How to defend against copying the password hives

The attacker copies the SAM, SECURITY and SYSTEM hives, or NTDS.dit, with built-in tools, so detect the tools in that use: reg save of an HKLM hive, esentutl with a volume shadow copy, ntdsutil ... ifm, and vssadmin create shadow. Prevent what you can: Credential Guard keeps domain credentials out of reach, and on a domain controller the AD database and its backups are the crown jewels, so restrict and monitor administrator access. These tools need administrator rights, so fewer administrators means fewer accounts that can run them.

What the attacker does

Windows keeps password material in files: the SAM hive holds local account hashes, SECURITY holds LSA secrets and cached domain credentials, and on a domain controller NTDS.dit holds every domain account. The files are locked while Windows runs, so an attacker with administrator rights copies them with built-in tools instead of a named hacking program: reg save writes a hive to a file, vssadmin create shadow makes a volume shadow copy from which the locked files can be read, esentutl /vss copies a hive out of a shadow copy, and ntdsutil ... ifm produces a full copy of the AD database. The hashes are cracked or replayed elsewhere.

What it looks like in the logs

A process creation event for one of those tools, with the file it touches on the command line. This is one of the commands in the recordings:

Image	C:\Windows\System32\ntdsutil.exe
CommandLine	ntdsutil "ac i ntds" "ifm" "create full C:\Windows\Temp\ntds_T1003" q q
ParentImage	C:\Windows\System32\cmd.exe
User	PANDALAB\Administrator

ntds_T1003 is the folder ntdsutil was told to write the copy into; vssadmin create shadow and reg save HKLM\SYSTEM appear on other machines in the same set, because reading NTDS.dit needs the SYSTEM hive too.

Detect

Measured on the challenge data: the rule caught 6 of 6 attack events and matched 0 of 2,253 normal events.

Show the rule (try the challenge first)

title: Password hive or AD database copied with a built-in tool
id: d523bc75-0b21-4976-9028-6fc2b0940b50
status: test
description: >
  Detects a copy of the SAM, SECURITY or SYSTEM registry hive or of NTDS.dit made with a built-in
  tool: reg save of an HKLM hive, esentutl reading a config hive or ntds.dit, ntdsutil ifm, or
  vssadmin creating a shadow copy that the copy then reads. Normal administration rarely runs these.
references:
  - https://attack.mitre.org/techniques/T1003/
  - https://howdefend.com/defend/credential-hive-copy/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
  - attack.t1003.004
logsource:
  product: windows
  category: process_creation
detection:
  reg_save:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
      - ' save '
      - ' export '
  reg_hive:
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system'
      - 'hkey_local_machine\sam'
      - 'hkey_local_machine\security'
      - 'hkey_local_machine\system'
  esentutl:
    Image|endswith: '\esentutl.exe'
    CommandLine|contains:
      - '\config\sam'
      - '/config/sam'
      - '\config\security'
      - '/config/security'
      - '\config\system'
      - '/config/system'
      - 'ntds.dit'
  ntdsutil:
    Image|endswith: '\ntdsutil.exe'
    CommandLine|contains: 'ifm'
  shadow:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'create'
      - 'shadow'
  condition: (reg_save and reg_hive) or esentutl or ntdsutil or shadow
falsepositives:
  - A backup product that creates volume shadow copies on a schedule (filter it by its parent process)
level: high

What the rule misses

Reading memory instead of a file. Credentials can also be taken from lsass.exe in memory; that is a different data source with its own page.
A renamed or custom tool. The rule keys on the built-in program names. A copy of esentutl.exe under another name, or a purpose-built tool that reads the shadow copy directly, does not match. On a domain controller, watch access to the NTDS.dit path itself.
A direct read of the shadow copy. Once vssadmin has made the shadow copy, any program can read the files from the \\?\GLOBALROOT\... path; a copy done that way shows only the shadow creation, not a hive tool.

Prevent

Credential Guard. Keeps NTLM hashes and Kerberos tickets in an isolated environment, so a SECURITY hive copy yields far less.
Protect the domain controller. NTDS.dit and its backups are the whole domain. Restrict who can log on to a domain controller, and treat any ntdsutil or shadow-copy activity there as an incident until explained.
Fewer administrators. Every command here needs administrator rights. Unique local administrator passwords (LAPS) stop one SAM copy from unlocking other machines.

Practice

Write the rule yourself on the same data, with every target labelled.