hard20 pts · first answer countsidentity-securityactive-directorycredential-theft

ntdsutil run on a domain controller

EDR shows this command on a domain controller at 2 a.m. from an account that does not normally manage AD. What did the attacker most likely obtain?

ntdsutil "ac i ntds" "ifm" "create full C:\Windows\Temp\x" q q

A.A full list of DNS records to map out the networkB.A backup of Group Policy so they can change login scriptsC.A copy of the event logs so they can delete their tracksD.An offline copy of the AD database to extract every hash

Discussion 0

Join free to post in the discussion.

ntdsutil run on a domain controller

Discussion 0

Related questions