attack.t1558 | Detection.FYI

Antivirus Password Dumper Detection

Oct 8, 2024 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·
Share on:

Detects a highly relevant Antivirus alert that reports a password dumper.

Read More
HackTool - Mimikatz Kirbi File Creation

Aug 12, 2024 · attack.credential-access attack.t1558 ·
Share on:

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Read More
Replay Attack Detected

Aug 12, 2024 · attack.credential-access attack.t1558 ·
Share on:

Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Read More
Uncommon Outbound Kerberos Connection

Aug 12, 2024 · attack.credential-access attack.t1558 attack.lateral-movement attack.t1550.003 ·
Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More
Kerberos .kirbi Ticket Files

Mar 26, 2024 · attack.s0002 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Kerberos ticket files (.kirbi) are of interest to adversaries as they can contain sensitive data such as NTLM hashes that can be cracked offline. To perform these attacks, a unique file extension variable is defined within Mimikatz that designates the default extension as .kirbi. Part of the RedCanary 2024 Threat Detection Report.

Read More
Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Read More