esentutl is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.
| Technique | Procedure example |
|---|---|
| T1003.003 NTDS |
esentutl can copy `ntds.dit` using the Volume Shadow Copy service. |
| T1005 Data from Local System |
esentutl can be used to collect data from local file systems. |
| T1006 Direct Volume Access |
esentutl can use the Volume Shadow Copy service to copy locked files such as `ntds.dit`. |
| T1105 Ingress Tool Transfer |
esentutl can be used to copy files from a given URL. |
| T1564.004 NTFS File Attributes |
esentutl can be used to read and write alternate data streams. |
| T1570 Lateral Tool Transfer |
esentutl can be used to copy files to/from a remote share. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
