NTDS
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that conta...
BY SOURCE
PROCEDURES (21)
Auto-extracted: 4 detections for dump
Auto-extracted: 3 detections for dump
Auto-extracted: 3 detections for shadow cop
Auto-extracted: 3 detections for ntds
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for suspicious
Auto-extracted: 1 detections for ntds
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for credential