t1003-003-ntds

name	T1003.003_ntds
description	Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as...
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1003.003","credential-access","windows","sub-technique"]
technique_id	T1003.003
tactic	credential-access
all_tactics	["credential-access"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1003/003
tech_stack	["windows"]
cwe_ids	["CWE-522"]
chains_with	["T1003","T1003.001","T1003.002","T1003.004","T1003.005","T1003.006","T1003.007","T1003.008"]
prerequisites	["T1003"]
severity_boost	{"T1003":"Chain with T1003 for deeper attack path","T1003.001":"Chain with T1003.001 for deeper attack path","T1003.002":"Chain with T1003.002 for deeper attack path"}

T1003.003 NTDS

Sub-technique of: T1003

High-Level Description

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

• Volume Shadow Copy
• secretsdump.py
• Using the in-built Windows tool, ntdsutil.exe
• Invoke-NinjaCopy

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Windows

What to Check

• Identify if NTDS technique is applicable to target environment
• Check Windows systems for indicators of NTDS
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Create Volume Shadow Copy with vssadmin

This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

Supported Platforms: windows Elevation Required: Yes

vssadmin.exe create shadow /for=#{drive_letter}

Dependencies:

• Target must be a Domain Controller

Atomic Test 2: Copy NTDS.dit from Volume Shadow Copy

This test is intended to be run on a domain Controller.

The Active Directory database NTDS.dit may be dumped by copying it from a Volume Shadow Copy.

This test requires steps taken in the test "Create Volume Shadow Copy with vssadmin". A successful test also requires the export of the SYSTEM Registry hive. This test must be executed on a Windows Domain Controller.