Detects potential use of Rubeus via registered new trusted logon process

Read More

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

Read More

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Read More

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

Read More

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

Read More

Detects the use of Windows Credential Editor (WCE)

Read More

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Read More

Detects process handle on LSASS process with certain access mask

Read More

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Read More

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Read More

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Read More

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Read More

Detects process access requests from hacktool processes based on their default image name

Read More

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Read More

Detects process access requests to LSASS process with potentially suspicious access flags

Read More

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Read More

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Read More

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Read More

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

Read More

Detects new user account creation

Read More

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

Read More

Detects access to Okta admin functions through proxy.

Read More

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Read More

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Read More

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Read More

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Read More

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

Read More

Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials.

Read More

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

Read More

Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

Read More

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Read More

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Read More

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Read More

Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures.

Read More

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database.

Read More

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Read More

Detects certificate creation with template allowing risk permission subject

Read More

Detects certificate creation with template allowing risk permission subject and risky EKU

Read More

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

Read More

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Read More

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Read More

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Read More

Detects when a configuration change is made to an applications AppID URI.

Read More

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Read More

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More

Detect when users are authenticating without MFA being required.

Read More

Identifies when a key vault is modified or deleted.

Read More

Identifies when a Keyvault Key is modified or deleted in Azure.

Read More

Identifies when secrets are modified or deleted in Azure.

Read More

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Read More

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Read More

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Read More

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Read More

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More

Detects when an application acquires a certificate private key

Read More

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More

Collect pertinent data from the configuration files

Read More

Show when private keys are being exported from the device, or when new certificates are installed

Read More

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Read More

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More

See what commands are being input into the device by other people, full credentials can be in the history

Read More

Show when a monitor or a span/rspan is setup or modified

Read More

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Read More

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Read More

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Read More

Detects when the file "passwd" or "shadow" is copied from tmp path

Read More

Files with well-known filenames (sensitive files with credential data) copying

Read More

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

Read More

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Read More

Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

Read More

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Read More

Detects well-known credential dumping tools execution via service execution events

Read More

Detects well-known credential dumping tools execution via service execution events

Read More

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Read More

Detects passwords dumps from Keychain

Read More

Detecting attempts to extract passwords with grep and laZagne

Read More

Detecting attempts to extract passwords with grep

Read More

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Read More

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

Read More

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

Read More

Detects when highly privileged delegated permissions are granted on behalf of all users

Read More

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Read More

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Read More

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Read More

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Read More

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Read More

Detects process dump via legitimate sqldumper.exe binary

Read More

Detects when an end user consents to an application

Read More

Detects when end user consent is blocked due to risk-based consent.

Read More

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Read More

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Read More

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Read More

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Read More

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

Read More

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Read More

Detect failed authentications from countries you do not operate out of.

Read More

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Read More

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Read More

Detects when a user disables a critical security feature for an organization.

Read More

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Read More

Identifies when the Secrets are Modified or Deleted.

Read More

Detects suspicious session with two users present

Read More

Detects attempts to use system dialog prompts to capture user credentials

Read More

Detects suspicious user agent strings user by hack tools in proxy logs

Read More

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Read More

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Read More

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More

Detects file creation events with filename patterns used by CrackMapExec.

Read More

Detects suspicious process patterns found in logs when CrackMapExec is used

Read More

Detects well-known credential dumping tools execution via specific named pipe creation

Read More

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

Read More

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Read More

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

Read More

Detects command line parameters used by Hydra password guessing hack tool

Read More

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Read More

Detects creation of default named pipes used by the Koh tool

Read More

Detects the use of KrbRelay, a Kerberos relaying tool

Read More

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More

Detection well-known mimikatz command line arguments

Read More

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Read More

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

Read More

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Read More

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

Read More

Detects usage of the Quarks PwDump tool via commandline arguments

Read More

Detects a dump file written by QuarksPwDump password dumper

Read More

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

Read More

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More

Detects the execution of the hacktool Rubeus using specific command line flags

Read More

Detects default lsass dump filename generated by SafetyKatz.

Read More

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Read More

Detects the execution of SecurityXploded Tools

Read More

Detects files written by the different tools that exploit HiveNightmare

Read More

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More

Detect the harvesting of wifi credentials using netsh.exe

Read More

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Read More

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More

Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

Read More

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Read More

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Read More

Detects when Kubernetes Secrets are Modified or Deleted.

Read More

Detect attempt to enable auditing of TTY input

Read More

Detects events with patterns found in commands used for reconnaissance on linux systems

Read More

Detects Access to LSASS Process

Read More

Detects potential mimikatz-like tools accessing LSASS from non system account

Read More

Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference

Read More

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Read More

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Read More

Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

Read More

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

Read More

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

Read More

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Read More

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Read More

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Read More

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

Read More

Detects Mimikatz DC sync security events

Read More

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Read More

Detects failed logon attempts from clients to MSSQL server.

Read More

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Read More

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read More

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Read More

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

Read More

Detects the execution of netsh with the "trace" flag in order to start a network capture

Read More

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

Read More

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

Read More

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

Read More

Detects creation of a file named "ntds.dit" (Active Directory Database)

Read More

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

Read More

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Read More

Detects potential abuse of ntdsutil to dump ntds.dit database

Read More

Detects common NTLM brute force device names

Read More

Detects when an attempt at deactivating or resetting MFA.

Read More

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

Read More

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.

Read More

Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

Read More

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Read More

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

Read More

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

Read More

Detect when a user has reset their password in Azure AD

Read More

Indicates that a password spray attack has been successfully performed.

Read More

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

Read More

Detects execution of PktMon, a tool that captures network packets.

Read More

Detects DCShadow via create new SPN

Read More

Detect AD credential dumping using impacket secretdump HKTL

Read More

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Read More