T1003.003

Official Description

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015)

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

* Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy

Tactics: Credential Access
Platforms: Windows
Parent Technique: T1003 · OS Credential Dumping
MITRE Version: 1.3
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (1)

Threat actors used ntdsutil.exe to copy the domain's NTDS.dit database, which contains account password hashes. PaperCut Zero-Days Used to Deploy AdaptixC2 and Compromise an Education Customer’s Domain

CVE (2)

Malware (1)

MITRE ATT&CK (18)

Vendors (2)

Products (3)

Tools (8)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.