attack.t1078.003 | Detection.FYI

Admin User Remote Logon
May 2, 2023 · attack.lateral_movement attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·
Share on:
Detect remote login by Administrator user (depending on internal pattern).

Read More
User Added To Admin Group - MacOS
Mar 21, 2023 · attack.t1078.003 attack.initial_access attack.privilege_escalation ·
Share on:
Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Read More