Results for “credential-abuse”

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Investigate Active Directory authentication logs with Splunk and KQL queries to find signs of Golden Ticket attacks, which use forged Kerberos authentication tickets. Examine encryption mismatches, missing ticket requests, unusual lifetimes, and account inconsistencies.

• Hunting for forged tickets after credential theft
• Investigating encryption mismatches in authentication logs
• Checking for persistent access after incident response

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

The English summary is being prepared. Showing the original description.

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

The English summary is being prepared. Showing the original description.

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

The English summary is being prepared. Showing the original description.

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

The English summary is being prepared. Showing the original description.

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

The English summary is being prepared. Showing the original description.

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

The English summary is being prepared. Showing the original description.