Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Detecting NTDS Database Dumping

Learn how attackers dump NTDS, the heart of Active Directory, and detect it with logs and artifacts.

Task 1: Introduction

Task 2: NTDS From Adversarial Perspective

Task 3: Detecting NTDS Dumping With Logs

Task 4: Detecting NTDS Dumping With Artifacts

Task 5: Detecting DCSync Attack With Logs

Task 6: Protection Against NTDS Dumping

Task 7: Conclusion

Back to all walkthroughs
Room Icon

Detecting NTDS Database Dumping

Max room.

Learn how attackers dump NTDS, the heart of Active Directory, and detect it with logs and artifacts.

medium

60 min

9

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

NTDS.dit is the Active Directory database on every domain controller, and it holds the password hashes of the entire domain. In this room, you will see how adversaries steal the domain database, how you catch them in the logs, how you confirm it from disk when the logs are gone, and how you limit the damage of a stolen NTDS.dit.

Learning Objectives

  • Recall what NTDS stores and why it is a primary target
  • Practice exporting NTDS with ntdsutil, VSS, and DCSync
  • Detect NTDS dumping via file copying with logs and artifacts
  • Detect DCSync from directory-service and authentication logs
  • Learn how to prevent and remediate NTDS database dumping

Prerequisites

Lab Access

Before moving forward, start the lab by clicking the Start Machine button below. The opens in split view and takes up to five minutes to fully load. You also need to use DefenseBox or use your own -connected machine to practice the commands from Task 2 and dig deeper into the topic.

For a smooth experience, we highly recommend using the target VM and DefenseBox over OpenVPN. The credentials for DefenseBox are DFIRUser:Secure!, and the credentials for the target VM are shown below.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your DefenseBox and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Defender machine
Status:Off
Lab machine
Status:Off

Credentials

Alternatively, you can access the VM from your own VPN-connected machine with the credentials below:

Username
 
Administrator
 
Password
 
Secure!
 
IP address
 
MACHINE_IP
 
Connection via
 
RDP
Answer the questions below

Let's begin!