BYPASSING EDR NTDS.DIT PROTECTION USING BLUE TEAM TOOLS

Summary from the TLDR InfoSec newsletter

This blog post details a method for extracting NTDS hashes while bypassing EDR and OS protections. The SYSTEM hive and NTDS.dit are needed to extract these hashes. The author utilized forensics tooling to extract these files without triggering EDR or OS protections.