Hackers Breach Active Directory, Steal NTDS.dit for Full Domain Compromise

Threat actors recently infiltrated a corporate environment, compromised the Active Directory (AD) database file NTDS.dit, and nearly achieved full domain control.

The Active Directory serves as the backbone of Windows domains, storing account data, group policies, and password hashes. Compromise of its core file can give attackers extensive access and control.

The breach initiated with attackers gaining administrative privileges on a workstation via a phishing email, which deployed a remote access tool. They then moved laterally, capturing LSASS process memory to steal password hashes using Mimikatz. Employing Pass-the-Hash techniques, they authenticated to servers and ultimately reached a domain controller.

At the domain controller, the attackers used Volume Shadow Copy Service (VSS) to create a hidden snapshot of the system volume to bypass a locked AD database. This method allowed them to extract the NTDS.dit file and the SYSTEM registry hive, which contains the decryption key. With these files, they could decrypt and process the AD database offline.

To avoid detection, the attackers used built-in Windows commands, such as vssadmin and PowerShell utilities, to copy locked files. They repaired the shadow copy with esentutl before dumping credentials using SecretsDump. Finally, they compressed the NTDS.dit and SYSTEM hive into an archive and transferred it to an attacker-controlled server using standard SMB connections.

Trellix Network Detection and Response (NDR) identified key stages of the breach by analyzing behavioral patterns and protocol anomalies:

Suspicious SMB Traffic: High-volume file transfers to an external IP triggered alerts when service protocols deviated from normal patterns. Shadow Copy Creation: Unusual use of vssadmin by a non-administrative account indicated potential database exfiltration. Archive Exfiltration: A spike in SMB read operations on system volume snapshots was flagged as a high-fidelity exfiltration signature.

Trellix NDR’s AI-powered engine correlated these alerts into a coherent kill chain, guiding analysts from initial compromise to data theft. This accelerated response times and helped contain the breach before further escalation.

Monitor Native Tool Usage: Alert on atypical VSS and registry export operations, even with built-in commands. Profile Protocol Behaviors: Establish baselines for SMB and RPC traffic to detect subtle exfiltration attempts. Correlate Alerts into Chains: Group anomalies into a unified attack narrative to facilitate swift action.

By detecting stealthy AD database theft at multiple points, modern NDR platforms like Trellix NDR can effectively combat identity-based attacks. Security teams should enhance monitoring to detect NTDS.dit extraction signs before full domain compromise occurs.

Based on reporting by GBHackers.