Skip to content

T1003.003 NTDS

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.2

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.1

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

  • Volume Shadow Copy
  • secretsdump.py
  • Using the in-built Windows tool, ntdsutil.exe
  • Invoke-NinjaCopy
Item Value
ID T1003.003
Sub-techniques T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1003.007, T1003.008
Tactics TA0006
Platforms Windows
Version 1.3
Created 11 February 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0007 APT28 APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.8
C0051 APT28 Nearest Neighbor Campaign During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via vssadmin.36
G0096 APT41 APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.29
G0114 Chimera Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.21 Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe “NTDS.dit” -s “SYSTEM” -p RecordedTV_pdmp.txt –users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.22
S0488 CrackMapExec CrackMapExec can dump hashed passwords associated with Active Directory using Windows’ Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.3
C0029 Cutting Edge During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract
ntds.dit.38
G0035 Dragonfly Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.2827
S0404 esentutl esentutl can copy ntds.dit using the Volume Shadow Copy service.54
G1016 FIN13 FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.13
G0037 FIN6 FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim’s Active Directory database.1415
G0117 Fox Kitten Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.23
G0125 HAFNIUM HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).3334
S0357 Impacket SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.6
G0004 Ke3chang Ke3chang has used NTDSDump and other password dumping tools to gather credentials.32
S0250 Koadic Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.7
G1004 LAPSUS$ LAPSUS$ has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.35
G1051 Medusa Group Medusa Group has accessed the ntds.dit file to engage in credential dumping.24
G0045 menuPass menuPass has used Ntdsutil to dump credentials.20
G0129 Mustang Panda Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.3031
C0048 Operation MidnightEclipse During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.37
G0034 Sandworm Team Sandworm Team has used ntdsutil.exe to back up the Active Directory database, likely for credential access.12
G1015 Scattered Spider Scattered Spider has extracted the NTDS.dit file by creating volume shadow copies of virtual domain controller disks.11910
G1017 Volt Typhoon Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.18191716
G0102 Wizard Spider Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.2526

Mitigations

ID Mitigation Description
M1041 Encrypt Sensitive Information Ensure Domain Controller backups are properly secured.1
M1027 Password Policies Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
M1026 Privileged Account Management Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
M1017 User Training Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

References

  1. Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest. Retrieved February 3, 2015. ↩↩

  2. Wikipedia. (2018, March 10). Active Directory. Retrieved April 11, 2018. ↩

  3. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020. ↩

  4. Cary, M. (2018, December 6). Locked File Access Using ESENTUTL.exe. Retrieved September 5, 2019. ↩

  5. LOLBAS. (n.d.). Esentutl.exe. Retrieved September 3, 2019. ↩

  6. SecureAuth. (n.d.). Retrieved January 15, 2019. ↩

  7. Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024. ↩

  8. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  9. Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025. ↩

  10. Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025. ↩

  11. Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024. ↩

  12. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. ↩

  13. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023. ↩

  14. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024. ↩

  15. McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. ↩

  16. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  17. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023. ↩

  18. Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023. ↩

  19. NSA et al. (2023, May 24). People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023. ↩

  20. Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020. ↩

  21. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.. ↩

  22. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  23. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  24. Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025. ↩

  25. Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020. ↩

  26. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023. ↩

  27. Core Security. (n.d.). Impacket. Retrieved November 2, 2017. ↩

  28. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  29. Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024. ↩

  30. Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021. ↩

  31. Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025. ↩

  32. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩

  33. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021. ↩

  34. Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025. ↩

  35. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  36. Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025. ↩

  37. Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024. ↩

  38. Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024. ↩