Akira NTDS.dit Exfiltration via wbadmin.exe Backup to Localhost C$ Share

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects the use of the native Windows Backup utility (wbadmin.exe) to initiate a backup that specifically includes the Active Directory database file (ntds.dit). This behavior is characteristic of an attempt to perform offline Active Directory credential dumping by creating a backup of the database to an accessible location.