attack.t1557.001

Potential PetitPotam Attack Via EFS RPC Calls

Nov 24, 2025 · attack.collection attack.credential-access attack.t1557.001 attack.t1187 ·

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Attempts of Kerberos Coercion Via DNS SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·

Share on:

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the nslookup command.

HackTool - ADCSPwn Execution

Oct 23, 2025 · attack.collection attack.credential-access attack.t1557.001 ·

Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

HackTool - Impacket Tools Execution

Oct 23, 2025 · attack.collection attack.execution attack.credential-access attack.t1557.001 ·

Share on:

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Local Privilege Escalation Indicator TabTip

Oct 23, 2025 · attack.collection attack.execution attack.credential-access attack.t1557.001 ·

Share on:

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Potential SMB Relay Attack Tool Execution

Oct 23, 2025 · attack.collection attack.execution attack.credential-access attack.t1557.001 ·

Share on:

Detects different hacktools used for relay attacks on Windows for privilege escalation

RottenPotato Like Attack Pattern

Oct 23, 2025 · attack.collection attack.privilege-escalation attack.credential-access attack.t1557.001 ·

Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·

Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·

Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

WinDivert Driver Load

Oct 23, 2025 · attack.credential-access attack.collection attack.defense-evasion attack.t1599.001 attack.t1557.001 ·

Share on:

Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows