Nightmare Eclipse - Ntds.dit Active Directory Extraction (T1003.003)
Detects the threat actor abusing ntdsutil.exe to create an Install From Media (IFM) dump of the Active Directory database for offline credential cracking.
Microsoft Sentinel (KQL)
Detects the threat actor abusing ntdsutil.exe to create an Install From Media (IFM) dump of the Active Directory database for offline credential cracking.
Already have an account?