UNC6692 Snow - FTK Imager Active Directory Database Extraction

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the execution of known forensic imaging tools (FTK Imager or AD Imager) or commands interacting with the Active Directory database (ntds.dit). This behavior is characteristic of unauthorized attempts to extract credential hashes from the NTDS.dit file for offline cracking.