Procedure examples

gsecdump can dump Windows password hashes from the SAM.

CrackMapExec can dump usernames and hashed passwords from the SAM.

Koadic can gather hashed passwords by dumping SAM/SECURITY hive.

During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.

During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract
ntds.dit.

During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via vssadmin.

During the 2025 Poland Wiper Attacks, the adversaries dumped the entire Active Directory database by extracting the contents of the ntds.dit file.

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.

APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.

menuPass has used Ntdsutil to dump credentials.

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.

Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.

Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.

MirrorFace has dumped NTDS.dit through volume shadow copies.

Medusa Group has accessed the ntds.dit file to engage in credential dumping.

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.

Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.

LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database.

Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.

FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.

esentutl can copy `ntds.dit` using the Volume Shadow Copy service.

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.

Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.

Dragonfly has dropped and executed SecretsDump to dump password hashes.

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.

MuddyWater has performed credential dumping with LaZagne.

Leafminer used several tools for retrieving login and password information, including LaZagne.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Ke3chang has dumped credentials, including by using gsecdump.

APT29 has used the `reg save` command to extract LSA secrets offline.

Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

CosmicDuke collects LSA secrets.

IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

AADInternals can dump secrets from the Local Security Authority.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.

gsecdump can dump LSA secrets.

LaZagne can perform credential dumping from LSA secrets to obtain account and password information.

CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.

Pupy can use Lazagne for harvesting credentials.

MuddyWater has performed credential dumping with LaZagne.

Leafminer used several tools for retrieving login and password information, including LaZagne.