Analytics BIOC
High
✕
Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin
Attackers may attempt to dump the ntds.dit file, which stores all Active Directory account information, to later extract passwords and hashes from it.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping: NTDS (T1003.003)
Attacker's goals:
Retrieve Active Directory data, to perform malicious activities such as lateral movement.
Investigative actions:
Check the initiator process for additional suspicious activity.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day