CmdID

CmdID / Techniques / T1003

T1003.003 OS Credential Dumping: NTDS

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. MITRE ATT&CK

6 programs on CmdID 12 Sigma rules T1003.003 on attack.mitre.org

Part of

MITRE ATT&CK
T1003OS Credential Dumping

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
diskshadow.exeDumpdsdbutil.exeDumpesentutl.exeCopyntdsutil.exeDumpprint.exeits Sigma ruleswbadmin.exeDump

Sigma rules tagged with it

process creation, the highest levels first
criticalPotential Russian APT Credential Theft ActivityFlorian Roth (Nextron Systems) · Windows
highCopying Sensitive Files with Credential DataTeymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community · Windows
highPUA - DIT Snapshot ViewerFurkan Caliskan (@caliskanfurkan_) · Windows
highSensitive File Dump Via Print.EXEAyush Anand (Securityinbits) · Windows
highSensitive File Dump Via Wbadmin.EXENasreddine Bencherchali (Nextron Systems), frack113 · Windows
highSensitive File Recovery From Backup Via Wbadmin.EXENasreddine Bencherchali (Nextron Systems), frack113 · Windows
highSuspicious Process Patterns NTDS.DIT ExfilFlorian Roth (Nextron Systems) · Windows
highVolumeShadowCopy Symlink Creation Via MklinkTeymur Kheirkhabarov, oscd.community · Windows
mediumEsentutl Gather Credentialssam0x90 · Windows
mediumInvocation of Active Directory Diagnostic Tool (ntdsutil.exe)Thomas Patzke · Windows
mediumShadow Copies Creation Using Operating Systems UtilitiesTeymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community · Windows
mediumSuspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)Nasreddine Bencherchali (Nextron Systems) · Windows