{"id":"T1003.003","name":"NTDS","url":"https://attack.mitre.org/techniques/T1003/003","tactics":["credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0586","stix_id":"x-mitre-detection-strategy--a97fe87f-e9be-4f71-8530-af5d70eaddf3","name":"Detection of NTDS.dit Credential Dumping from Domain Controllers","url":"https://attack.mitre.org/detectionstrategies/DET0586","analytics":[{"id":"AN1611","stix_id":"x-mitre-analytic--1c715030-9564-482d-98b7-22072bf28c97","name":"Analytic 1611","description":"Detects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\\NTDS\\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.","url":"https://attack.mitre.org/detectionstrategies/DET0586#AN1611","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=2","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-VSS","channel":"Volume Shadow Copy Creation","data_component":"DC0097","data_component_name":"Volume Creation","log_source_slug":"wineventlog-microsoft-windows-vss"}],"mutable_elements":[{"field":"TargetFilePath","description":"Tunable for NTDS file location or backup paths if organization uses custom domain controller storage structure."},{"field":"ParentProcessName","description":"Can suppress backup-related parent processes to reduce false positives."},{"field":"TimeWindow","description":"Temporal correlation between shadow copy creation and NTDS file access (e.g., 5 min window)."},{"field":"UserContext","description":"Tune based on expected privileged user/service account behavior."}],"live":true,"detection_strategies":["DET0586"],"techniques":["T1003.003"]}],"live":true,"version":"1.0","techniques":["T1003.003"]}],"sigma_rules":[{"id":"0b8baa3f-575c-46ee-8715-d6f28cc7d33c","title":"NTDS.DIT Created","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-05-05","modified":null,"description":"Detects creation of a file named \"ntds.dit\" (Active Directory Database)","references":["Internal Research"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/file/file_event/file_event_win_ntds_dit_creation.yml","techniques":["T1003.003"],"cves":[]},{"id":"11b1ed55-154d-4e82-8ad7-83739298f720","title":"NTDS.DIT Creation By Uncommon Process","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-01-11","modified":"2022-07-14","description":"Detects creation of a file named \"ntds.dit\" (Active Directory Database) by an uncommon process or a process located in a suspicious directory","references":["https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/","https://adsecurity.org/?p=2398"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.003"],"path":"rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml","techniques":["T1003.002","T1003.003"],"cves":[]},{"id":"252902e3-5830-4cf6-bf21-c22083dfd5cf","title":"Possible Impacket SecretDump Remote Activity","author":"Samir Bousseaden, wagga","status":"test","level":"high","date":"2019-04-03","modified":"2022-08-11","description":"Detect AD credential dumping using impacket secretdump HKTL","references":["https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.004","attack.t1003.003"],"path":"rules/windows/builtin/security/win_security_impacket_secretdump.yml","techniques":["T1003.002","T1003.004","T1003.003"],"cves":[]},{"id":"2afafd61-6aae-4df4-baed-139fa1f4c345","title":"Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)","author":"Thomas Patzke","status":"test","level":"medium","date":"2019-01-16","modified":"2022-03-11","description":"Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)","references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml","techniques":["T1003.003"],"cves":[]},{"id":"2e69f167-47b5-4ae7-a390-47764529eff5","title":"Transferring Files with Credential Data via Network Shares - Zeek","author":"@neu5ron, Teymur Kheirkhabarov, oscd.community","status":"test","level":"medium","date":"2020-04-02","modified":"2021-11-27","description":"Transferring files with well-known filenames (sensitive files with credential data) using network shares","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"zeek","service":"smb_files"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.001","attack.t1003.003"],"path":"rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml","techniques":["T1003.002","T1003.001","T1003.003"],"cves":[]},{"id":"2fcda7e2-8c57-4904-86ac-37fc3157e09d","title":"Sensitive File Dump Via Print.EXE","author":"Ayush Anand (Securityinbits)","status":"test","level":"high","date":"2026-04-28","modified":null,"description":"Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.