In this very easy sherlock, you will learn how to detect NTDS.dit dumping which is one of the most critical Active directory attacks. You will get your hands on event logs and MFT to respond to an attack where the attacker utilized vssadmin utility to dump the NTDS.dit database.
