Forensia CTI Core

About

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller. In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information. The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy

Platforms: WindowsParent: T1003 OS Credential DumpingMITRE ATT&CK ↗

Used by actors

18 known groups

G0004 Ke3chang G0007 APT28 G0034 Sandworm Team G0035 Dragonfly G0037 FIN6 G0045 menuPass G0096 APT41 G0102 Wizard Spider G0114 Chimera G0117 Fox Kitten G0125 HAFNIUM G0129 Mustang Panda G1004 LAPSUS$G1015 Scattered Spider G1016 FIN13 G1017 Volt Typhoon G1051 Medusa Group G1054 MirrorFace

Software

4 malware/tools implement this

KoadicImpacketesentutlCrackMapExec

Corpus indicators tagged with this technique

37 indicators in the corpus carry T1003.003.

Indicator	Type	Family	Sev	Src
cve-2021-27076	cve	—	85	1
a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331	sha256	ransomware	80	1
6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23	sha256	ransomware	80	1
18b8e6762afd29a09becae283083c74a19fc09db1f2c3412c42f1b0178bc122a	sha256	ransomware	80	1
186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da	sha256	ransomware	80	1
a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2	sha256	ransomware	80	1
6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c	sha256	—	80	1
febbaf5f08a8e0782ffcce8beef1f2b4e249a52b	sha1	ransomware	78	1
23fd50b3bcc06f5adcbd0122c32260786ec3b98a	sha1	—	78	1
1b9aa401457d29405c0bcf19cbf19a7028a0d214	sha1	ransomware	78	1
f352cec89a56e23dae20cdd62df4d40bc7f22b5e	sha1	ransomware	78	1
a746da514c90f26a187a294fda7edc1b	md5	ransomware	76	1
24fcebdeecba65004fdb0923763d74fd	md5	—	76	1
9c872a0d5d5a38950e8b9ac9b488be3f	md5	—	76	1
9cbd560f820c95d7c38342cd558cb5c6	md5	—	76	1
a514d1bb62d7916475946fe7c07ac0aa	md5	—	76	1
aa3086be652c8b20b0b29b2730d57119	md5	—	76	1
b3352b42432dedc4a519f011dc8b5d5a	md5	—	76	1
c559cc68986933200fd5d9e4388e2f58	md5	—	76	1
d98f568496512e4f98670c61c97cb07a	md5	—	76	1
1f65544978b8ea0e745e573b8ee9684b	md5	—	76	9
bcee0ab10b23f5999bcdb56c0b4a631a	md5	ransomware	76	1
ca8646dfc88423bb9fffda811160cebe	md5	ransomware	76	1
172.96.137.160	ip	ransomware	70	1
193.242.184.150	ip	ransomware	70	1
109.205.195.211	ip	ransomware	70	1
ip-scanner.org	domain	ransomware	65	1
connect-microsoft.com	domain	—	65	1
opmanager.pro	domain	ransomware	65	1
2rxyt9urhq0bgj.org	domain	ransomware	65	1

Showing the top 30 by severity of 37.