\n","references":["https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2","https://lolbas-project.github.io/lolbas/Binaries/Print/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.stealth","attack.t1003.003","attack.t1003.002","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files.yml","techniques":["T1003.003","T1003.002","T1218"],"cves":[]},{"id":"3a8da4e0-36c1-40d2-8b29-b3e890d5172a","title":"NTDS Exfiltration Filename Patterns","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-11","modified":"2023-05-05","description":"Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.","references":["https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb","https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1","https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml","techniques":["T1003.003"],"cves":[]},{"id":"40b19fa6-d835-400c-b301-41f3a2baacaf","title":"VolumeShadowCopy Symlink Creation Via Mklink","author":"Teymur Kheirkhabarov, oscd.community","status":"stable","level":"high","date":"2019-10-22","modified":"2023-03-06","description":"Shadow Copies storage symbolic link creation using operating systems utilities","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml","techniques":["T1003.002","T1003.003"],"cves":[]},{"id":"4e7050dd-e548-483f-b7d6-527ab4fa784d","title":"NTDS.DIT Creation By Uncommon Parent Process","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-11","modified":"2023-01-05","description":"Detects creation of a file named \"ntds.dit\" (Active Directory Database) by an uncommon parent process or directory","references":["https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/","https://pentestlab.blog/tag/ntds-dit/","https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml","techniques":["T1003.003"],"cves":[]},{"id":"7df1713a-1a5b-4a4b-a071-dc83b144a101","title":"Esentutl Gather Credentials","author":"sam0x90","status":"test","level":"medium","date":"2021-08-06","modified":"2022-10-09","description":"Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.","references":["https://twitter.com/vxunderground/status/1423336151860002816","https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1003.003","attack.s0404"],"path":"rules/windows/process_creation/proc_creation_win_esentutl_params.yml","techniques":["T1003","T1003.003"],"cves":[]},{"id":"84972c80-251c-4c3a-9079-4f00aad93938","title":"Sensitive File Recovery From Backup Via Wbadmin.EXE","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2024-05-10","modified":null,"description":"Detects the dump of highly sensitive files such as \"NTDS.DIT\" and \"SECURITY\" hive.\nAttackers can leverage the \"wbadmin\" utility in order to dump sensitive files that might contain credential or sensitive information.\n","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml","https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml","techniques":["T1003.003"],"cves":[]},{"id":"8b93a509-1cb8-42e1-97aa-ee24224cdc15","title":"Sensitive File Dump Via Wbadmin.EXE","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2024-05-10","modified":null,"description":"Detects the dump of highly sensitive files such as \"NTDS.DIT\" and \"SECURITY\" hive.\nAttackers can leverage the \"wbadmin\" utility in order to dump sensitive files that might contain credential or sensitive information.\n","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml","https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml","techniques":["T1003.003"],"cves":[]},{"id":"8bc64091-6875-4881-aaf9-7bd25b5dda08","title":"Suspicious Process Patterns NTDS.DIT Exfil","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-11","modified":"2022-11-10","description":"Detects suspicious process patterns used in NTDS.DIT exfiltration","references":["https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/","https://pentestlab.blog/tag/ntds-dit/","https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1","https://github.com/zcgonvh/NTDSDumpEx","https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1","https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_ntds.yml","techniques":["T1003.003"],"cves":[]},{"id":"8fbf3271-1ef6-4e94-8210-03c2317947f6","title":"Cred Dump Tools Dropped Files","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"high","date":"2019-11-01","modified":"2025-10-25","description":"Files with well-known filenames (parts of credential dump software or files produced by them) creation","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1003.001","attack.t1003.002","attack.t1003.003","attack.t1003.004","attack.t1003.005"],"path":"rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml","techniques":["T1003.001","T1003.002","T1003.003","T1003.004","T1003.005"],"cves":[]},{"id":"910ab938-668b-401b-b08c-b596e80fdca5","title":"Transferring Files with Credential Data via Network Shares","author":"Teymur Kheirkhabarov, oscd.community","status":"test","level":"medium","date":"2019-10-22","modified":"2025-07-11","description":"Transferring files with well-known filenames (sensitive files with credential data) using network