T1003.003 — NTDS

Tactic: Credential Access · Platforms: Windows

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.003 OS Credential Dumping: NTDS

title: "T1003.003 OS Credential Dumping: NTDS"
id: f376cd62-6857-4165-a9c8-478922e70367
description: 'Detection of NTDS.dit Credential Dumping from Domain Controllers. (Data Component: File Modification; baseline tier: windows-eventid.) Tune using: TargetFilePath, ParentProcessName, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1003/003
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.003

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith: '\ntds.dit'

  condition: selection

falsepositives:
  - Legitimate NTDS.dit creation during domain controller promotion/demotion or backup/restore operations.

level: high

Related sub-techniques

Explore