Active Directory (AD) is the backbone of authentication in Windows environments, storing user credentials, policies, and domain configurations.
Attackers prize the NTDS. dit file the core AD database on Domain Controllers because it holds hashed passwords for every domain account, including Domain Admins.
Stealing it, plus the SYSTEM hive for decryption, lets threat actors crack hashes offline, impersonate any user, and seize complete control.
A recent Trellix Advanced Research Center analysis details a real incident in which intruders used stealthy tactics to dump NTDS.dit, evade defenses, and attempt to exfiltrate it.
Understanding NTDS.dit Compromise
NTDS.dit (NT Directory Services .dit) resides in C:\Windows\NTDS\ on Domain Controllers and is locked during runtime.
Attackers gain admin access via phishing, exploits, or lateral movement, then use living-off-the-land tools to extract it without alerts.
Key steps (T1003.003 – OS Credential Dumping: NTDS):
- Run vssadmin create shadow /for=C: to snapshot the drive, bypassing locks.
- Copy NTDS.dit from the shadow copy with esentutl /y to repair, then tools like SecretsDump or Mimikatz extract hashes.
- Pair with reg save HKLM\SYSTEM system.hive for decryption.
This yields NTLM hashes for pass-the-hash attacks or cracking with Hashcat/John the Ripper. No online logins needed pure offline dominance.
.webp)
Trellix notes that attackers used PsExec for remote execution, hopping systems via SMB (port 445) and blending with legitimate admin traffic.
Timeline pieced six alerts:
- Domain Admin HTTP outbound from workstation.
- PsExec lateral movement.
- Vssadmin shadow creation.
- NTDS.dit/SYSTEM extraction.
- SMB transfers.
- Exfil attempt.
MITRE mapping highlighted T1003.003, T1021.002 (SMB), and T1570 (Lateral Tool Transfer). Without correlation, SOCs chase noise; Helix delivers the story instantly.
MITRE ATT&CK Techniques Table
| Technique ID | Technique Name | Description |
|---|---|---|
| T1003.003 | OS Credential Dumping: NTDS | Extract NTDS.dit via shadow copies. |
| T1021.002 | Remote Services: SMB/Windows Admin Shares | PsExec/SMB for lateral movement. |
| T1560.002 | Archive Collected Data: Archive via Utility | Compress NTDS.dit for exfil. |
| T1048 | Exfiltration Over Alternative Protocol | HTTP outbound with DB file. |
Trellix Product Coverage Table
| Product | Key Signatures/Indicators |
|---|---|
| Trellix Helix | Credential Theft: NTDS.dit Exfil; PsExec AD Dump; Lateral PsExec. |
| Trellix NDR | NTDS.dit Exfil Attempt; Shadow Copy to Host; Dump NTDS/SYSTEM. |
| Trellix EDR | PsExec NTDSUtil; Unsecured AD Creds; Vssadmin Shadow; DC Hash Dump. |
Immediate Actions
- Contain: Isolate hosts, deactivate privileged accounts, block outbound traffic.
- Reset: All priv passwords; KRBTGT twice; enforce MFA.
- Hunt: Logs for PsExec, auth anomalies; kill persistence.
- Harden: Credential Guard, PAWs, allowlist PsExec/vssadmin, tiered admins.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 is the backbone of authentication in Windows environments, storing user credentials, policies, and domain){kind=link}