StrikeShark NTDS.dit Extraction via ntdsutil or vssadmin with Shell Parent

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the unauthorized access or copying of the Active Directory NTDS.dit database file, a common credential harvesting technique. The rule monitors for the execution of ntdsutil.exe or vssadmin.exe with arguments typically used to create shadow copies or extract the NTDS database, specifically when executed by cmd.exe or powershell.exe.