이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when Ntdsutil is used in a suspicious manner, typically to access the Ntds.dit file.
Strategy
Threat actors are known to utilize tools found natively in a victim’s environment to accomplish their objectives. Ntdsutil, a legitimate Windows binary, has been abused by malicious actors in the past to gain access to the Ntds.dit file.
Triage and response
- Identify if the usage of Ntdsutil is authorized, and confirm if the
Ntds.dit file was downloaded. - If it’s not authorized, isolate the host from the network.
- Follow your organization’s internal processes for investigating and remediating compromised systems.
