T1003.003sub-technique of T1003 OS Credential Dumping
NTDS
Windowsnothing on this site yetT1003.003 on attack.mitre.org
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in `%SystemRoot%\NTDS\Ntds.dit` of a domain controller.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection of NTDS.dit Credential Dumping from Domain Controllers
- Detects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\NTDS\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.
what reduces it
- M1017 User Training. Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1026 Privileged Account Management. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
- M1041 Encrypt Sensitive Information. Ensure Domain Controller backups are properly secured.