attack.t1003.006

Credential Dumping Tools Service Execution - System
Apr 14, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:
Detects well-known credential dumping tools execution via service execution events

Read More
HackTool - Mimikatz Execution
Feb 22, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:
Detection well-known mimikatz command line arguments

Read More
Active Directory Replication from Non Machine Account
Feb 7, 2023 · attack.credential_access attack.t1003.006 ·
Share on:
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Read More
Credential Dumping Tools Service Execution
Feb 1, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:
Detects well-known credential dumping tools execution via service execution events

Read More
Credential Dumping Tools Service Execution - Security
Feb 1, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:
Detects well-known credential dumping tools execution via service execution events

Read More
Mimikatz DC Sync
Feb 1, 2023 · attack.credential_access attack.s0002 attack.t1003.006 ·
Share on:
Detects Mimikatz DC sync security events

Read More
Mimikatz Use
Feb 1, 2023 · attack.s0002 attack.lateral_movement attack.credential_access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More
Suspicious Get-ADReplAccount
Jan 27, 2023 · attack.credential_access attack.t1003.006 ·
Share on:
The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
Mimikatz Command Line With Ticket Export
Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:
Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

Read More