Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

By Adithya Chandra and Maulik Maheta · August 18, 2026

Executive Summary

While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from Active Directory, specifically the extraction and exfiltration of the NTDS.dit database, stands out as one of the most consequential attack techniques an adversary can execute. Gaining access to this file is not merely a data breach; it is a wholesale takeover of an organization's identity infrastructure.

This blog continues the series exploring NTDS.dit credential theft, building on our earlier work. In this analysis, we examine the underlying methodologies used in these attacks and how Trellix Helix identifies them. We will highlight the advanced correlation engine (ACE)'s capability to consolidate telemetry from policy, network, and endpoint sources. This correlation provides a comprehensive view of the intrusion, regardless of the specific toolset an attacker employs.

NTDS.dit: Crown jewel of Active Directory

In Windows domains, Active Directory manages enterprise-wide access and identity through NTDS.dit (NT Directory Services Directory Information Tree) file serving as its core database.

This file stores all domain credentials, including password hashes for administrative accounts. When paired with the SYSTEM registry hive’s decryption boot key, an attacker can extract hashes to crack passwords offline and impersonate any user without alerting authentication systems.

What makes this technique particularly dangerous is its stealth. Adversaries routinely use built-in Windows utilities like vssadmin to create volume shadow copies, essential for repairing the locked database file to avoid touching the live NTDS.dit, and for circumventing file-locking mechanisms. The extraction can be carried out entirely with signed, native binaries. Credential extraction tools such as SecretsDump, Mimikatz, and Impacket come into play only after the file has already left the domain controller. By that point, traditional perimeter controls have already failed.

The severity of an NTDS.dit compromise is therefore not measured in rows of data; it is measured in the total loss of trust across the entire Windows domain.

The attack simulation: Technique over tooling

To ground this analysis in observable, repeatable behavior, we simulate the end-to-end attack chain using the Metasploit framework and Meterpreter, two widely used penetration testing tools. The goal is not to demonstrate how these tools work, but to surface the underlying technique patterns that any tool executing the same technique will produce.

Figure 1 provides a high-level visual representation of the complete attack chain, from initial access and credential dumping through to data exfiltration, with detection opportunity windows annotated at each phase.

The chain proceeds through three distinct phases:

• Gaining initial access and establishing a foothold
• Performing credential material extraction from Active Directory
• Exfiltrating the harvested data

Each phase generates a distinct class of technique signatures that Trellix Helix's correlation engine can detect and correlate.

Method 1: NTDS.dit extraction via the Metasploit psexec_ntdsgrab module

The first method uses Metasploit's dedicated psexec_ntdsgrab module. It automates the end-to-end process of connecting to a domain controller over SMB using stolen credentials, invoking Volume Shadow Copy creation. Then it retrieves the NTDS.dit and SYSTEM hive files, and stages them for download all in a single operation.

Figure 2 captures the moment the module executes successfully, demonstrating both the credential extraction point and the file acquisition in a single, automated technique chain.

From a technique standpoint, this module exercises several MITRE ATT&CK techniques simultaneously: lateral movement via PsExec (T1021.002), volume shadow copy creation to bypass file locks (T1003.003 prerequisite), and OS credential dumping (T1003.003). The automation collapses what might otherwise be a multi-step manual attack into seconds, underscoring why defenders cannot rely on detecting specific command sequences; the technique pattern is what matters.

Method 2: Manual extraction via a live Meterpreter session

The second simulation method takes a more hands-on approach, establishing an interactive Meterpreter session on the compromised domain controller and executing the extraction steps manually. This more closely reflects real-world adversary behavior, where an operator with established access navigates the filesystem and executes commands interactively.

Figure 3 shows the live Meterpreter session following successful post-exploitation access. The interactive shell gives the attacker full freedom to enumerate the environment, escalate privilege, and stage data for removal.

With the session established, the attacker backgrounds the active session to manage additional targets or launch auxiliary modules, a standard multi-session management pattern in prolonged intrusions.

In the next image (Figure 5), we see the file system enumeration step, where the attacker locates the precise directory path where NTDS.dit is stored on the domain controller %SystemRoot%\NTDS\ntds.dit. Knowing this path is prerequisite knowledge for any credential extraction technique, and filesystem enumeration of this specific path is itself a detectable technique signal.

The next image (figure 6) shows the culminating step: the attacker successfully dumping and staging both the NTDS.dit database and the SYSTEM hive file for exfiltration. This is the point of maximum damage at this moment; the attacker possesses the necessary materials to recover every credential in the domain offline, without any further interaction with the target environment.

