Skip to content
Threat Feed

Tag

Ninjacopy

1 brief RSS
high advisory

PowerShell Invoke-NinjaCopy Script Detection

The Invoke-NinjaCopy PowerShell script is used by attackers to directly access volume files, such as NTDS.dit or registry hives, for credential dumping.

Windows credential-access powershell ninjacopy
2r 1t