esentutl.exe

esentutl.exe maintains databases built on the Extensible Storage Engine (ESE, also called Jet Blue), the embedded database format behind the Active Directory store (ntds.dit), the Windows Search index, the certificate database, and others. Its legitimate verbs handle database health: /d defragment, /p repair, /r recovery, /g integrity check, and /m dump. The genuine binary lives at C:\Windows\System32\esentutl.exe.

It also has a raw file-copy capability, /y, that can read a file even while another process holds it open, optionally going through a Volume Shadow Copy with /vss. That is genuinely useful for copying a live database during maintenance, but it is the same capability an attacker uses to grab files Windows normally keeps locked.

Legitimately, esentutl is run by administrators and by directory or backup tooling, infrequently and in a maintenance context. On an ordinary workstation it is uncommon. The verb and the files on its command line describe what an instance is doing.

esentutl.exe copies locked credential stores (T1003.003, T1003.002). The /y /vss combination copies a file that is locked while Windows runs: esentutl /y /vss C:\Windows\NTDS\ntds.dit /d C:\temp\ntds.dit on a domain controller lifts the entire Active Directory database (T1003.003), and the same trick copies the SAM and SYSTEM hives for local account hashes (T1003.002). A /y or /vss operation touching ntds.dit or the hive files is close to a confirmed credential-theft attempt.

The same copy verb also reads from remote and WebDAV paths, so esentutl can pull a payload off the internet under a trusted name (T1105). A remote or \\... source is out of place for a database tool.

In every case the binary is the genuine signed esentutl and the operation is a legitimate copy, so path and signature checks pass and even Microsoft-trusting application control allows it. The verb, the files, and the parent are what separate maintenance from theft.