attack.t1207 | Detection.FYI

Add or Remove Computer from DC

Aug 12, 2024 · attack.defense-evasion attack.t1207 ·
Share on:

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Read More
Possible DC Shadow Attack

Aug 12, 2024 · attack.credential-access attack.t1207 ·
Share on:

Detects DCShadow via create new SPN

Read More