Hackers Steal NTDS.dit to Dump Active Directory Password Hashes and Forge Golden Tickets
Trellix details how attackers dump the NTDS.dit Active Directory database via shadow copies to harvest NTLM hashes and forge persistent Golden Tickets.
Trellix analysts documented an end-to-end attack chain, demonstrated in a controlled simulation, where intruders escalate from spearphishing-delivered in-memory loaders to SYSTEM access on a domain controller. Attackers abuse Volume Shadow Copy Service to copy the locked NTDS.dit database plus the SYSTEM registry hive, extracting NTLM hashes, Kerberos keys, and password history for offline cracking, pass-the-hash, and Golden Ticket forgery via the KRBTGT secret. Exfiltration used SMB and HTTPS to cloud storage, and defenders are advised to watch for shadow-copy creation, directory-file collection, and unusual outbound transfers rather than tool signatures.
- Attackers abuse Volume Shadow Copy Service to copy the locked NTDS.dit database
- Stolen NTLM hashes and Kerberos keys enable pass-the-hash and lateral movement
- KRBTGT secret allows forging Golden Tickets for durable domain persistence
- Chain began with spearphishing, malicious macros, shortcut files, or tampered installers
- Trellix recommends behavioral detection: monitor DC access, shadow copies, DCSync, exfiltration
- ATT&CK
- T1566.001 Spearphishing AttachmentT1003.001 LSASS MemoryT1003.003 NTDS.ditT1550.002 Pass the HashT1558.001 Golden Ticket
- Tags
- ntds-ditactive-directorygolden-ticketcredential-dumpingkerberospass-the-hashvolume-shadow-copywindows
From the original article
4 min read at cybersecuritynews.com
Threat actors that gain a foothold in a Windows network are increasingly aiming for the domain controller, the server that manages identities and permissions. A successful theft of its Active Directory database can expose password material for every account in the domain. That single step can transform a local intrusion into a far wider breach.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.