NTDS.dit extraction

AD database copied (via VSS/ntdsutil) to dump every domain credential

categoryIdentity, authentication and credential attacksseverityVery Highdetectability (measured in our lab)Lowlabpartially detected

Example: Storm-0501

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1003.003 · Copy NTDS in low level NTFS acquisition via MFT parsing · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.003 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1003.003 -TestGuids f57cb283-c131-4e2f-8a6c-363d575748b2 -TimeoutSeconds 120'

ATT&CK T1003.003 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.003 -Tool atomic -RunId run-2026-11-02-001 -Command 'Invoke-AtomicTest T1003.003 -TestGuids f57cb283-c131-4e2f-8a6c-363d575748b2 -TimeoutSeconds 120'

What our lab measured

partially detected windows · 2026-11-02

What it looked like in telemetry

Log source	What it means
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell executed "Get-Content -Stream or Invoke-Expresion". Possible string execution as code
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 4 more event type(s)

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~5855 incidental alerts/hour — tune against this.

Classification

23 values: 13 reviewed, 2 lab-measured, 7 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	Very High
Impact	Confidentiality
Platform	Windows
Environment	On-premises
Target asset class	IdentityServer
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Low
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File CreationFile ModificationProcess CreationVolume Creation

Detection & response

Mitigated by 13

M1017 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1041 attack-mitigation
D3-ANCI d3fend
D3-CCSA d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DUC d3fend
D3-MFA d3fend
D3-RIC d3fend

Detected by 25

DET0586 attack-detection-strategy
0b8baa3f-575c-46ee-8715-d6f28cc7d33c sigma
11b1ed55-154d-4e82-8ad7-83739298f720 sigma
252902e3-5830-4cf6-bf21-c22083dfd5cf sigma
2afafd61-6aae-4df4-baed-139fa1f4c345 sigma
2e69f167-47b5-4ae7-a390-47764529eff5 sigma
2fcda7e2-8c57-4904-86ac-37fc3157e09d sigma
3a8da4e0-36c1-40d2-8b29-b3e890d5172a sigma
40b19fa6-d835-400c-b301-41f3a2baacaf sigma
4e7050dd-e548-483f-b7d6-527ab4fa784d sigma
7df1713a-1a5b-4a4b-a071-dc83b144a101 sigma
84972c80-251c-4c3a-9079-4f00aad93938 sigma
8b93a509-1cb8-42e1-97aa-ee24224cdc15 sigma
8bc64091-6875-4881-aaf9-7bd25b5dda08 sigma
8fbf3271-1ef6-4e94-8210-03c2317947f6 sigma
910ab938-668b-401b-b08c-b596e80fdca5 sigma
92dae1ed-1c9d-4eff-a567-33acbd95b00e sigma
a58353df-af43-4753-bad0-cd83ef35eef5 sigma
afd12fed-b0ec-45c9-a13d-aa86625dac81 sigma
b140afd9-474b-4072-958e-2ebb435abd68 sigma
b17ea6f7-6e90-447e-a799-e6c0a493d6ce sigma
b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee sigma
d3b70aad-097e-409c-9df2-450f80dc476b sigma
e6e88853-5f20-4c4a-8d26-cd469fd8d31f sigma
e7be6119-fc37-43f0-ad4f-1f3f99be2f9f sigma

Tested by 11

21748c28-2793-4284-9e07-d6d028b66702 atomic
21c7bf80-3e8b-40fa-8f9d-f5b194ff2865 atomic
224f7de0-8f0a-4a94-b5d8-989b036c86da atomic
2364e33d-ceab-4641-8468-bfb1d7cc2723 atomic
542bb97e-da53-436b-8e43-e0a7d31a6c24 atomic
b385996c-0e7d-4e27-95a4-aca046b119a7 atomic
c6237146-9ea6-4711-85c9-c56d263a6b03 atomic
c7be89f7-5d06-4321-9f90-8676a77e0502 atomic
d893459f-71f0-484d-9808-ec83b2b64226 atomic
dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f atomic
f57cb283-c131-4e2f-8a6c-363d575748b2 atomic

Attack relationships

Parent: Credential-dumping tooling

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-11-02-001`	partially-detected	atomic	windows	2026-11-02

run-2026-11-02-001 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=11). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=161 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1003/
attack: T1003.003 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 335 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 26 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-001 (partially-detected) for T1003.003: no alert matched the expected technique