Threat Hunting Exercise: Analyzing Windows NTDS.dit Dumping via Ntdsutil Dataset

This hunt uses a simulated Domain Controller telemetry dataset (win_security_ntdsutil_2022-09-08T020000.json) capturing T1003.003: OS Credential Dumping (NTDS), where an attacker with local admin access on a Domain Controller uses the built-in ntdsutil.exe to create a Volume Shadow Copy snapshot and extract the entire NTDS.dit Active Directory database offline.

Step 1: Hypothesis Formation

Hypothesis: A process on a Domain Controller invokes ntdsutil.exe with the ac i ntds / ifm (Install From Media) or create full shadow-copy syntax outside of a scheduled backup window, producing a large export directory containing ntds.dit and SYSTEM registry hive - indicating offline AD database extraction for credential harvesting. Indicators:

Process creation of ntdsutil.exe with command-line arguments referencing ifm, create full, or ac i ntds.
A newly created directory (commonly under C:\temp\, C:\Windows\Temp\, or a user profile) containing ntds.dit and registry\SYSTEM shortly after.
The invoking account is not the backup service account, and the action occurs outside documented backup schedules.
Follow-on file compression (7z/rar) or outbound transfer of the export directory.

Null Hypothesis: This is the organization's legitimate AD backup process using ntdsutil IFM for a recovery DC build, executed by the backup service account on schedule. Invalidate by confirming the account, host, and timing against the backup runbook.

Rationale: ntdsutil is a native, signed Windows binary, making this a classic living-off-the-land credential dumping technique that evades tools relying solely on file/hash reputation; the moment of database export is the last reliable detection point before the data leaves the DC.

Step 2: Data Sources and Scope

Sources: Sysmon Event ID 1 (process creation) and 11 (file creation) on the Domain Controller; Windows Security Event ID 4688; file-integrity monitoring on C:\Windows\NTDS\.
Scope: ~2022-09-08T02:00:00-02:20:00 UTC; Host: DC02 (10.10.0.11); Invoking account: helpdesk_adm2.
SIEM Queries (Splunk/ELK):
index=sysmon EventCode=1 Image="ntdsutil.exe" CommandLine="ifm" OR CommandLine="create full*"
Export file creation: index=sysmon EventCode=11 TargetFilename="*ntds.dit"
Compression follow-on: index=sysmon EventCode=1 (Image="7z.exe" OR Image="rar.exe") ParentImage="cmd.exe"

Step 3: Key Findings

Parsed events (5 shown) confirm helpdesk_adm2 - an account with no backup-operator role - ran ntdsutil to create a full IFM export of the AD database to a local temp directory, then compressed it for exfiltration, entirely outside the documented 01:00 backup window.

Timestamp (UTC)	Host	Event	Detail	IOC/Why Suspicious?
2022-09-08 02:04:11	DC02	Sysmon Event ID 1	`ntdsutil.exe "ac i ntds" "ifm" "create full C:\Windows\Temp\adbkp" q q` run by `helpdesk_adm2`	LOLBIN IOC: signed native tool used to perform a full NTDS Install-From-Media export - the canonical offline AD dump technique.
2022-09-08 02:06:47	DC02	Sysmon Event ID 11	Files created: `C:\Windows\Temp\adbkp\Active Directory\ntds.dit` (620 MB), `C:\Windows\Temp\adbkp\registry\SYSTEM`	Artifact IOC: presence of both `ntds.dit` and the `SYSTEM` hive together is sufficient for full offline hash extraction (e.g., via `secretsdump.py`).
2022-09-08 02:11:02	DC02	Sysmon Event ID 1	`7z.exe a -pS3cr3t! C:\Windows\Temp\adbkp.7z C:\Windows\Temp\adbkp\*`	Staging IOC: password-protected archive creation of the export directory, typical pre-exfiltration staging to evade content inspection.
2022-09-08 02:14:30	DC02	(Account role check)	`helpdesk_adm2` is a member of "Help Desk Level 2" - not Backup Operators or Domain Admins	Privilege-Mismatch IOC: the account should not have the rights or business justification to export the AD database.
-	(backup schedule)	(runbook check)	Documented AD backups run at 01:00 UTC via `svc-backup` using Windows Server Backup, not `ntdsutil` IFM	Confirms this activity falls outside and independent of the legitimate backup process, both in timing, tooling, and identity.

Validation:

Timeline: unscheduled ntdsutil IFM export, immediate creation of ntds.dit+SYSTEM, followed by password-protected compression - a complete offline AD-dump staging chain within 10 minutes.
False Positives: no change ticket or backup schedule entry matches this window or account; the account lacks Backup Operator privileges (this itself indicates likely prior privilege escalation).
Correlation: tooling, artifact creation, staging, and identity/privilege mismatch jointly confirm malicious NTDS extraction.

Step 4: Recommendations & Next Steps

Immediate Response: Isolate DC02, disable helpdesk_adm2 and audit how it obtained local admin on a DC, force a domain-wide krbtgt password reset (twice, per Microsoft guidance) and reset all privileged account credentials, and preserve C:\Windows\Temp\adbkp.7z for forensic scoping of what was exported.
Detection: Sigma-style rule: title: NTDS.dit Extraction via Ntdsutil IFM → selection: Image endswith 'ntdsutil.exe' AND CommandLine contains 'ifm' → condition: selection.
Pro Tip: File-integrity-monitor C:\Windows\NTDS\ntds.dit for any read access from a process other than lsass.exe, and separately alert on any creation of a file literally named ntds.dit outside that directory - legitimate IFM exports are rare enough that this can run as a near-zero-noise, always-on detection.

Hypothesis confirmed - a help-desk account with unauthorized DC access used the built-in ntdsutil utility to export and compress the entire Active Directory database, setting up for a full domain-wide credential compromise!