.. / ntdsutil.exe
Star

Command line utility used to export Actove Directory.


Paths:


Resources:
https://adsecurity.org/?p=2398#CreateIFM

Acknowledgement:
Sean Metcalf - @PyroTek3


Detection:
ntdsutil.exe with command line including "ifm"



Dump

Dump NTDS.dit into folder
ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q
Usecase:Dumping of Active Directory NTDS.dit database
Privileges required:Administrator
OS:Windows
Mitre:T1003