CyberStack

MITRE ATT&CK / Techniques / T1003.003

OS Credential Dumping: NTDS

ID
T1003.003
Tactics
TA0006 Credential Access
Sub-technique of
T1003 OS Credential Dumping
Platforms
Windows
Data sources
Process Creation, File Modification, File Creation, Volume Creation
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.[2]

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.[1]

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

  • Volume Shadow Copy
  • secretsdump.py
  • Using the in-built Windows tool, ntdsutil.exe
  • Invoke-NinjaCopy

Detection

Mitigations (4)

M1017 User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

M1026 Privileged Account Management

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1041 Encrypt Sensitive Information

Ensure Domain Controller backups are properly secured.[1]

Groups (18)

Software (4)

References

  1. Metcalf 2015
  2. Wikipedia Active Directory