Hackers breach active directory, steal NTDS.dit using native windows tools, risking full domain takeover

Attackers gained admin access via a phishing email, moved laterally using Mimikatz to steal password hashes, and exploited Windows’ Volume Shadow Copy Service to extract and decrypt the locked Active Directory database (NTDS.dit) from the domain controller

Cybercriminals recently compromised a corporate network by stealing the Active Directory (AD) database file, NTDS.dit, nearly gaining full domain control. The AD database is critical, containing account data, password hashes, and group policies, making its theft extremely dangerous.

How the attack unfolded

The breach began when attackers gained admin access on a workstation through a phishing email that installed a remote access tool. From this entry point, they moved laterally across the network, capturing password hashes from the LSASS process using Mimikatz. Using Pass-the-Hash attacks, they authenticated to multiple servers and ultimately accessed a domain controller.

At the domain controller, the AD database was locked. To bypass this, the attackers used Windows’ built-in Volume Shadow Copy Service (VSS) to create a hidden snapshot of the system volume. This snapshot allowed them to quietly extract the NTDS.dit file and the SYSTEM registry hive, which holds the decryption key. With these files, they decrypted the AD database offline.

Rather than use noisy custom tools, the attackers relied on native Windows commands like vssadmin and PowerShell to copy locked files undetected. They then repaired the shadow copy using esentutl and extracted credentials with SecretsDump. The stolen data was compressed and moved over standard SMB connections to an attacker-controlled server, blending with normal network traffic.

Detection and prevention

Trellix Network Detection and Response (NDR) detected the breach by analyzing behavioral patterns and anomalies rather than signatures. It flagged unusual SMB file transfers to external IPs, suspicious use of vssadmin by non-admin accounts, and spikes in SMB reads on shadow copies.

Trellix’s AI correlated these alerts into a full kill chain, helping security teams quickly understand and contain the attack before further damage occurred.

This incident highlights the importance of monitoring native tool usage, establishing baselines for network protocol behavior, and correlating alerts into comprehensive attack narratives. Detecting subtle signs of NTDS.dit extraction is essential for preventing complete domain compromise in an evolving threat landscape.