attack.t1207 | Detection.FYI

Add or Remove Computer from DC

Oct 17, 2023 · attack.defense_evasion attack.t1207 ·
Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Read More
Possible DC Shadow Attack

Oct 17, 2023 · attack.credential_access attack.t1207 ·
Share on:

Detects DCShadow via create new SPN

Read More