T1003.003Credential Access
NTDS
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller. In addition to looking for NTDS files on active Domain…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports0
Detections
24 Sigma rules tagged T1003.003NTDST1003.00324 general rules
- Potential Russian APT Credential Theft Activitycriticalstable
- VolumeShadowCopy Symlink Creation Via Mklinkhighstable
- Copying Sensitive Files with Credential Datahightest
- Create Volume Shadow Copy with Powershellhightest
- Cred Dump Tools Dropped Fileshightest
- NTDS Exfiltration Filename Patternshightest
- NTDS.DIT Creation By Uncommon Parent Processhightest
- NTDS.DIT Creation By Uncommon Processhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to NTDS
3 CVEs, by priority. Each link shows its badge.- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.0%Top 0.07%83.7priority
- CVE-2024-24919Check Point Quantum Security Gateways Information Disclosure VulnerabilityCheck Point · Quantum Security GatewaysKEVRansomwarePublic exploitHigh · 8.6T1059.004Unix ShellT1202Indirect Command Execution+3 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.0priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 moreMITRE CTID mapping of the KEV entry · follow-on activity93.3%Top 0.16%69.8priority