ATT&CK coverage › Technique
OS Credential Dumping: NTDS T1003.003
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.
Events covered
10 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 20 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (11 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (138 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 20 rules
- Copying Sensitive Files with Credential Data
- Create Volume Shadow Copy with Powershell
- Cred Dump Tools Dropped Files
- Esentutl Gather Credentials
- Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
- NTDS Exfiltration Filename Patterns
- NTDS.DIT Created
- NTDS.DIT Creation By Uncommon Parent Process
- NTDS.DIT Creation By Uncommon Process
- Ntdsutil Abuse
- Possible Impacket SecretDump Remote Activity
- PUA - DIT Snapshot Viewer
- Sensitive File Dump Via Wbadmin.EXE
- Sensitive File Recovery From Backup Via Wbadmin.EXE
- Shadow Copies Creation Using Operating Systems Utilities
- Suspicious Get-ADDBAccount Usage
- Suspicious Process Patterns NTDS.DIT Exfil
- Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
- Transferring Files with Credential Data via Network Shares
- VolumeShadowCopy Symlink Creation Via Mklink