Akira - NTDS.dit Exfiltration via wbadmin Backup to UNC Loopback Path
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup targeting critical Active Directory or system configuration files (ntds.dit, SYSTEM, or SECURITY registry hives). This behavior is often associated with credential dumping, where adversaries attempt to extract the AD database by utilizing built-in Windows backup tools to create a copy that can then be exfiltrated or processed offline.
Splunk (SPL)
