OS Credential Dumping: NTDS

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.^[3]

During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via vssadmin.^[4]

APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.^[5]

Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.^[6] Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.^[7]

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.^[8]

During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract
ntds.dit.^[9]

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.^[10][11]

esentutl can copy ntds.dit using the Volume Shadow Copy service.^[12][13]

FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.^[14]

FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.^[15][16]

Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.^[17]

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).^[18][19]

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.^[20]

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.^[21]

Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.^[22]

LAPSUS$ has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.^[23]

Medusa Group has accessed the ntds.dit file to engage in credential dumping.^[24]

menuPass has used Ntdsutil to dump credentials.^[25]

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.^[26][27]

During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.^[28]

Sandworm Team has used ntdsutil.exe to back up the Active Directory database, likely for credential access.^[29]

Scattered Spider has extracted the NTDS.dit file by creating volume shadow copies of virtual domain controller disks.^[30][31][32]

Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.^{[33][34][35][36]}

Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.^[37][38]

Ensure Domain Controller backups are properly secured.^[2]

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.