attack.s0404 | Detection.FYI

Esentutl Gather Credentials

Nov 24, 2025 · attack.credential-access attack.t1003 attack.t1003.003 attack.s0404 ·
Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Read More
Copying Sensitive Files with Credential Data

Aug 28, 2025 · attack.credential-access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·
Share on:

Files with well-known filenames (sensitive files with credential data) copying

Read More