MITRE ATT&CKsub-technique

T1003.003 NTDS

Published 2020-02-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Windows
Version
1.3
Created
2020-02-11

Description

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller. In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information. The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. • Volume Shadow Copy • secretsdump.py • Using the in-built Windows tool, ntdsutil.exe • Invoke-NinjaCopy

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1003 OS Credential Dumping technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1041 Encrypt Sensitive Information mitigation
  • M1017 User Training mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (27)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • C0063 2025 Poland Wiper Attacks campaign
  • G1054 MirrorFace group
  • G1051 Medusa Group group
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • C0048 Operation MidnightEclipse campaign
  • C0029 Cutting Edge campaign
  • G1016 FIN13 group
  • G1017 Volt Typhoon group
  • G1015 Scattered Spider group
  • G1004 LAPSUS$ group
  • G0129 Mustang Panda group
  • G0125 HAFNIUM group
  • G0117 Fox Kitten group
  • G0114 Chimera group
  • S0488 CrackMapExec software (tool)
  • G0102 Wizard Spider group
  • G0096 APT41 group
  • S0404 esentutl software (tool)
  • S0357 Impacket software (tool)
  • S0250 Koadic software (tool)
  • G0004 Ke3chang group
  • G0007 APT28 group
  • G0034 Sandworm Team group
  • G0035 Dragonfly group
  • G0037 FIN6 group
  • G0045 menuPass group

Referenced by Compliance · mitigates (20)

  • CIS-11.3 Protect Recovery Data CIS Safeguard v8.1
  • CIS-3.11 Encrypt Sensitive Data At Rest CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References