wbadmin NTDS.dit dump detection for Domain Controllers

When wbadmin.exe is used to back up NTDS.dit + registry hives, treat it as credential access, not routine IT backup. This post is for Elastic + Sigma + Windows logs and focuses on wbadmin NTDS.dit dump detection you can validate end-to-end in a lab.

You will: spot the command, confirm artifacts on disk, and alert in MDE/Elastic with Sigma-derived logic. 🔎

wbadmin.exe can create VSS backups of files that are normally locked, including:

• C:\Windows\NTDS\ntds.dit (AD database)
• SYSTEM and SECURITY hives (needed for offline credential)

The signal is in what is included and where the backup is written.

Attackers commonly run a one-time backup and write output to a convenient local path via a loopback UNC.

wbadmin.exe start backup -backuptarget:\\127.0.0.1\C$\ProgramData\ -include":C:\windows\NTDS\ntds.dit,C:\windows\system32\config\SYSTEM,C:\windows\system32\config\SECURITY" -quiet

What to notice:

• -include targets NTDS.dit and SYSTEM/SECURITY. That is the high-signal part.
• -backuptarget:\\127.0.0.1\C$\ProgramData\ writes to the local C: drive through an admin share (easy staging). ⚠️

Use filesystem artifacts to confirm the alert is real and to find what needs containment. This dir structure may be already removed by the attacker.

No spam. Unsubscribe anytime.

After dump this is how it looks like

Look for:

• New backup directory created under the target path.
• Backup container VHDX files with timestamps matching the wbadmin execution.

After mounting vhdx files
vhdx file will contain the files included in the backup

If NTDS/hives are missing after mounting, the job likely failed or you mounted the wrong container. Use backup logs below to confirm.

Backup logs tell you whether the job completed and can help you scope impact fast.

Get the logs about backup operation from Microsoft-Windows-Backup

Get-WinEvent -FilterHashtable @{
  LogName   = 'Microsoft-Windows-Backup'
  Id        = 1,4,5,14   # 1=Started, 4=Success, 5=Failure, 14=Completed
  StartTime = (Get-Date).AddHours(-1.5)
} | Sort-Object TimeCreated |
Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

What you want:

• A start event near the wbadmin process time.
• A completed/success event if a usable copy exists on disk.
• Any failure details (permissions, target path, missing components).

Upstream Sigma already covers this pattern (wbadmin NTDS.dit dump detection). Use it as a baseline, then tune around maintenance windows and known backup accounts.

Sigma Alert in Kibana

Elastic Process Tree

Practical tuning
Prioritize alerts where ProcessCommandLine also contains admin shares (for example \\127.0.0.1\C$\) or unusual backup targets. Suppress only after baselining normal backup tooling on DCs.

These queries were generated by converting the Sigma rule with pySigma backends.

Detects the dump of highly sensitive files such as “NTDS.DIT” and “SECURITY” hive. Attackers can leverage the “wbadmin” utility in order to dump sensitive files that might contain credential or sensitive information.

Thanks to @frack113 and @nas_bench for publishing the awesome Sigma rules and helping the community.

1. Who ran it (user, logon type, remote session)?
2. Did backup logs show success (a real copy likely exists)?
3. What is the backup target path and what files were written there?
4. Any follow-on activity touching the backup path (archive tools, outbound transfers, remote tooling)?

✅ If the job completed and this activity is not expected, escalate as probable domain compromise.

• How to set up Sigma rules for Elasticsearch SIEM
• LSASS Dump via comsvcs.dll: Defender Detection Guide
• Discovery using nltest, net and whoami

• Detects the dump of highly sensitive files such as “NTDS.DIT” and “SECURITY” hive.
• Wbadmin | LOLBAS
• From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira – The DFIR Report
• wbadmin start backup | Microsoft Learn
• OS Credential Dumping: NTDS (T1003.003) | MITRE ATT&CK