Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"
Deletes the mount of the snapshot
Deletes the snapshot
C:\Windows\System32\dsdbutil.exe, C:\Windows\SysWOW64\dsdbutil.exe
IOC: Event ID 4688, IOC: dsdbutil.exe process creation, IOC: Event ID 4663, IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit, IOC: Event ID 4656, IOC: Regular and Volume Shadow Copy attempts to read or modify ntds.dit, Analysis: , Sigma: , Elastic: , Splunk: , BlockRule: 
bohop (@bohops), Ekitji (@eki_erk)