ntdsutil.exe

NT5DS file version info (xCyclopedia)

LOLBAS Dump 4 Sigma rules name it 1 ATT&CK technique 1 documented command 2 known copies with hashes

How ntdsutil.exe is abused

documented by LOLBAS

Dump T1003.003 OS Credential Dumping: NTDS

q

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ntdsutil.exe.

1 documented command

from LOLBAS, each read by the identifier

Dump T1003.003 OS Credential Dumping: NTDS Administrator privileges

Dump NTDS.dit into folder

ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q

Identify

Trips 3 Sigma rules: highSuspicious Process Patterns NTDS.DIT Exfil by Florian Roth (Nextron Systems); mediumInvocation of Active Directory Diagnostic Tool (ntdsutil.exe) by Thomas Patzke; mediumSuspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) by Nasreddine Bencherchali (Nextron Systems)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ntdsutil.exe, by Tony Lambert, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ntdsutil.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumSuspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)Nasreddine Bencherchali (Nextron Systems)

mediumInvocation of Active Directory Diagnostic Tool (ntdsutil.exe)Thomas Patzke

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

T1003.003OS Credential Dumping: NTDS

Is it the real ntdsutil.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNT5DS

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ntdsutil.exe · signed by Microsoft Windows

60ede9d533d695180715915d41c1ef56021cac59b4fd073c5c11e977512f1db4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ntdsutil.exe · signed by Microsoft Windows

692d8824d329ab6a2ed520ceda1f13ebf0cab9e8d32c4fd0a2f1bc980a0c002a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.