Attackers are increasingly targeting Active Directory domain controllers to steal credentials stored in the NTDS.dIT database.
A recent simulation shows how threat actors can combine native Windows features, remote administration tools, and credential-dumping utilities to copy the Active Directory database and the SYSTEM registry hive before exfiltrating them.
The NTDS.dit file holds critical domain identity data, including NTLM password hashes, Kerberos keys, account information, and password-history data.
If attackers obtain both NTDS.dit and the SYSTEM hive, they may decrypt the database offline and gain access to credentials for every domain account.
Attackers Extract NTDS Credentials
The attack typically begins with initial access through spear-phishing emails, malicious Office files, LNK attachments, or trojanized software installers.
Once a victim runs the initial payload, attackers may load a second-stage implant directly into memory to reduce disk-based evidence.
The malware then connects to a command-and-control server using encrypted traffic. Attackers attempt to elevate privileges to NT AUTHORITY\SYSTEM, allowing them to access protected processes and sensitive operating-system resources.
At this stage, they may target LSASS memory to collect NTLM hashes and Kerberos tickets. Stolen credentials can then be reused for pass-the-hash or pass-the-ticket attacks.
This allows intruders to move laterally through the network and reach a domain controller, which is the most valuable target in an Active Directory environment.
To obtain the Active Directory database, attackers can use PsExec over SMB or an existing remote session on the domain controller.
Because Windows locks the NTDS.dit file while Active Directory is running, adversaries abuse the Volume Shadow Copy Service (VSS) to create a readable copy of the database.
They also copy the SYSTEM registry hive, which contains the boot key needed to decrypt the protected credential data in NTDS.dit.
Tools such as Impacket secretsdump or DSInternals can then extract password hashes and Kerberos-related information from the copied files offline.
The final stage is data exfiltration. Attackers may send the stolen files through HTTPS to cloud storage or attacker-controlled infrastructure, blending credential theft traffic with normal encrypted web activity.
Security teams should detect the behavior behind this attack instead of relying only on signatures for PsExec, Metasploit, Meterpreter, or secretsdump.
Threat actors can switch tools quickly, but the core actions shadow-copy creation, NTDS.dit access, SYSTEM-hive collection, SMB movement, and large outbound transfers remain highly suspicious.
Network Detection and Response platforms can identify this chain by correlating credential-dumping activity with file transfers and unusual outbound connections.
Trellix NDR, for example, can generate alerts when NTDS.dit and SYSTEM hive files are collected or later transferred outside the organization.
Its investigation workflow can also map observed activity to MITRE ATT&CK techniques and recommend remediation actions.
Organizations should monitor domain controllers for unexpected VSS activity, remote SMB administration, access to NTDS.dit paths, registry-hive exports, and unusually large file transfers.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
