ntdsutil.exe IFM Snapshot for AD Database Offline Extraction

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the use of the native Windows utility ntdsutil.exe with arguments 'ac i ntds' or 'ifm', which are commonly used to perform an 'Install from Media' (IFM) operation. This technique is frequently abused by adversaries to create a snapshot of the Active Directory database (ntds.dit) and the SYSTEM registry hive, facilitating offline credential dumping.