StrikeShark NTDS.dit Extraction via VSS, ntdsutil, diskshadow, or esentutl

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.