Cary Esentutl

Cary, M. (2018, December 6). Locked File Access Using ESENTUTL.exe. Retrieved September 5, 2019.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1003.003 NTDS	Toolesentutl	esentutl can copy `ntds.dit` using the Volume Shadow Copy service. Cary Esentutl LOLBAS Esentutl
T1006 Direct Volume Access	Toolesentutl	esentutl can use the Volume Shadow Copy service to copy locked files such as `ntds.dit`. Cary Esentutl LOLBAS Esentutl

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.