Storm-2603 NTDS.zip Archive Creation Indicating NTDS.dit Exfiltration

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•3

Detects the creation of a file named 'NTDS.zip', which is a common naming convention used by adversaries when compressing the Active Directory database (NTDS.dit) for staging and subsequent exfiltration.