OS Credential Dumping: NTDS

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.[1]

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.[2]

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

  • Volume Shadow Copy
  • secretsdump.py
  • Using the in-built Windows tool, ntdsutil.exe
  • Invoke-NinjaCopy
ID: T1003.003
Sub-technique of:  T1003
Platforms: Windows
System Requirements: Access to Domain Controller or backup
Permissions Required: Administrator
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 1.1
Created: 11 February 2020
Last Modified: 08 March 2022

Procedure Examples

ID Name Description
G0007 APT28

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.[3]

G0114 Chimera

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.[4] Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.[5]

S0488 CrackMapExec

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.[6]

G0035 Dragonfly

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.[7][8]

S0404 esentutl

esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit.[9][10]

G0037 FIN6

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.[11][12]

G0117 Fox Kitten

Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.[13]


HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).[14]

S0357 Impacket

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.[15]

G0004 Ke3chang

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.[16]

S0250 Koadic

Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.[17]


LAPSUS$ has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.[18]

G0045 menuPass

menuPass has used Ntdsutil to dump credentials.[19]

G0129 Mustang Panda

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.[20]

G0034 Sandworm Team

Sandworm Team has used ntdsutil.exe to back up the Active Directory database, likely for credential access.[21]

G0102 Wizard Spider

Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.[22]


ID Mitigation Description
M1041 Encrypt Sensitive Information

Ensure Domain Controller backups are properly secured.[2]

M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1026 Privileged Account Management

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

M1017 User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.


ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. Look for command-lines that invoke attempts to access or copy the NTDS.dit.

DS0022 File File Access

Monitor for access or copy of the NTDS.dit.