MirrorFaceG1054 ↗
- Tactic
- Credential Access
- Platform
- Windows
- Version
- 1.3
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributor
- Ed Williams, Trustwave, SpiderLabs
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
18
Threat groupsTop 10%
Threat groups90th percentile · 90% of ATT&CK techniques have this many threat groups attributed or fewer.4
CampaignsTop 10%
Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.30
Detection rulesTop 9%
Detection rules91st percentile · 91% of ATT&CK techniques have this many detection rules written or fewer.NTDS MITRE reference T1003.003
Top 10%of all ATT&CK techniques for number of groups
18 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Medusa GroupG1051 ↗
Has accessed the ntds.dit file to engage in credential dumping.1
Volt TyphoonG1017 ↗
Has used ntds.util to create domain controller installation media containing usernames and password hashes.1234
FIN13G1016 ↗
Has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.1
Scattered SpiderG1015 ↗
Has extracted the NTDS.dit file by creating volume shadow copies of virtual domain controller disks.123
LAPSUS$G1004 ↗
Has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.1
All 18 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries dumped the entire Active Directory database by extracting the contents of the ntds.dit file.1
Operation MidnightEclipseC0048 ↗
During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.1
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract ntds.dit.1
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via vssadmin.1
All 4 campaigns for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
CrackMapExecS0488 ↗
Can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.1
esentutlS0404 ↗
ImpacketS0357 ↗
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.1
KoadicS0250 ↗
Can gather hashed passwords by gathering domain controller hashes from NTDS.1
All 4 software entries for this technique
Offense vs defense T1003.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 4Sigma rules (cumulative) · 24Splunk ESCU (cumulative) · 6
first rule: 2019 Q1 · 4 of 4 campaigns plottedNTDS detection strategy DET0586
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of NTDS.dit Credential Dumping from Domain Controllers
1 platform
AN1611 · Windows
Detects credential dumping attempts targeting the NTDS.dit database by monitoring shadow copy creation, suspicious file access to %SystemRoot%\NTDS\ntds.dit, and the use of tooling like ntdsutil.exe or volume management APIs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File ModificationDC0061 | WinEventLog:Sysmon | EventCode=2 |
| Volume CreationDC0097 | WinEventLog:Microsoft-Windows-VSS | Volume Shadow Copy Creation |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetFilePath | Tunable for NTDS file location or backup paths if organization uses custom domain controller storage structure. |
| ParentProcessName | Can suppress backup-related parent processes to reduce false positives. |
| TimeWindow | Temporal correlation between shadow copy creation and NTDS file access (e.g., 5 min window). |
| UserContext | Tune based on expected privileged user/service account behavior. |
2 analytics
The NTDSUtil tool may be used to dump a Microsoft Active Directory database to disk for processing with a credential access tool such as Mimikatz. This is performed by launching ntdsutil.exe as a privileged user with command line arguments indicating that media should be created for offline Active Directory installation and specifying a folder path. This process will create a copy of the Active Directory database, ntds.dit, to the specified folder path.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| file | create | file_name |
| file | create | image_path |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This base pseudocode looks for file create events where a file with a name of ntds.dit is created by the ntdsutil process.
files = search File:Create ntds_dump = filter files where ( file_name = "ntds.dit" and image_path = "*ntdsutil.exe") output ntds_dump
A Splunk/Sysmon version of the above pseudocode.
index=__your_sysmon_index__ EventCode=11 TargetFilename="*ntds.dit" Image="*ntdsutil.exe"
An EQL version of the above pseudocode.
file where file_name == "ntds.dit" and process_name == "ntdsutil.exe"
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=11 file="*ntds.dit" source_image="*ntdsutil.exe"
Unit tests
CAR’s own validation procedures for this analytic.
1. Open a Windows Command Prompt or PowerShell instance as Administrator 2. Execute `ntdsutil.exe “ac i ntds” “ifm” “create full c:\temp” q q`
This analytic detects the minidump variant of credential dumping where a process opens lsass.exe in order to extract credentials using the Win32 API call MiniDumpWriteDump. Tools like SafetyKatz, SafetyDump, and Outflank-Dumpert default to this variant and may be detected by this analytic, though keep in mind that not all options for using those tools will result in this specific behavior.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-SCA | System Call Analysis |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This Splunk query looks for process access events where lsass.exe is accessed with a specific call trace that indicates the use of MiniDumpWriteDump.
index=__your_sysmon_index__ EventCode=10 TargetImage="C:\\windows\\system32\\lsass.exe" (CallTrace="*dbghelp.dll*" OR CallTrace="*dbgcore.dll*")| table _time host SourceProcessId SourceImage
LogPoint version of the above pseudocodes.
norm_id=WindowsSysmon event_id=10 image="C:\Windows\system32\lsass.exe" call_trace IN ["*dbghelp.dll*", "*dbgcore.dll*"] | fields log_ts host source_process_id source_image
Ensure Domain Controller backups are properly secured.
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
User TrainingM1017
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
Tests11Executorscmd 8 · PowerShell 3Need elevation11 of 11Have prerequisites6Have cleanup4Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition