NTDS Dump via Volume Shadow Copy Technique

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to dump NTDS.dit via the Volume Shadow Copy technique over HTTP. It specifically looks for HTTP URIs containing both 'vssadmin' and 'ntds.dit' (case-insensitive). This combination suggests an attacker is trying to exfiltrate the NTDS.dit file, which contains Active Directory database information, using the vssadmin utility to create a shadow copy and then access the file.