Akira NTDS.dit Exfiltration via wbadmin or ntdsutil (T1003.003)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects unauthorized access to the Active Directory database (NTDS.dit) or registry hives (SYSTEM, SECURITY) using native Windows utilities like wbadmin.exe and ntdsutil.exe. This activity is indicative of credential dumping and staging efforts for exfiltration, as observed in Akira ransomware campaigns.