Suspicious NTDS.DIT Credential Dumping Patterns

The NTDS.DIT file is the primary database for Active Directory, containing sensitive information including password hashes. Attackers commonly attempt to exfiltrate this file to perform offline credential recovery. This activity often involves native binaries like ntdsutil, which can be misused to create an Install from Media (IFM) set, or simple file system operations to copy the database file. Additionally, offensive security tools such as NTDSDumpEx or PowerShell-based scripts are frequently deployed in compromised environments. Defenders must monitor for unauthorized execution of these tools or suspicious process behavior that interacts with the NTDS.DIT file path. This intelligence covers common exfiltration patterns that detection engineers should prioritize when monitoring Windows process execution.

Attack Chain

1. Initial access is established on a domain controller or system with sufficient privileges.
2. The attacker identifies the location of the NTDS.DIT database file (typically C:\Windows\NTDS\ntds.dit).
3. The attacker utilizes native binaries like 'ntdsutil.exe' to initiate an 'ifm' (Install from Media) operation to create a snapshot of the database.
4. Alternatively, the attacker uses the 'copy' command or PowerShell to move the database file to a staging directory.
5. Offensive scripts or specialized binaries like 'NTDSDumpEx.exe' are executed to interact with the database.
6. The system registry 'system.hiv' file is often dumped concurrently to extract the decryption keys.
7. The attacker exfiltrates the database and key files from the network for offline processing.
8. The final objective is the acquisition of domain user credentials and potential privilege escalation.

Impact

Successful exfiltration of the NTDS.DIT database typically leads to full domain compromise, as an attacker can crack all user hashes offline without further interaction with the network. This results in broad unauthorized access to corporate resources, data exfiltration, and potential ransomware deployment.

Recommendation

• Deploy the Sigma rule below to monitor process creation events for suspicious NTDS-related activity.
• Enable Sysmon or Windows Event ID 4688 to capture the full Command Line for processes interacting with the NTDS folder.
• Baseline administrative usage of 'ntdsutil.exe' in your environment to distinguish legitimate domain controller maintenance from malicious activity.
• Prioritize monitoring for processes executing from temporary folders (e.g., \AppData, \Temp) that also access the NTDS.DIT path.