dsdbutil.exe

Commands

1. DumpAdministrator T1003.003

   Snapshoting of Active Directory NTDS.dit database

   dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"

   dsdbutil supports VSS snapshot creation

   os: Windows Server 2012, Windows Server 2016, Windows Server 2019

2. DumpAdministrator T1003.003

   Mounting the snapshot to access the ntds.dit with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`

   dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"

   Mounting the snapshot with its GUID

   os: Windows Server 2012, Windows Server 2016, Windows Server 2019

3. DumpAdministrator T1003.003

   Deletes the snapshot

   dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"

   Deletes the mount of the snapshot

   os: Windows Server 2012, Windows Server 2016, Windows Server 2019

4. DumpAdministrator T1003.003

   Mounting the snapshot identifier 1 and accessing it with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`

   dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"

   Mounting with snapshot identifier

   os: Windows Server 2012, Windows Server 2016, Windows Server 2019

5. DumpAdministrator T1003.003

   deletes the snapshot

   dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"

   Deletes the mount of the snapshot

   os: Windows Server 2012, Windows Server 2016, Windows Server 2019

Detection

• IOCEvent ID 4688
• IOCdsdbutil.exe process creation
• IOCEvent ID 4663
• IOCRegular and Volume Shadow Copy attempts to read or modify ntds.dit
• IOCEvent ID 4656
• IOCRegular and Volume Shadow Copy attempts to read or modify ntds.dit

Resources

• https://gist.github.com/bohops/88561ca40998e83deb3d1da90289e358
• https://www.netwrix.com/ntds_dit_security_active_directory.html