NTDS.dit extraction via wbadmin.exe backup include list
Detects the use of the built-in Windows tool 'wbadmin.exe' to perform a system backup that specifically includes the Active Directory database (ntds.dit) along with SYSTEM and SECURITY registry hives. This technique is often used by adversaries to perform offline credential theft by creating an accessible copy of sensitive domain files.
Microsoft Sentinel (KQL)
