What is an advanced persistent threat (APT)?

In one compromise, Volt Typhoon likely extracted NTDS.dit from three domain controllers over a four-year period. CISA, the NSA and the FBI published that detail in advisory AA24-038A in February 2024. In a second victim network, the same authoring agencies report the actor pulled NTDS.dit twice in nine months.

The tooling was vssadmin and ntdsutil. Both ship with Windows. Both are signed. The interesting number in that paragraph is four years, not the binaries.

That gap is the whole problem with the phrase advanced persistent threat. It is three words, and only one of them reliably describes what you are dealing with.

Advanced is the weakest of the three words

Volt Typhoon (MITRE ATT&CK G1017) is assessed by CISA, the NSA and the FBI as a PRC state-sponsored actor pre-positioning in US critical infrastructure. In one confirmed compromise documented in AA24-038A, initial access was likely an unpatched FortiGate 300D and CVE-2022-42475, with buffer overflow evidence found in the SSL-VPN crash logs. The advisory notes the group often uses publicly available exploit code for known vulnerabilities (T1190).

Microsoft's account of the January 2024 intrusion into its own corporate tenant is starker. Microsoft reported that Midnight Blizzard, which it attributes to the Russian SVR and which ATT&CK tracks as APT29 (G0016), got in through a password spray (T1110.003) against a legacy, non-production test tenant account with no MFA enabled. Microsoft's security team detected the activity on 12 January 2024. Microsoft states the actor began the spray in late November 2023. From there the actor compromised a legacy test OAuth application that held elevated access to the corporate environment, created a new user account to grant consent to its own malicious OAuth applications, and used the legacy application to grant itself the Office 365 Exchange Online full_access_as_app role (T1550.001).

No zero-day. No custom implant at the door. A missing MFA policy on an account nobody owned, and an OAuth app nobody had reviewed.

State-linked actors do burn real capability when the mission calls for it. Most of the time they do not need to. What is hard to replicate is the discipline: AA24-038A describes Volt Typhoon going quiet after credential dumping, running discovery, and not exfiltrating data.

Persistent is the word that earns its place

A commodity infostealer runs, ships a credential archive, and is done. The distinguishing property of the actors this term was invented for is that they have a mission that outlives your incident.

Watch what happened at Microsoft after detection. Microsoft's 8 March 2024 update reports that Midnight Blizzard increased the volume of its password sprays by as much as ten-fold in February compared to January, and used secrets found in exfiltrated email to reach source code repositories and other internal systems. Being caught was an input to the operation, not the end of it.

Threat means a person on the other end

This is the word that separates an APT from a malware family. Commodity malware runs the same decision tree every time. An operator watches what you do and changes.

The artifacts show it. AA24-038A records Volt Typhoon selectively clearing Windows event logs and other technical artifacts (T1070.001), using netsh to create a PortProxy registry modification on a PRTG server for internal proxying (T1090.001), and downloading an outdated but legitimate version of comsvcs.dll onto a domain controller in a non-standard folder. Each of those is a choice made against a specific environment.

Your containment action is telemetry for them. Reset one account and they use another. Block one C2 and they fall back to the SOHO router relay.

The naming problem, concretely

The same actor carries a different name in every vendor's telemetry. ATT&CK G0016 lists fourteen associated names for APT29: IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524 and Midnight Blizzard.

It gets worse when vendors rename their own clusters. Microsoft moved to a weather-themed taxonomy in April 2023, so NOBELIUM became Midnight Blizzard, STRONTIUM became Forest Blizzard, and IRIDIUM became Seashell Blizzard. Mandiant graduated the Sandworm cluster to APT44 in April 2024. ATT&CK G0034 now carries ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS and APT44 for one actor.

Some of that is being fixed. On 2 June 2025 Microsoft and CrowdStrike published a joint alias mapping, which CrowdStrike said had deconflicted more than eighty adversaries, with Google Threat Intelligence and Palo Alto Unit 42 stated as contributors. It is a translation table, not a merge. The clusters are still drawn from different telemetry and still disagree at the edges.

Three things follow for a defender:

1. An attribution name is a research label, not a detection. You cannot write a SIEM rule whose condition is actor = APT29. Rules match command lines, event IDs and authentication patterns.

2. A vendor alert titled with a group name is usually a hash or an infrastructure hit dressed up as attribution. Read what actually fired before you brief anyone.

