Hackers Steal NTDS.dit to Dump Active Directory Password Hashes and Forge Golden Tickets
Trellix details how attackers dump the NTDS.dit Active Directory database via shadow copies to harvest NTLM hashes and forge persistent Golden Tickets.
4
Stories per day · 30 days
6 stories, newest first · one card per story
Stories tagged #golden-ticket
One Stolen Active Directory File Can Expose Credentials for an Entire Windows Domain
Trellix warns that stealing a domain controller's NTDS.dit and SYSTEM hive can expose an entire Windows domain's credentials.
2
CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks
CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.
3
Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly
Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.
3
Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes
Attackers abuse Active Directory replication (DCSync) via the DRSUAPI protocol to steal password hashes and forge Golden Tickets for persistent domain compromise.
5
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.