When the Directory Becomes the Weapon: Understanding NTDS.dit Theft

By Maulik Maheta and Henry Bernabe · September 21, 2026

Executive Summary

While adversaries continually update their attack tools, their fundamental techniques, such as extracting credentials from Active Directory's NTDS.dit and SYSTEM hives, remain consistent. This blog focuses on a critical defense shift: moving from signature-based detection to a technique-driven approach that identifies malicious behavior regardless of the specific toolkit utilized. We simulate a full credential theft and exfiltration attack chain to demonstrate the power of tool-agnostic defense.

In this simulation, Trellix Network Detection and Response (NDR) provides an essential layer of visibility, detecting and correlating malicious activity throughout the attack lifecycle, from the credential dumping phase to data exfiltration.

Dumping and exfiltrating AD NTDS.dit file

Phase 1 : Initial access

• Attack vector: Spearphishing, malicious Office macro, LNK file, or trojanized installer
• Victim executes a stager that loads the next-stage agent into memory
• Evasion: process hollowing or DLL sideloading to blend into a legitimate process tree

Phase 2 : C2 callback

• Stager connects back to the attacker's C2 listener (Metasploit multi/handler)
• Meterpreter stage pushed in-memory via reflective DLL injection—nothing touches disk
• Communication uses encrypted TLV protocol, evading signature-based detection
• getsystem → Named Pipe Impersonation escalates token to NT AUTHORITY\SYSTEM

Phase 3 : Credential theft

SYSTEM privileges are used to target lsass.exe, which caches credential material in memory

• Techniques:

• sekurlsa::logonpasswords extracts NTLM hashes & Kerberos tickets
• Pass-the-Hash (PtH) reuse NTLM hash without cracking
• Pass-the-Ticket / Overpass-the-Hash forge Kerberos TGTs (T1558)
• Extracted credentials become the pivot key into the domain controller

Phase 4 : Lateral movement

• Attacker moves to the domain controller via SMB/PsExec (psexec_ntdsgrab) or existing Meterpreter session
• ntds.dit is OS-locked by ESE (Extensible Storage Engine), bypassed using VSS (Volume Shadow Copy): \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit
• SYSTEM hive also exported contains the Boot Key (SysKey) required to decrypt ntds.dit

Phase 5 : Exfiltration

• Exfiltrated via HTTPS to cloud storage (T1567.002), blending into normal web traffic
• Offline decryption using Impacket secretsdump.py or DSInternals: secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
• Result: every domain account's NTLM hash, Kerberos keys, and password history enable Golden Ticket attacks indefinitely

Method 1: Using psexec ntdsgrab module

Figure 2 shows the auxiliary/admin/smb/psexec_ntdsgrab module in the Metasploit Framework automates the extraction of the Active Directory (AD) database (ntds.dit) and the SYSTEM registry hive from a target domain controller. It connects via the SMB protocol using administrative credentials, creates a Volume Shadow Copy to bypass OS file locking, and downloads the files to your local attack machine without dropping an executable binary onto the target system.

Method 2: Using Meterpreter session

Figure 3 shows that if you already have an active Meterpreter session on the domain controller, you do not need to use the psexec_ntdsgrab auxiliary module. You can dump the ntds.dit database directly through your existing session using automated scripts or built-in tools; here Meterpreter shell is an advanced, dynamically extensible payload used by penetration testers and ethical hackers within the Metasploit Framework. Unlike a standard operating system command prompt, it runs entirely in the target computer's memory (RAM) and gives the operator precise, silent control over the compromised machine.

Figure 4 shows the Metasploit interface, which demonstrates how an active session is moved to the background, allowing the attacker to manage multiple sessions or launch new attacks.

Figure 5 shows a file system view of the exact directory where NTDS.dit is stored on a domain controller, revealing the target path for credential theft operations.

The command execution screen shows how the attacker successfully dumps and prepares the NTDS.dit and SYSTEM hives for exfiltration from the compromised system. Please refer to Figure 6 for further information.

Detection: Trellix NDR

Trellix NDR utilizes Trellix Wise, an AI-powered investigation assistant, to enhance threat detection and response capabilities. Trellix Wise automates many aspects of alert investigation, reducing false positives and accelerating the time to resolution for security teams. This integration enables organizations to achieve greater threat-detection accuracy, automate complex tasks, and focus on strategic defense.

Trellix Wise can provide a user with comprehensive details such as additional information on the alert, remediation steps, MITRE information, etc.

In Trellix NDR, we detect this in two places: when NTDS.dit and the SYSTEM hive file are dumped, and when these files are exfiltrated.

1. Trellix NDR alert: NTDS.dit and SYSTEM hive file dump

Trellix NDR detected NTDS.dit and SYSTEM file dumping activity generating an alert and demonstrating near real-time behavioral analysis and threat detection. Please refer to Figure 7 for further information.

Summarize this alert

A summary dashboard that breaks down the key elements of the Trellix NDR alert for credential dumping, such as the affected hosts and indicators.

MITRE findings

Below is a detailed view of how Trellix NDR maps attack behaviors to the MITRE ATT&CK framework, aligning it with known adversary tactics.

Remediation steps

Trellix NDR provides suggested actions to mitigate detected credential theft activity and prevent further attacker movement.

Knowledge graph

A visualization of the relationships between entities in the NTDS.dit file dump, including attacker IPs, alert types, and targeted systems.

2. Exfiltration attempt of NTDS.dit and SYSTEM hive file

Summarize this alert

Trellix NDR's alert summary highlights the detection of a suspicious data transfer attempt, signaling the attack's exfiltration phase.

MITRE findings

The MITRE technique mapping for the exfiltration phase demonstrates how Trellix NDR classifies and correlates outbound credential movement.

Remediation steps

Trellix NDR prescribed defense measures in response to the detection of credential exfiltration attempts, with a focus on containment and response.

Knowledge graph

A network relationship graph that shows the entities, alerts, and behavioral patterns associated with the NTDS.dit exfiltration attempt.

Conclusion

This blog expands on our previous entry on NTDS.dit attacks by shifting the focus away from well-known tools and towards core adversary techniques. We use Metasploit and Meterpreter to simulate the dumping and exfiltration of Active Directory's NTDS.dit and SYSTEM hive files, demonstrating how Trellix NDR detects malicious behavior regardless of the tools used.

We go through each step of the attack chain: gaining access, credential dumping, and data exfiltration. Trellix NDR generates rich alerts for each phase, maps activities to the MITRE ATT&CK framework, and recommends remediation steps, all of which are visualized using a knowledge graph that links entities and actions in context.

Finally, this blog shows that tool-agnostic detection is critical for defending against modern identity-based threats, and Trellix NDR provides that visibility via behavioral analysis, protocol intelligence, and AI-assisted investigation.

Organizations can significantly reduce their exposure to AD credential theft by addressing the native Windows capabilities that adversaries routinely abuse at each phase of this attack chain.

Recommendations for organizations

• Enable protected users security group.
• Disable unnecessary VSS access.
• Disable NTLM where possible.
• Deploy NDR sensors on all paths to domain controllers.
• Alert on large file transfers over SMB from domain controllers.
• Monitor for DCSync traffic patterns.

To learn more about Trellix NDR, take our product tour or read more here.

Discover the latest cybersecurity research from the Trellix Advanced Research Center.