Across both simulation methods, the technique signatures are identical: PsExec-based lateral movement, shadow copy creation or direct file access on the domain controller, and large-file staging followed by SMB or HTTP transfer. The tools differ; the detectable behaviors do not.

Detection: Trellix Helix and the power of ACE correlation

Where individual security tools see fragments like an endpoint alert here, a network anomaly there, Trellix Helix sees the complete attack. This is the core value of the ACE: the ability to ingest telemetry from Trellix Endpoint Security, Trellix Network Security, and third-party data sources, and automatically stitch related events into a single, high-fidelity incident with full MITRE ATT&CK mapping and actionable context.

Figure 7 illustrates the complete attack progression as detected by Trellix Helix, spanning initial compromise through NTDS.dit extraction and attempted exfiltration. The diagram surfaces specific Trellix Helix alerts at each phase of the chain., that begins with the initial file delivery , during which Trellix NDR logs Malware Object alert. The sequence continues through the credential extraction phase, triggered by the alert Credential Access: PsExec Used To Dump Active Directory Database. Finally, it reaches the data exfiltration phase, culminating in a critical correlated alert, Credential Theft: Exfiltration Of Active Directory Database (NTDS.dit). The animation below illustrates how the Trellix Helix ACE engine intervenes across the MITRE ATT&CK® Matrix.

Unlike traditional SIEMs that require analysts to manually correlate alerts across dashboards, Trellix Helix performs this correlation automatically and in real time, dramatically reducing mean time to detect (MTTD) and eliminating the alert-fatigue triage burden that allows sophisticated attacks to progress unnoticed.

The Trellix Helix alert: From noise to signal

When Trellix Helix detected this attack simulation, it generated a single CRITICAL severity alert: "Credential Theft: Exfiltration Of Active Directory Database (NTDS.dit)." This alert represents the complete attack story, not just a fragment.

Figure 8 shows the primary Trellix Helix alert view for this incident. The alert immediately communicates the severity, the affected assets (including compromised IP addresses and privileged user accounts flagged as "Not Contained"), and the specific MITRE ATT&CK techniques mapped to each detected behavior.

The "Not Contained" status on affected assets provides security teams with instant visibility into the scope of the breach and enables rapid prioritization of containment actions. Rather than spending hours manually assembling the incident picture, analysts receive this context the moment the correlation fires.

The alert was triggered by a multi-source correlation: an endpoint alert from Trellix Endpoint Security mapped to credential dumping activity (T1003.003), cross-referenced with network telemetry showing an active PsExec session being used to transfer the Active Directory database file. Trellix Helix linked these events through matching IP addresses, timestamps, and behavioral patterns, eliminating false positives while surfacing the complete attack narrative.

The correlation timeline: ACE assembles the attack story

Trellix Helix's Alert Details view (Figure 9) reveals the full depth of the solution’s investigative power. It shows how the ACE engine assembled multiple distinct security signals which would otherwise appear as separate, low-context alerts into a single coherent incident timeline.

The correlation story unfolded as follows:

1. Suspicious outbound HTTP traffic from a workstation operating under a domain admin account was flagged as a potential exfiltration precursor. This alone is a low-confidence signal. In context, it is the first thread of a much larger pattern.
2. A PsExec-based lateral movement event was detected as the attacker moved from an initial foothold to the domain controller. Trellix Helix's lateral movement rule fired and linked the source and destination assets.
3. The most critical signal, a high severity endpoint alert, captured the execution of a PsExec service on the domain controller under an administrative account, correlating directly with the retrieval of the NTDS.dit database. This maps to T1003.003 OS Credential Dumping: NTDS.
4. The Network Intrusion Detection System flagged anomalous activity involving registry tool interactions on the domain controller, a known indicator of SYSTEM hive extraction.
5. Suspicious SMB file-sharing traffic appeared on port 445, consistent with large-file lateral transfer toward a staging host.
6. Endpoint sensors confirmed the PsExec service instantiation on the target domain controller under the compromised admin account, closing the loop on the lateral movement chain.

Trellix Helix linked all six events through matching IP addresses, user account identifiers, and timestamps. What would have required hours of manual correlation and risked missing the connection entirely was resolved automatically into a single incident with full context.

Each stage as the attack unfolds, is automatically enriched with MITRE ATT&CK context, showing analysts not just what happened, but precisely where the attack sits in the adversary kill chain and what must be disrupted to stop it.

Why technique-level detection outperforms tool-based detection

The simulations above used Metasploit and Meterpreter, which are well-known, easily blocked tools. A sophisticated adversary would not use these. Real-world intrusions leverage living-off-the-land binaries, such as wmic.exe, ntdsutil.exe, vssadmin.exe, and robocopy.exe. These are all signed Microsoft utilities that appear in legitimate administrative activity every day.

