Techniques › T1003 › T1003.003
T1003.003 NTDS
credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
24
Sigma rules tagged attack.t1003.003
3
KEV CVEs mapped here
<p>Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.</p><p>In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.</p><p>The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.</p>
- <li>Volume Shadow Copy</li><li>secretsdump.py</li><li>Using the in-built Windows tool, ntdsutil.exe</li><li>Invoke-NinjaCopy</li>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-24919 | Check Point Quantum Security Gateways | secondary impact | Mapped | 2024-05-30 |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | secondary impact | Mapped | 2021-12-01 |
| CVE-2021-40539 | Zoho ManageEngine | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0586 Detection of NTDS.dit Credential Dumping from Domain Controllers v1.0
AN1611 WindowsDetects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\NTDS\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.Tunable:
TargetFilePathParentProcessNameTimeWindowUserContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1003.003
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-05 · logsource: product=windows category=file_event · 0b8baa3f-575c-46ee-8715-d6f28cc7d33c
Detects creation of a file named "ntds.dit" (Active Directory Database)
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-11 (modified 2022-07-14) · logsource: product=windows category=file_event · 11b1ed55-154d-4e82-8ad7-83739298f720
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Author: Samir Bousseaden, wagga
· 2019-04-03 (modified 2022-08-11) · logsource: product=windows service=security · 252902e3-5830-4cf6-bf21-c22083dfd5cf
Detect AD credential dumping using impacket secretdump HKTL
Author: Thomas Patzke
· 2019-01-16 (modified 2022-03-11) · logsource: product=windows category=process_creation · 2afafd61-6aae-4df4-baed-139fa1f4c345
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Author: @neu5ron, Teymur Kheirkhabarov, oscd.community
· 2020-04-02 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 2e69f167-47b5-4ae7-a390-47764529eff5
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Author: Ayush Anand (Securityinbits)
· 2026-04-28 · logsource: product=windows category=process_creation · 2fcda7e2-8c57-4904-86ac-37fc3157e09d
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Author: Florian Roth (Nextron Systems)
· 2022-03-11 (modified 2023-05-05) · logsource: product=windows category=file_event · 3a8da4e0-36c1-40d2-8b29-b3e890d5172a
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.
Author: Teymur Kheirkhabarov, oscd.community
· 2019-10-22 (modified 2023-03-06) · logsource: product=windows category=process_creation · 40b19fa6-d835-400c-b301-41f3a2baacaf
Shadow Copies storage symbolic link creation using operating systems utilities
Author: Florian Roth (Nextron Systems)
· 2022-03-11 (modified 2023-01-05) · logsource: product=windows category=file_event · 4e7050dd-e548-483f-b7d6-527ab4fa784d
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Author: sam0x90
· 2021-08-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7df1713a-1a5b-4a4b-a071-dc83b144a101
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2024-05-10 · logsource: product=windows category=process_creation · 84972c80-251c-4c3a-9079-4f00aad93938
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2024-05-10 · logsource: product=windows category=process_creation · 8b93a509-1cb8-42e1-97aa-ee24224cdc15
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Author: Florian Roth (Nextron Systems)
· 2022-03-11 (modified 2022-11-10) · logsource: product=windows category=process_creation · 8bc64091-6875-4881-aaf9-7bd25b5dda08
Detects suspicious process patterns used in NTDS.DIT exfiltration
Author: Teymur Kheirkhabarov, oscd.community
· 2019-11-01 (modified 2025-10-25) · logsource: product=windows category=file_event · 8fbf3271-1ef6-4e94-8210-03c2317947f6
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Author: Teymur Kheirkhabarov, oscd.community
· 2019-10-22 (modified 2025-07-11) · logsource: product=windows service=security · 910ab938-668b-401b-b08c-b596e80fdca5
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Author: Samir Bousseaden, @neu5ron
· 2020-03-19 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 92dae1ed-1c9d-4eff-a567-33acbd95b00e
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-14 · logsource: product=windows category=process_creation · a58353df-af43-4753-bad0-cd83ef35eef5
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Author: frack113
· 2022-01-12 · logsource: product=windows category=ps_script · afd12fed-b0ec-45c9-a13d-aa86625dac81
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information
Author: Florian Roth (Nextron Systems)
· 2022-03-16 · logsource: product=windows category=ps_module · b140afd9-474b-4072-958e-2ebb435abd68
Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2022-11-10) · logsource: product=windows category=process_creation · b17ea6f7-6e90-447e-a799-e6c0a493d6ce
Shadow Copies creation using operating systems utilities, possible credential access
Author: Florian Roth (Nextron Systems)
· 2019-02-21 (modified 2023-03-08) · logsource: product=windows category=process_creation · b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
Author: Furkan Caliskan (@caliskanfurkan_)
· 2020-07-04 (modified 2023-02-21) · logsource: product=windows category=process_creation · d3b70aad-097e-409c-9df2-450f80dc476b
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-14 · logsource: product=windows service=application · e6e88853-5f20-4c4a-8d26-cd469fd8d31f
Detects potential abuse of ntdsutil to dump ntds.dit database
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2024-06-04) · logsource: product=windows category=process_creation · e7be6119-fc37-43f0-ad4f-1f3f99be2f9f
Files with well-known filenames (sensitive files with credential data) copying
Rules tagged at the parent level (attack.t1003) 37
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
Author: Thomas Patzke
· 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Author: Florian Roth (Nextron Systems)
· 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea)
· 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec
Detects the execution of the hacktool Rubeus using specific command line flags
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Author: Florian Roth (Nextron Systems)
· 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Author: Pawel Mazur
· 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc
Detect attempt to enable auditing of TTY input
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Author: Andreas Braathen (mnemonic.io)
· 2025-10-19 · logsource: product=windows service=security · 5d6c375a-18ae-4952-b4f6-8b803f6c8555
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
hightest
Author: SecurityAura
· 2022-11-16 (modified 2024-06-27) · logsource: product=windows category=file_event · 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 6e78f90f-0043-4a01-ac41-f97681613a66
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: sam0x90
· 2021-08-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7df1713a-1a5b-4a4b-a071-dc83b144a101
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-04-20) · logsource: product=windows category=process_creation · 7ec2c172-dceb-4c10-92c9-87c1881b7e18
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · 8a1b2c3d-4e5f-6789-abcd-ef1234567890
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Author: frack113, X__Junior (Nextron Systems)
· 2022-04-09 (modified 2024-07-29) · logsource: product=windows category=file_access · 91cb43db-302a-47e3-b3c8-7ede481e27bf
Detects file access requests to browser credential stores by uncommon processes.
Could indicate potential attempt of credential stealing.
Requires heavy baselining before usage
Author: Julia Fomina, oscd.community
· 2020-10-09 (modified 2025-10-31) · logsource: product=windows category=process_creation · 93671f99-04eb-4ab4-a161-70d446a84003
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2022-12-30) · logsource: product=windows category=process_creation · 97dbf6e2-e436-44d8-abee-4261b24d3e41
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=file_event · a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2022-11-10) · logsource: product=windows category=process_creation · b17ea6f7-6e90-447e-a799-e6c0a493d6ce
Shadow Copies creation using operating systems utilities, possible credential access
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-02-02) · logsource: product=windows category=process_creation · baef1ec6-2ca9-47a3-97cc-4cf2bda10b77
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · c1182e02-49a3-481c-b3de-0fadc4091488
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · c5f37810-a85f-4186-81e9-33f23abb4141
Detects file access requests to chromium based browser sensitive files by uncommon processes.
Could indicate potential attempt of stealing sensitive information.
Author: Florian Roth (Nextron Systems), Samir Bousseaden
· 2021-11-27 (modified 2023-03-02) · logsource: product=windows category=process_creation · c8da0dfd-4ed0-4b68-962d-13c9c884384e
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Author: Max Altgelt (Nextron Systems)
· 2021-09-21 (modified 2022-12-25) · logsource: product=windows category=ps_script · cd185561-4760-45d6-a63e-a51325112cae
Detects usage of a PowerShell command to dump the live memory of a Windows machine
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e7d79a1b-25ed-4956-bd56-bd344fa8fd06
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 · logsource: product=windows category=process_creation · e83e8899-c9b2-483b-b355-5decc942b959
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · f41b0311-44f9-44f0-816d-dd45e39d4bc8
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.