shares","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.001","attack.t1003.003"],"path":"rules/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml","techniques":["T1003.002","T1003.001","T1003.003"],"cves":[]},{"id":"92dae1ed-1c9d-4eff-a567-33acbd95b00e","title":"Possible Impacket SecretDump Remote Activity - Zeek","author":"Samir Bousseaden, @neu5ron","status":"test","level":"high","date":"2020-03-19","modified":"2021-11-27","description":"Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml","references":["https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html"],"logsource":{"product":"zeek","service":"smb_files"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.004","attack.t1003.003"],"path":"rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml","techniques":["T1003.002","T1003.004","T1003.003"],"cves":[]},{"id":"a58353df-af43-4753-bad0-cd83ef35eef5","title":"Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-14","modified":null,"description":"Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml","techniques":["T1003.003"],"cves":[]},{"id":"afd12fed-b0ec-45c9-a13d-aa86625dac81","title":"Create Volume Shadow Copy with Powershell","author":"frack113","status":"test","level":"high","date":"2022-01-12","modified":null,"description":"Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information","references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1003.003","attack.ds0005"],"path":"rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml","techniques":["T1003.003"],"cves":[]},{"id":"b140afd9-474b-4072-958e-2ebb435abd68","title":"Suspicious Get-ADDBAccount Usage","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-16","modified":null,"description":"Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers","references":["https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/","https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml","techniques":["T1003.003"],"cves":[]},{"id":"b17ea6f7-6e90-447e-a799-e6c0a493d6ce","title":"Shadow Copies Creation Using Operating Systems Utilities","author":"Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2019-10-22","modified":"2022-11-10","description":"Shadow Copies creation using operating systems utilities, possible credential access","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1003.002","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml","techniques":["T1003","T1003.002","T1003.003"],"cves":[]},{"id":"b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee","title":"Potential Russian APT Credential Theft Activity","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2019-02-21","modified":"2023-03-08","description":"Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike","references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.001","attack.t1003.003","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Bear-APT-Activity/proc_creation_win_apt_bear_activity_gtr19.yml","techniques":["T1552.001","T1003.003"],"cves":[]},{"id":"d3b70aad-097e-409c-9df2-450f80dc476b","title":"PUA - DIT Snapshot Viewer","author":"Furkan Caliskan (@caliskanfurkan_)","status":"test","level":"high","date":"2020-07-04","modified":"2023-02-21","description":"Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.","references":["https://thedfirreport.com/2020/06/21/snatch-ransomware/","https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/process_creation/proc_creation_win_pua_ditsnap.yml","techniques":["T1003.003"],"cves":[]},{"id":"e6e88853-5f20-4c4a-8d26-cd469fd8d31f","title":"Ntdsutil Abuse","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-14","modified":null,"description":"Detects potential abuse of ntdsutil to dump ntds.dit database","references":["https://twitter.com/mgreen27/status/1558223256704122882","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)"],"logsource":{"product":"windows","service":"application"},"tags":["attack.credential-access","attack.t1003.003"],"path":"rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml","techniques":["T1003.003"],"cves":[]},{"id":"e7be6119-fc37-43f0-ad4f-1f3f99be2f9f","title":"Copying Sensitive Files with Credential Data","author":"Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community","status":"test","level":"high","date":"2019-10-22","modified":"2024-06-04","description":"Files with well-known filenames (sensitive files with credential data) copying","references":["https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/","https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/","https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003.002","attack.t1003.003","car.2013-07-001","attack.s0404"],"path":"rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml","techniques":["T1003.002","T1003.003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-24919","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}