StrikeShark NTDS.dit Credential Dumping via ntdsutil/vssadmin/diskshadow

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of built-in Windows utilities such as ntdsutil.exe, vssadmin.exe, and diskshadow.exe, often used by attackers to dump the Active Directory database (NTDS.dit) or manipulate volume shadow copies for credential theft or data staging/destruction purposes.