attack.t1558

Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock

Apr 7, 2025 · attack.reconnaissance attack.discovery attack.credential-access attack.t1018 attack.t1558 attack.t1589.002 ·

Share on:

Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

Antivirus Password Dumper Detection

Nov 4, 2024 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

HackTool - Mimikatz Kirbi File Creation

Aug 12, 2024 · attack.credential-access attack.t1558 ·

Share on:

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Replay Attack Detected

Aug 12, 2024 · attack.credential-access attack.t1558 ·

Share on:

Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Uncommon Outbound Kerberos Connection

Aug 12, 2024 · attack.credential-access attack.t1558 attack.lateral-movement attack.t1550.003 ·

Share on:

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Kerberos .kirbi Ticket Files

Mar 26, 2024 · attack.s0002 attack.credential_access attack.t1558 attack.t1558.003 ·

Share on:

Kerberos ticket files (.kirbi) are of interest to adversaries as they can contain sensitive data such as NTLM hashes that can be cracked offline. To perform these attacks, a unique file extension variable is defined within Mimikatz that designates the default extension as .kirbi. Part of the RedCanary 2024 Threat Detection Report.

Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·

Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.