name: Credential Dumping Ntds test
detections:
  - Creation of Shadow Copy
  - Creation of Shadow Copy with wmic and powershell
  - Credential Dumping via Copy Command from Shadow Copy
  - Credential Dumping via Symlink to Shadow Copy
description: Test credential dumping detections
pass_condition: '| stats count | where count > 0'
target: attack-range-windows-domain-controller
simulation_technique: 'T1003.003'