Hide Navigation Hide TOC NTDS.DIT Created (0b8baa3f-575c-46ee-8715-d6f28cc7d33c) Detects creation of a file named "ntds.dit" (Active Directory Database) Cluster A Galaxy A Cluster B Galaxy B Level NTDS.DIT Created (0b8baa3f-575c-46ee-8715-d6f28cc7d33c) Sigma-Rules NTDS - T1003.003 (edf91964-b26e-4b4a-9600-ccacd7d7df24) Attack Pattern 1 NTDS - T1003.003 (edf91964-b26e-4b4a-9600-ccacd7d7df24) Attack Pattern OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) Attack Pattern 2