NTDS.dit Active Directory Credential Extraction - Multi-Method (T1003.003)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects various techniques used to extract the Active Directory NTDS.dit database on Windows. The rule monitors for the misuse of administrative tools including ntdsutil.exe (for IFM or instance activation), vssadmin.exe (to create volume shadow copies as a prerequisite), and esentutl.exe (for direct ESE database operations). The detection focuses on suspicious command-line patterns indicative of credential dumping attempts.