Credential Access

2 items, newest first.

• 

  wbadmin NTDS.dit dump detection for Domain Controllers

  Jan 3, 2026

  wbadmin NTDS.dit dump detection for DCs using Sigma, MDE KQL, and Elastic plus fast triage with Backup logs.

• 

  LSASS Dump via comsvcs.dll: Defender Detection Guide

  Sep 25, 2025

  Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic