OS Credential Dumping: NTDS (T1003.003)

Tactic: Credential Access · Platforms: Windows

The interactive view maps 1 detection strategy, 4 mitigations, 18 threat groups, 4 software entries, 4 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of OS Credential Dumping (T1003).

Overview

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

* Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy

Explore

• Open T1003.003 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1003.003
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan