NTDS

T1003.003

Sub-technique of T1003 OS Credential Dumping.View on attack.mitre.org

About this technique

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

* Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy

Detection rules29

Rules on DetectionCode tagged with T1003.003.

Sigma23

Rule	Level	Log source
Copying Sensitive Files with Credential Data	high	windows / process_creation
Create Volume Shadow Copy with Powershell	high	windows / ps_script
Cred Dump Tools Dropped Files	high	windows / file_event
NTDS Exfiltration Filename Patterns	high	windows / file_event
NTDS.DIT Creation By Uncommon Parent Process	high	windows / file_event
NTDS.DIT Creation By Uncommon Process	high	windows / file_event
Possible Impacket SecretDump Remote Activity	high	windows / NULL
Possible Impacket SecretDump Remote Activity - Zeek	high	zeek / NULL
PUA - DIT Snapshot Viewer	high	windows / process_creation
Sensitive File Dump Via Print.EXE	high	windows / process_creation
Sensitive File Dump Via Wbadmin.EXE	high	windows / process_creation
Sensitive File Recovery From Backup Via Wbadmin.EXE	high	windows / process_creation
Suspicious Get-ADDBAccount Usage	high	windows / ps_module
Suspicious Process Patterns NTDS.DIT Exfil	high	windows / process_creation
VolumeShadowCopy Symlink Creation Via Mklink	high	windows / process_creation
Esentutl Gather Credentials	medium	windows / process_creation
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)	medium	windows / process_creation
Ntdsutil Abuse	medium	windows / NULL
Shadow Copies Creation Using Operating Systems Utilities	medium	windows / process_creation
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)	medium	windows / process_creation
Transferring Files with Credential Data via Network Shares	medium	windows / NULL
Transferring Files with Credential Data via Network Shares - Zeek	medium	zeek / NULL
NTDS.DIT Created	low	windows / file_event

Splunk6

Rule	Type	Risk	Data source
Creation of Shadow Copy	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Creation of Shadow Copy with wmic and powershell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Credential Dumping via Copy Command from Shadow Copy	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Credential Dumping via Symlink to Shadow Copy	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Ntdsutil Export NTDS	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
SecretDumps Offline NTDS Dumping Tool	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups18

Software4

CrackMapExec esentutl Impacket Koadic

Campaigns4

2025 Poland Wiper Attacks APT28 Nearest Neighbor Campaign Cutting Edge Operation MidnightEclipse

Procedure examples26

Groups18

Used by	Procedure example
GroupAPT28	APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access. Cybersecurity Advisory GRU Brute Force Campaign July 2021
GroupAPT41	APT41 used ntdsutil to obtain a copy of the victim environment `ntds.dit` file. Rostovcev APT41 2021
GroupChimera	Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via `msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv` and used ntdsutil to copy the Active Directory database. Cycraft Chimera April 2020 NCC Group Chimera January 2021
GroupDragonfly	Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers. Core Security Impacket US-CERT TA18-074A
GroupFIN13	FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it. Sygnia Elephant Beetle Jan 2022
GroupFIN6	FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database. FireEye FIN6 Apr 2019 FireEye FIN6 April 2016
GroupFox Kitten	Fox Kitten has used Volume Shadow Copy to access credential information from NTDS. CISA AA20-259A Iran-Based Actor September 2020
GroupHAFNIUM	HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT). Microsoft Silk Typhoon MAR 2025 Volexity Exchange Marauder March 2021

View all 18 groups examples

Software4

Used by	Procedure example
ToolCrackMapExec	CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy. CME Github September 2018
Toolesentutl	esentutl can copy `ntds.dit` using the Volume Shadow Copy service. Cary Esentutl LOLBAS Esentutl
ToolImpacket	SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit. Impacket Tools
ToolKoadic	Koadic can gather hashed passwords by gathering domain controller hashes from NTDS. Github Koadic

Campaigns4

Used by	Procedure example
Campaign2025 Poland Wiper Attacks	During the 2025 Poland Wiper Attacks, the adversaries dumped the entire Active Directory database by extracting the contents of the ntds.dit file. CERT Polska
CampaignAPT28 Nearest Neighbor Campaign	During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via `vssadmin`. Nearest Neighbor Volexity
CampaignCutting Edge	During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract ntds.dit. Volexity Ivanti Zero-Day Exploitation January 2024
CampaignOperation MidnightEclipse	During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file. Volexity UPSTYLE 2024

References2

Metcalf 2015 Open source
Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest. Retrieved February 3, 2015.
Wikipedia Active Directory Open source
Wikipedia. (2018, March 10). Active Directory. Retrieved April 11, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.