Hackers Breach Active Directory, Steal NTDS.dit for Full Domain Compromise
Threat actors have recently infiltrated a corporate environment, successfully extracting the Active Directory (AD) database file NTDS.dit, thereby nearly achieving full domain control. AD serves as the backbone of Windows domains, storing account data,…
Threat actors have recently infiltrated a corporate environment, successfully extracting the Active Directory (AD) database file NTDS.dit, thereby nearly achieving full domain control. AD serves as the backbone of Windows domains, storing account data, group policies, and password hashes. Compromise of this core file effectively grants attackers significant access privileges.
The breach initiated with attackers gaining administrative privileges on a workstation via a phishing email that deployed a remote access tool. This allowed them to move laterally, capturing LSASS process memory to steal password hashes using Mimikatz. Employing Pass-the-Hash techniques, they authenticated to servers and subsequently accessed a domain controller.
Upon reaching the domain controller, the attackers encountered a locked AD database. To circumvent the lock, they utilized Volume Shadow Copy Service (VSS) to create a hidden snapshot of the system volume, enabling the quiet extraction of the NTDS.dit file and the SYSTEM registry hive. These files were then used to decrypt and process the entire AD database offline.
Rather than deploying noisy custom tools, the adversaries relied on built-in Windows commands, such as vssadmin and PowerShell utilities, to copy locked files. They repaired the shadow copy with esentutl before dumping credentials with SecretsDump. Ultimately, they compressed the NTDS.dit and SYSTEM hive into an archive and transferred it to an attacker-controlled server using standard SMB connections, blending into normal traffic.
AD serves as the backbone of Windows domains, storing account data, group policies, and password hashes.
Trellix Network Detection and Response (NDR) identified key stages of the breach by analyzing behavioral patterns and protocol anomalies rather than simple signatures. The solution flagged:
Suspicious SMB Traffic: High-volume file transfers to an external IP prompted an alert when service protocols deviated from normal patterns. Shadow Copy Creation: Unusual use of vssadmin by a non-administrative account triggered a behavioral detection, indicating potential database exfiltration. Archive Exfiltration: A sudden spike in SMB read operations on system volume snapshots was identified as a high-fidelity exfiltration signature.
Throughout the incident, Trellix NDR’s AI-powered engine correlated these alerts into a coherent kill chain, guiding analysts from initial compromise to data theft. This contextual view accelerated response times and helped contain the breach before further pivoting by the attackers.
Monitor Native Tool Usage: Alert on atypical VSS and registry export operations, even when using built-in commands. Profile Protocol Behaviors: Establish baselines for SMB and RPC traffic to catch subtle exfiltration attempts. Correlate Alerts into Chains: Group individual anomalies into a unified attack narrative to guide swift action.
By detecting stealthy AD database theft at multiple points, modern NDR platforms like Trellix NDR can effectively counter identity-based attacks. Security teams should enhance their monitoring to identify the subtle indicators of NTDS.dit extraction before full domain compromise occurs.
Based on reporting by GBHackers.