UNC6692 - Active Directory Database Harvesting (T1003.003)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•3

Detects the execution of tools writing Active Directory database components (ntds.dit, SAM, SYSTEM, SECURITY) directly into user download directories. This activity is indicative of credential harvesting, specifically targeting Active Directory database files.