.. / ntdsutil.exe
Star

Command line utility used to export Active Directory.


Paths:

Resources:
Acknowledgements:

Detection:

Dump

Dump NTDS.dit into folder
ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q
Usecase: Dumping of Active Directory NTDS.dit database
Privileges required: Administrator
OS: Windows
MITRE ATT&CK®: T1003.003