Tool-based detection fails when the attacker changes their tooling, uses a novel framework, or wraps a known technique in an obfuscated loader. Technique-level detection does not fail in these scenarios because of the behavioral signature. In this case, SMB lateral movement to a domain controller, followed by NTDS.dit file access, followed by large-file transfer remains constant regardless of what executes it.

Trellix Helix operates at the technique level. It does not look for Metasploit command signatures. It looks for the behavioral pattern: administrative tool executing on a domain controller, accessing the NTDS directory, combined with lateral movement telemetry and outbound transfer a pattern that holds true whether the adversary uses Metasploit, Impacket, a custom C2 implant, or a PowerShell one-liner.

This is the fundamental advantage of a correlation-first, technique-aware solution: It closes the detection gap that tool rotation exploits.

Recommended response actions

Based on the Trellix Helix alert analysis, organizations should execute the following response actions immediately upon detecting this class of credential theft:

1. Immediate containment:
   • Isolate all systems identified in the Trellix Helix alert from the network to halt lateral movement.
   • Disable compromised user accounts, with priority given to domain administrator and other privileged identities.
   • Block outbound connections from affected hosts to prevent confirmed or suspected exfiltration.
2. Credential reset and rotation:
   • Reset passwords for all privileged accounts immediately, beginning with domain admins.
   • Reset the KRBTGT account password twice (with the appropriate waiting period between resets) to invalidate all active Kerberos tickets and eliminate Golden Ticket risk.
   • Enable multi-factor authentication on all administrative accounts.
3. Investigation and forensics
   • Review authentication logs for evidence of pass-the-hash or pass-the-ticket attacks using stolen credential material.
   • Examine network logs for confirmed exfiltration channels.
   • Analyze PsExec execution logs to map the full scope of lateral movement.
   • Review scheduled tasks, services, and registry run keys for attacker-installed persistence mechanisms.
4. System hardening:
   • Restrict administrative shares and disable SMB access where not operationally required.
   • Deploy application allowlisting to prevent unauthorized tool execution on domain controllers.
   • Enable Windows Defender Credential Guard and Remote Credential Guard.
   • Audit and restrict volume shadow copy creation rights to administrative accounts only.
5. Detection enhancement:
   • Verify that Trellix Endpoint Security and Trellix Network Security sensors are deployed across all domain controllers and critical assets.
   • Enable advanced threat hunting rules within Trellix Helix targeting NTDS.dit access patterns.
   • Configure automated response playbooks for credential theft scenarios to reduce response time.
   • Establish behavioral baselines for administrative tools, such as PsExec, vssadmin, and ntdsutil, to improve anomaly detection fidelity.
6. Long-term security improvements:
   • Implement a tiered Active Directory administrative model to limit the blast radius of future credential compromise.
   • Deploy privileged access workstations (PAWs) for all domain administration tasks.
   • Conduct regular adversary simulation exercises targeting NTDS.dit extraction to validate detection coverage.
   • Invest in security awareness training focused on phishing and credential hygiene as the most common initial access vectors.

Conclusion

The theft of the NTDS.dit file is not a sophisticated attack requiring novel zero-day exploits. It is a technique that can be executed with a range of tools, including the signed binaries already present on every Windows domain controller. What makes it so dangerous is not its complexity but its finality: a successful extraction delivers every credential in the domain, offline, with no further network interaction required.

The simulations in this blog, executed with Metasploit's psexec_ntdsgrab module and a live Meterpreter session, demonstrate that the technique signatures are consistent and detectable regardless of the tooling. Trellix Helix captures these signatures across endpoint, network, and policy telemetry layers and assembles them into a single, high-fidelity incident with full MITRE ATT&CK context.

What would otherwise be six separate low-context alerts, each individually deniable, each requiring manual investigation, becomes a CRITICAL severity incident with a complete kill-chain timeline, an affected asset inventory, and automatically delivered actionable response guidance. This is the security operations capability that modern identity-focused attacks demand: not faster tool signatures, but technique-aware correlation that holds true regardless of how the adversary executes the attack.

With Trellix Wise's AI-powered investigation capabilities layered on top of Trellix Helix, analysts can move directly from detection to strategic response eliminating the manual triage burden that sophisticated attackers depend on to operate undetected.

NTDS.dit theft is not about the tools. It never was. It is about the technique and detecting the technique is exactly what Trellix Helix is built to do.

Product coverage

To learn more about the Trellix Helix, take our product tour to see it in action or visit this page.

Discover the latest cybersecurity research from the Trellix Advanced Research Center.