Suspicious Active Directory Database Export via NTDSUtil

Daniel Jeremiah@daniyyell

•updated 6 days ago•2•0•7

Detects NTDSUtil commands associated with Active Directory database export, installation media preparation, and snapshot creation, which may facilitate offline credential extraction.