attack.t1098.005 | Detection.FYI

Windows LAPS Credential Dump From Entra ID

Aug 12, 2024 · attack.t1098.005 ·
Share on:

Detects when an account dumps the LAPS password from Entra ID.

Read More

Recent Posts

CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
Renamed Powershell Under Powershell Channel
Suspicious Non PowerShell WSMAN COM Provider
Antivirus Password Dumper Detection
HackTool - Certipy Execution
Alternate PowerShell Hosts Pipe
Local System Accounts Discovery - Linux
Disable Windows Defender Functionalities Via Registry Keys

Language

SIGMA 3890 ELASTIC 1200 MQL 456

Tags

ATTACK.DEFENSE-EVASION 1267 USE-CASE-THREAT-DETECTION 827 ATTACK.EXECUTION 826 DOMAIN-ENDPOINT 754 DATA-SOURCE-ELASTIC-DEFEND 594 ATTACK.PERSISTENCE 570 OS-WINDOWS 441 ATTACK.PRIVILEGE-ESCALATION 370 DATA-SOURCE-ELASTIC-ENDGAME 336 DETECTION.EMERGING-THREATS 330 TACTIC-DEFENSE-EVASION 298 ATTACK.CREDENTIAL-ACCESS 297 RESOURCES-INVESTIGATION-GUIDE 272 OS-LINUX 263