Hackers Steal NTDS.dit to Dump Active Directory Password Hashes and Forge Golden Tickets

Threat actors that gain a foothold in a Windows network are increasingly aiming for the domain controller, the server that manages identities and permissions.

A successful theft of its Active Directory database can expose password material for every account in the domain. That single step can transform a local intrusion into a far wider breach.

Researchers describe an attack chain that can begin with spearphishing, a harmful Office macro, a shortcut file, or a tampered installer.

A small first-stage program runs in memory, then contacts an attacker-controlled server and seeks higher privileges. From there, the intruder can move toward the domain controller while attempting to blend into ordinary Windows activity.

Trellix analysts noted the activity in a controlled simulation that followed credential theft from initial access through data removal.

Trellix said in a report shared with Cyber Security News (CSN) that defenders should focus on suspicious behavior, rather than depend only on known tool signatures.

The scenario matters because stolen password hashes can be used without learning the original password. They may also help attackers move between systems, impersonate privileged users, and preserve access after partial cleanup.

Similar risks appear in Active Directory password hash theft coverage, where attackers abuse identity systems rather than a single workstation.

Hackers Steal NTDS.dit

After reaching SYSTEM-level access, an attacker can collect credentials held by the Windows authentication process and reuse them to approach a domain controller.

The next target is the Active Directory database, which is normally locked while Windows is running. Attackers can abuse Volume Shadow Copy Service to create a readable copy and bypass that lock.

The stolen database is paired with a registry hive containing a key needed to unlock it offline. The result may include NTLM hashes, Kerberos keys, and password history for domain accounts.

In the lab chain, SMB and remote administration mechanisms copied the files before HTTPS exfiltration to cloud storage. Criminals do not need to crack every recovered password to benefit. A valid hash may support pass-the-hash activity, allowing access attempts with the hash itself.

Security teams have also seen Windows shadow-copy abuse attacks in which backup functions are turned against the organizations they were intended to protect.

The most serious consequence is access to the KRBTGT account secret. That secret lets an intruder forge a Golden Ticket, a Kerberos logon ticket that can claim powerful rights in the domain. Unless the relevant keys are changed, forged tickets can give attackers a durable route back into systems they previously compromised.

Detecting the Attack Chain

Rather than wait for a known malware file, defenders should watch activity around domain controllers. Signs include unusual privileged access, shadow-copy creation, directory-file collection, and large outbound transfers.

Broader Active Directory attack techniques guidance likewise highlights monitoring for credential dumping, DCSync, and forged tickets. Network visibility matters because exfiltration can hide in routine web traffic.

Organizations should review outbound connections from domain controllers and investigate unexpected SMB or HTTPS file transfers. They should also limit Volume Shadow Copy Service access and remove NTLM authentication where it is no longer required.

To reduce the chance of full identity takeover, administrators should enable the Protected Users group where appropriate and monitor paths to domain controllers.

They should audit replication rights and investigate unusual DCSync patterns, as DCSync attacks steal password hashes coverage explains. After a confirmed compromise, isolate affected systems, reset exposed privileged accounts, and plan a controlled KRBTGT key rotation.

Response cannot stop at deleting a suspicious program. Teams need to identify systems reached with stolen credentials, review logs for ticket misuse, and determine whether the database left the network.

The practical Active Directory security checklist offers context for reviewing identity exposure and recovery priorities. This simulated case reminds defenders that identity infrastructure is a high-value target after an initial breach.

They are better served by detecting behavior behind credential theft than by looking only for a familiar tool. Fast containment, disciplined credential recovery, and close domain-controller monitoring can prevent one intrusion becoming lasting control.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	ntds.dit	Active Directory database targeted for offline credential extraction.
Registry hive	SYSTEM	Registry hive containing the boot key used with the directory database.
File path	\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit	Shadow-copy path used in the simulated collection method.
Process name	lsass.exe	Windows authentication process targeted for credential material during the credential-theft stage.
File name	secretsdump.py	Offline credential-extraction utility referenced in the source material.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC