Detect NTDS.dit Password Extraction Attack
The best detection is to look for unexpected access events on the NTDS.dit file.
APPROACH
NTDS.dit File Access
DESCRIPTION
Monitor for access to the NTDS.dit file in the following ways:
- Direct access to the file on the file system. This file is locked by Active Directory while in use so typically an attacker cannot obtain the file without stopping the Active Directory service. Monitoring for access events as well as access denied events by user accounts can provide meaningful insight into unwanted access attempts, because the AD service runs as Local System.
- Access to the NTDS.dit file through Volume Shadow Copies. While the file is locked attackers are able to create a shadow copy of the entire drive and extract the NTDS.dit file from the shadow copy.
PRODUCT: StealthDEFEND
