StrikeShark NTDS.dit Extraction via vssadmin, ntdsutil, or diskshadow
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
SentinelOne