3. Two reports about "the same group" may describe two different clusters. Check the evidence, not the name.

What changes for a defender

Eviction has to be complete or it is not eviction. AA24-038A's incident response guidance is blunt about this: reset every domain user and every local account, and reset krbtgt twice, allowing the first reset to replicate before the second, because the account keeps a two-password history. Half an eviction hands the actor a shorter path back in than the one they used the first time.

Detection has to target behaviour rather than tooling. When the toolkit is vssadmin, wmic, ntdsutil and netsh, there is no hash to block and no filename to alert on. CISA says as much in the advisory: conventional IOCs for this activity are generally lacking. That constraint is the whole argument for behavioural rules, which we covered in detection engineering.

The assumption of a single dwell period is the third thing to drop. Three NTDS.dit extractions across four years is not one intrusion with a long tail. It is repeated re-entry, each visit validating access that was already there. Scope your hunt across years of retained logs, not the window since the first alert.

Detection: ntds.dit mounted from outside its live path

ntdsutil, vssadmin plus a copy, and most AD credential dumpers all end at the same place. The ESE database engine attaches a copy of ntds.dit from a path that is not C:\Windows\NTDS. That leaves ESENT events in the Application log, which CISA specifically recommends reviewing because they survive far longer than Security log entries.

title: NTDS.dit attached from a path outside the live database location
id: 6b2f0f2a-1a3d-4a9e-9f4b-2d7c8e51a0c4
status: experimental
description: >
  Detects ESENT database events on a domain controller that reference ntds.dit
  at a shadow copy, temp or staging path. ntdsutil IFM, vssadmin plus copy and
  most AD credential dumpers all produce this sequence regardless of the binary
  that drove them.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: 'ESENT'
    EventID:
      - 216
      - 325
      - 326
      - 327
  keyword_db:
    - 'ntds.dit'
  keyword_offpath:
    - 'VolumeShadowCopy'
    - 'GLOBALROOT'
    - '\Windows\Temp\'
    - '\Users\Public\'
  condition: selection and keyword_db and keyword_offpath
falsepositives:
  - Backup agents that mount the AD database from a shadow copy on a schedule
  - Domain controller promotion using IFM media created by an administrator
  - Disaster recovery testing and AD migrations
level: high

What it catches: the staging step, not the tool. ntdsutil "ac i ntds" ifm and a manual vssadmin plus copy both land in it, and so does a renamed binary, because the ESE engine logs the path it attached rather than the process that asked.

What it misses, and this matters more than the hit rate:

• DCSync (T1003.006) never touches the file. The credentials come over the replication protocol. Different rule, different log source.

• Copying the raw volume without ESE mounting the result on that host. If the .dit is dragged off and parsed elsewhere, only events 216 or 325 may appear, and event 216 alone is a weak signal.

• Log clearing. Volt Typhoon selectively cleared event logs (T1070.001). If the Application log is gone by the time you hunt, so is the rule's input. Forward these events off-host.

Backup software is the dominant false positive. Baseline it once by account and destination path, then alert on anything outside that baseline. On a domain controller this should be a handful of events per week.

ATT&CK techniques referenced

Summary

Advanced is the least reliable word in the term. Two of the best-documented state-linked intrusions of the last few years started with an unpatched edge appliance and a password spray against an account with no MFA. Persistent is the property that actually separates these actors: they have a mission, they come back, and one victim network saw NTDS.dit pulled three times across four years. Threat means a human who reads your response and adjusts, which is why partial eviction fails and why tool-name detections do not hold. Treat vendor group names as research labels, and write rules against the behaviour underneath them.

Collect these first if you are starting from nothing on a domain controller:

Application log    ESENT       216, 325, 326, 327   ntds.dit attach/detach outside C:\Windows\NTDS
Security log       Microsoft   4688 (with cmdline)  ntdsutil, vssadmin, wmic, netsh
Security log       Microsoft   4624 / 4625          logon type 10 to DCs, spray patterns
TerminalServices-LocalSessionManager/Operational     21, 22, 23, 25
Entra ID sign-in logs                                failed sign-ins per source ASN, legacy auth

Identity is where the cheap end of this starts, so that is where to look first. Browse identity detections in the catalog, or go straight to the NTDS credential access rules.