Akira NTDS.dit Exfiltration via wbadmin Backup to Loopback SMB Share

Ethan Andrews@eandrews

•updated Jun 29, 2026•2•0•3

Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup of the Active Directory database (NTDS.dit) and registry hives to a local SMB loopback share. This behavior is a technique used by Akira ransomware actors to bypass file locking mechanisms and exfiltrate sensitive credential material.