StrikeShark NTDS.dit Extraction via ntdsutil or vssadmin
Detects unauthorized attempts to extract the Active Directory database (NTDS.dit) for credential harvesting. The rule monitors for common administrative tools like ntdsutil.exe and vssadmin.exe being used to create shadow copies or extract the NTDS database, as well as direct file manipulation of ntds.dit. This activity is often associated with post-exploitation credential dumping techniques.
Microsoft Sentinel (KQL)
