TA0006 · CREDENTIAL ACCESS
NTDS
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
Detect it with
Monitor processes and command-line arguments for program execution that may be indicative of credential dumping, especially attempts to access or copy the NTDS.dit.
Why it matters on shift
NTDS is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context