LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

dsdbutil.exe

View source

Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.

DumpAlias: dsDbUtil.exe
05COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Dump5

EXAMPLE 01T1003.003

dsdbutil supports VSS snapshot creation

COMMAND
dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"
USE CASE
Snapshoting of Active Directory NTDS.dit database
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Server 2012, Windows Server 2016, Windows Server 2019
EXAMPLE 02T1003.003

Mounting the snapshot with its GUID

COMMAND
dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"
USE CASE
Mounting the snapshot to access the ntds.dit with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Server 2012, Windows Server 2016, Windows Server 2019
EXAMPLE 03T1003.003

Deletes the mount of the snapshot

COMMAND
dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"
USE CASE
Deletes the snapshot
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Server 2012, Windows Server 2016, Windows Server 2019
EXAMPLE 04T1003.003

Mounting with snapshot identifier

COMMAND
dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"
USE CASE
Mounting the snapshot identifier 1 and accessing it with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Server 2012, Windows Server 2016, Windows Server 2019
EXAMPLE 05T1003.003

Deletes the mount of the snapshot

COMMAND
dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"
USE CASE
deletes the snapshot
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Server 2012, Windows Server 2016, Windows Server 2019
02 / ON DISK

Known paths

C:\Windows\System32\dsdbutil.exe
C:\Windows\SysWOW64\dsdbutil.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    Event ID 4688

  • IOC

    dsdbutil.exe process creation

  • IOC

    Event ID 4663

  • IOC

    Regular and Volume Shadow Copy attempts to read or modify ntds.dit

  • IOC

    Event ID 4656

  • IOC

    Regular and Volume Shadow Copy attempts to read or modify ntds.dit

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

bohop@bohops
Ekitji@eki_erk