Hackers Breach Active Directory, Steal NTDS.dit for Full Domain Compromise

Threat actors infiltrated a corporate environment and dumped the AD database file NTDS[.]dit, enabling near-full domain control after breaching Active Directory. The breach began with a phishing email that granted administrative privileges on a workstation and allowed use of a remote access tool, followed by lateral movement that captured LSASS process memory to steal password hashes with Mimikatz and used Pass-the-Hash to reach a domain controller.

Once at the domain controller, the attackers used Volume Shadow Copy Service to create a hidden snapshot of the system volume, quietly extracting NTDS[.]dit and the SYSTEM registry hive, which contains the decryption key, so they could decrypt and process the entire AD database offline. Built-in Windows tools such as vssadmin and PowerShell were used to copy locked files, with esentutl repairing the shadow copy prior to dumping credentials with SecretsDump.

The incident was monitored by Trellix Network Detection and Response, which identified key stages by analysing behavioural patterns rather than signatures and highlighted suspicious SMB traffic, shadow copy creation, and archive exfiltration as notable indicators.