StrikeShark NTDS.dit Dumping via vssadmin, ntdsutil, diskshadow, or esentutl

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.