ifm`) sub-command to create an offline copy of `NTDS.dit` for credential harvesting. Outside a planned DC promotion this is essentially never legitimate.
## Logic:
Triggers on the documented `create full` / `create sysvol` IFM sub-commands. Each hit should produce a ticket; cross-reference the hostname against your known DC list and confirm with the AD team.
- [https://attack.mitre.org/techniques/T1003/003/](https://attack.mitre.org/techniques/T1003/003/)
- [https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "ntdsutil.exe"
| filter lowercase(action_process_image_command_line) contains "ifm"
and lowercase(action_process_image_command_line) contains "create"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 100