Skip to content
Threat Feed
Subscribe

Tag

Ntds

2 briefs RSS
high advisory

NTDS or SAM Database File Copied

Detects copy operations of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files using command-line tools, potentially leading to credential access.

Windows +1 credential-access ntds sam
2r 2t
high advisory

NTDS or SAM Database File Copied

Detects copy operations of Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files, potentially exposing sensitive hashed credentials on Windows systems.

Microsoft Defender XDR +2 credential-access windows ntds sam credential-theft
2r 1t