value:  SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit. ;; Koadic can gather hashed passwords by gathering domain controller hashes from NTDS. ;; menuPass has used Ntdsutil to dump credentials. ;; Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file. ;; Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database."
name: OS Credential Dumping: Ntds