Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0006 ✕

Download CSV Show ATT&CK heatmap
  • Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin High

    Attackers may attempt to dump the ntds.dit file, which stores all Active Directory account information, to later extract passwords and hashes from it.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping: NTDS (T1003.003)
    Required data: XDR Agent
    Attacker's goals: Retrieve Active Directory data, to perform malicious activities such as lateral movement.
    Investigative actions: Check the initiator process for additional suspicious activity.