NTDS.dit credential dumping via ntdsutil, VSS, or secretsdump.py (backup-excluded)

Duo Tech@duotech

•updated Aug 11, 2026•5•0•12

Detects OS credential dumping of the Active Directory NTDS.dit database via ntdsutil, VSS-based extraction, or Impacket's secretsdump.py, excluding approved AD backup jobs and accounts.