attack.t1098.005 | Detection.FYI

Windows LAPS Credential Dump From Entra ID

Aug 12, 2024 · attack.t1098.005 ·
Share on:

Detects when an account dumps the LAPS password from Entra ID.

Read More

Recent Posts

BITS Transfer Job Download From File Sharing Domains
COM Object Hijacking Via Modification Of Default System CLSID Default Value
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
New Connection Initiated To Potential Dead Drop Resolver Domain
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
Suspicious File Download From File Sharing Domain Via Curl.EXE
Suspicious File Download From File Sharing Domain Via Wget.EXE
Suspicious File Download From File Sharing Websites - File Stream

Language

SIGMA 3889 ELASTIC 1205 MQL 460

Tags

ATTACK.DEFENSE-EVASION 1267 USE-CASE-THREAT-DETECTION 832 ATTACK.EXECUTION 826 DOMAIN-ENDPOINT 759 DATA-SOURCE-ELASTIC-DEFEND 599 ATTACK.PERSISTENCE 570 OS-WINDOWS 440 ATTACK.PRIVILEGE-ESCALATION 370 DATA-SOURCE-ELASTIC-ENDGAME 342 DETECTION.EMERGING-THREATS 330 TACTIC-DEFENSE-EVASION 300 ATTACK.CREDENTIAL-ACCESS 297 RESOURCES-INVESTIGATION-GUIDE 272 OS-LINUX 268