aol.pm

NTDS

Subtechnique · ATTACK:enterprise:T1003.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1003.003",
  "title": "NTDS",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1003/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--edf91964-b26e-4b4a-9600-ccacd7d7df24",
  "external_id": "T1003.003",
  "domain": "enterprise",
  "created": "2020-02-11T18:42:35.572Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Metcalf 2015",
      "url": "http://adsecurity.org/?p=1275"
    },
    {
      "source_name": "Wikipedia Active Directory",
      "url": "https://en.wikipedia.org/wiki/Active_Directory"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01e22d76-e2ee-407a-834f-e3428df142ba

Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095c33ca-c1fa-4a8c-9b1d-01c277140e6d

Nearest Neighbor Volexity

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5dd1a0-fde3-4194-8cd4-03c2e77479f5

Volexity UPSTYLE 2024

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10ecbc19-10ab-4564-a637-cc4f6773e533

CME Github September 2018

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c4654e5-eac8-41e1-8da9-f88cadc6cc20

CrowdStrike Scattered Spider JUL 2025 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--342fb7f0-ef23-4b17-8550-750cbe5c8723

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4775487a-b632-43f9-8372-83219e2aa98c

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47f8da55-c38f-4cec-b1c6-241ecb3dd8b8

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4faa4943-e54e-420d-a391-350ef629e766

Cary Esentutl · LOLBAS Esentutl

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f53206-d15a-4b4d-8391-9d5dd5e0e403

FireEye FIN6 April 2016 · FireEye FIN6 Apr 2019

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--582f4641-f68d-4dad-96e0-eb4da4128bbf

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e3f6da4-a327-4c42-8a12-bc5840336430

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ffaf9bf-10a0-477f-88ff-5b9e7d5831cc

Symantec Cicada November 2020

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64abef3c-d453-4782-b084-25f684b3f7ae

Cycraft Chimera April 2020 · NCC Group Chimera January 2021

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6be69d69-7e01-4dd7-bc91-1599687be997

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d0fb103-d6f6-4259-a62f-296735020176

Impacket Tools

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71b92fe6-dd99-4192-b327-8ef27b790123

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85b3d881-a9d2-45ff-a980-95d0bd9a3dd1

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b8e829b-9f29-4677-8f22-f63b6c49a115

Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94175b7b-a332-4e38-9d7b-3b900825bb3a

Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1e10048-626c-4e64-9bdb-fd576be8c19f

FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a291d185-31c8-4458-a3fc-9af617af28d9

Core Security Impacket · US-CERT TA18-074A

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a359e758-a95c-4064-b8d7-b8351489409e

Github Koadic

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4b332b2-1cad-4403-a101-4203238ffdbf

Rostovcev APT41 2021

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6da41e9-9925-4b83-b9a7-d29509b852de

Secureworks BRONZE PRESIDENT December 2019 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c031bd06-453b-4f80-9a04-98e74a420323

Microsoft NICKEL December 2021

ATTACK:enterprise:T1003.003 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c53e4807-05e4-46d2-9cb9-fd6301ac3738

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1197689-ff2e-4a0e-ad1e-69bb14c8822d

Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d17f93ce-f419-4297-a6dd-9d745df31b92

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d63bfe4b-634b-4702-953a-7865ef564dce

JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6b41083-5390-452d-991c-de86befbe6e1

Metcalf 2015

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed919b5f-3437-4955-96a0-8e1370adf7d1

CERT Polska

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.