T1003.003

Sub-technique Windows

NTDS

Description

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

secretsdump.py
Using the in-built Windows tool, ntdsutil.exe
Invoke-NinjaCopy

Mitigations

M1017 — User Training M1026 — Privileged Account Management M1027 — Password Policies M1041 — Encrypt Sensitive Information