---
title: Tip: three cheap, high-signal ransomware alerts from the 3AM school case: new AD domain trusts, reads of the Veeam credentials table, and reg save of SAM/SECURITY/SYSTEM | ctxsec
url: https://ctxsec.com/items/tip-alert-new-ad-domain-trusts-netdom-and-veeam-credential-reads
description: "In Bitdefender's 3AM case the attacker stole backup credentials first and built cross-domain trusts before encrypting. Both are rare changes on a healthy network, so alerting on them catches this playbook whether a person or a model is typing."
status: "official (recommendations from Bitdefender's 3AM case, Nov 3; Windows event IDs per Microsoft documentation)"
published: 2026-11-03
---

> In Bitdefender's 3AM case the attacker stole backup credentials first and built cross-domain trusts before encrypting. Both are rare changes on a healthy network, so alerting on them catches this playbook whether a person or a model is typing.

[← Tips & Guides](/tips) · [markdown](/items/tip-alert-new-ad-domain-trusts-netdom-and-veeam-credential-reads.md)

official (recommendations from Bitdefender's 3AM case, Nov 3; Windows event IDs per Microsoft documentation)

2026-11-03

### Tip: three cheap, high-signal ransomware alerts from the 3AM school case: new AD domain trusts, reads of the Veeam credentials table, and reg save of SAM/SECURITY/SYSTEM

- **Domain trusts:** alert on Windows Security event 4706 (a trust to a domain was created) and 4716 (trust information modified) on domain controllers, and on any `netdom trust` or `dnscmd … /zoneadd … /forwarder` process execution. Put trust changes behind change control.
- **Backup credentials:** alert when anything other than the Veeam service queries `[VeeamBackup].[dbo].[Credentials]` (SQL audit), or when PowerShell on a backup server calls `ProtectedData]::Unprotect`. Scope Veeam accounts per domain and keep immutable copies no domain account can delete.
- **Hive dumps:** alert on `reg save HKLM\SAM`, `HKLM\SECURITY` or `HKLM\SYSTEM` outside known backup jobs, and on remote access to the `winreg` pipe from workstations.
- **Coverage gap:** every action in this case came from an internal machine without an EDR agent. Reconcile your asset list against EDR enrollment; unmanaged hosts are where attackers stage.

Sources: [Bitdefender: 3AM Hits European Schools: A Hybrid AI Ransomware Attack](https://businessinsights.bitdefender.com/3am-ransomware-hybrid-ai-attack) · [Microsoft Learn: Event 4706, a new trust was created to a domain](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706)