Malware

esentutl

esentutl is a legitimate Windows utility that can be abused as a dual-use collection and credential-access tool. The provided content states that it can be used to collect data from local file systems and can copy the Active Directory NTDS.dit database using the Volume Shadow Copy service. This behavior makes it relevant to collection of local data as well as theft of Active Directory credential material from domain controllers. The content does not attribute esentutl to a specific threat actor directly, but places it alongside broader tradecraft used to obtain NTDS.dit for credential dumping.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence3

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Credential Access

3 techniques

T1003.003NTDSEvidence1

"APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access"; "Chimera ... gathered the SYSTEM registry and ntds.dit files"; "Impacket SecretsDump and Mimikatz modules ... obtain account and password information from NTDS.dit"; "Wizard Spider ... gained access to credentials via exported copies of the ntds.dit Active Directory database" | "CrackMapExec can dump hashed passwords ... using ... Volume Shadow Copy"; "esentutl can copy ntds.dit using the Volume Shadow Copy service"; "Fox Kitten has used Volume Shadow Copy to access credential information from NTDS"; "Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file"; "Wizard Spider ... created a volume shadow copy ... to collect NTDS.dit"

T1555Credentials from Password StoresEvidence1

edr-win-cred-browser-esentutl

T1555.003Credentials from Web BrowsersEvidence1

Detects esentutl.exe used to copy browser credential databases (Login Data, cookies, etc). Threat actors use the /y (copy) and /d (destination) flags to duplicate locked browser databases for offline credential extraction.

Collection

1 technique

T1005Data from Local SystemEvidence3

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Jan 21, 2026

OS Credential Dumping: NTDS, Sub-technique T1003.003 - Enterprise | MITRE ATT&CK®

Legitimate Windows database utility abused to copy the Active Directory database (NTDS.dit), often via Volume Shadow Copy, to facilitate offline credential extraction.

mitre attackNews

Jan 25, 2026

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Legitimate Windows utility abused to collect data from local file systems.

mitre attackNews

Mar 18, 2026

OS Credential Dumping: NTDS, Sub-technique T1003.003 - Enterprise | MITRE ATT&CK®

Windows utility that can be abused to copy ESE database files (including NTDS.dit) often as part of credential access workflows.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

esentutl