One Stolen Active Directory File Can Expose Credentials for an Entire Windows Domain, Trellix Warns

Trellix details an end-to-end attack chain, demonstrated in a controlled simulation, in which attackers steal a domain controller's NTDS.dit database and SYSTEM hive via shadow copies to extract NTLM hashes and Kerberos keys, enabling pass-the-hash, offline…

Trellix describes how theft of a domain controller's NTDS.dit database together with the SYSTEM registry hive can expose an entire Windows domain's credentials, including NTLM hashes, Kerberos keys, and password history. Because the live database is locked, attackers commonly abuse the Volume Shadow Copy Service to copy NTDS.dit plus the SYSTEM hive and then process it offline with tools such as Impacket or DSInternals. In a controlled simulation, Trellix analysts demonstrated the full chain, which began with spearphishing, malicious documents/macros, shortcut (LNK) files, trojanized installers, and in-memory loaders, escalating to SYSTEM access on a domain controller; credential theft from LSASS was also cited. The extracted secrets enable offline cracking, pass-the-hash, pass-the-ticket lateral movement, and Golden Ticket forgery using the KRBTGT secret for durable domain persistence. Exfiltration used SMB and HTTPS to cloud storage. Recommended response includes host isolation, privileged-account resets, and rotating KRBTGT twice to limit Golden Ticket reuse. Trellix advises defenders to rely on behavioral detection—monitoring domain controller access, shadow-copy creation, directory-file collection, DCSync, and unusual outbound transfers—rather than tool signatures.

• Trellix researchers documented the attack chain in a controlled simulation, per the Cyber Security News report dated 2026-09-22; the GBHackers report (2026-09-22) frames the same research as a warning.
• Attackers abuse the Volume Shadow Copy Service to copy the locked NTDS.dit database together with the SYSTEM registry hive from a domain controller.
• Impacket and DSInternals can extract NTLM hashes, Kerberos keys, and password history from the stolen files offline.
• Initial access vectors cited include phishing/spearphishing, malicious documents and macros, LNK shortcut files, trojanized installers, and in-memory loaders leading to SYSTEM access on the domain controller.
• Stolen secrets enable offline password cracking, pass-the-hash, pass-the-ticket lateral movement, and credential theft from LSASS.
• The KRBTGT secret allows forging Golden Tickets for durable domain persistence; Trellix advises rotating KRBTGT twice to limit Golden Ticket reuse.
• Exfiltration used SMB and HTTPS to cloud storage.
• Trellix recommends behavioral detection: monitor domain controller access, shadow-copy creation, directory-file collection, DCSync, and unusual outbound transfers rather than tool signatures; response steps include isolating the host and…