DET0586 Detection of NTDS.dit Credential Dumping from Domain Controllers
| Item |
Value |
| ID |
DET0586 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1003.003 (NTDS)
Analytics
Windows
AN1611
Detects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\NTDS\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.
Log Sources
Mutable Elements
| Field |
Description |
| TargetFilePath |
Tunable for NTDS file location or backup paths if organization uses custom domain controller storage structure. |
| ParentProcessName |
Can suppress backup-related parent processes to reduce false positives. |
| TimeWindow |
Temporal correlation between shadow copy creation and NTDS file access (e.g., 5 min window). |
| UserContext |
Tune based on expected privileged user/service account behavior. |