MITRE ATT&CK T1003.003 WMIC Ntds.dit CISA Report

Google SecOps@GoogleSecOps

•updated Jun 2, 2025•0•0•1

Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf