Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Vice Society – ntdsutil NTDS Dump Paired with Minidump-Based LSASS Access

Vicesociety Lateral Movement Sentinel
MITRE ATT&CK
SMB/Windows Admin Shares
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (vicesociety)
What This Detects
Vice Society dumps NTDS.dit via ntdsutil and separately accesses LSASS via a 'minidump'-style technique (avoiding common ProcDump signatures) within the same intrusion window.
Query
let ntds = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "ntdsutil.exe" and ProcessCommandLine has_any ("ifm","create full")
| project DeviceName, NtdsTime = Timestamp;
let lsassAccess = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has "minidump" and ProcessCommandLine has "lsass"
| project DeviceName, DumpTime = Timestamp;
ntds
| join kind=inner lsassAccess on DeviceName
| where DumpTime - NtdsTime between (-2h .. 2h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.