Hackers Compromise Active Directory to Steal NTDS.dit that Leads to Full Domain Compromise

Active Directory (AD) remains the foundation of authentication and authorization in Windows environments. Threat actors targeting the NTDS.dit database can harvest every domain credential, unlock lateral movement, and achieve full domain compromise. 

Attackers leveraged native Windows utilities to dump and exfiltrate NTDS.dit, bypassing standard defenses. 

The adversary in this case obtained DOMAIN ADMIN privileges via a successful phishing campaign and subsequent privilege escalation. Once elevated, they executed:

To create a Volume Shadow Copy and extract NTDS.dit, silently bypassing file locks. With the SYSTEM hive obtained, attackers decrypted the database offline using secretsdump.py from Impacket:

This chain enabled harvesting of NTLM and AES hashes for all domain accounts without triggering traditional endpoint alarms.

After archiving and compressing the dump with tar -czf ntds.tar.gz c:\temp\ntds.dit c:\temp\SYSTEM, the attackers exfiltrated data over SMB to a compromised file share.

Trellix detected this activity via two high-fidelity signatures: anomalous SMB write patterns exceeding baseline volume and a custom exfiltration signature for large NTDS file transfers. 

Behavioral detection flagged unexpected esentutl processes running outside maintenance windows, and protocol anomaly alerts triggered on shadow copy reads to C:\$VolumeShadowCopy.

Through Trellix Wise, AI-driven alert correlation highlighted the progression from VSS creation to SMB upload, reducing analyst workload by 60% and cutting mean time to detect (MTTD) by 45%. 

The theft of NTDS.dit poses an existential threat to Windows domains, providing attackers complete control over all credentials.  

Traditional defenses often miss the low-and-slow techniques employed during shadow copy creation and offline decryption.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.