attack.t1550.003 | Detection.FYI

HackTool - KrbRelayUp Execution

Aug 12, 2024 · attack.credential-access attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More
HackTool - Rubeus Execution

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More
HackTool - Rubeus Execution - ScriptBlock

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1558.003 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

Read More
Uncommon Outbound Kerberos Connection

Aug 12, 2024 · attack.credential-access attack.t1558 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More