public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-01-12 23:11:40 +01:00
Code Issues Projects Releases Wiki Activity

Re-added ntdsutil

Browse Source
This commit is contained in:
Oddvar Moe 2020-03-17 10:55:59 +01:00
parent 4bef10b147
commit dc3a211c89
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
yml/OtherMSBinaries/Ntdsutil.yml Normal file
View File

@ -0,0 +1,26 @@
---
Name: ntdsutil.exe
Description: Command line utility used to export Actove Directory.
Author: 'Tony Lambert'
Created: '2020-01-10'
Commands:
- Command: ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q
Description: Dump NTDS.dit into folder
Usecase: Dumping of Active Directory NTDS.dit database
Category: Dump
Privileges: Administrator
MitreID: T1003
MitreLink: https://attack.mitre.org/wiki/Technique/T1003
OperatingSystem: Windows
Full_Path:
- Path: C:\Windows\System32\ntdsutil.exe
Code_Sample:
- Code:
Detection:
- IOC: ntdsutil.exe with command line including "ifm"
Resources:
- Link: https://adsecurity.org/?p=2398#CreateIFM
Acknowledgement:
- Person: Sean Metcalf
Handle: '@PyroTek3'
---