“credential-theft”的搜索结果

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.

中文简介正在准备中。当前显示原文说明。

Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. Activates for requests to analyze an infostealer, identify targeted credential stores, or map stealer collection and exfiltration behavior.

中文简介正在准备中。当前显示原文说明。

Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.

中文简介正在准备中。当前显示英语简介。

• Hunting for credential theft in Active Directory
• Investigating suspected Mimikatz or Impacket use
• Auditing accounts with directory replication permissions

Investigate forged Kerberos authentication tickets in Active Directory by checking Windows logs for unusual encryption, excessive ticket lifetimes, and missing authentication requests. Produce a JSON report of suspicious indicators with risk ratings.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected forged authentication tickets
• Checking for possible krbtgt credential theft
• Building detection rules from authentication logs

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM

中文简介正在准备中。当前显示原文说明。

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM

中文简介正在准备中。当前显示原文说明。

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

中文简介正在准备中。当前显示原文说明。

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM

中文简介正在准备中。当前显示原文说明。

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM

中文简介正在准备中。当前显示原文说明。

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

中文简介正在准备中。当前显示原文说明。

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM

中文简介正在准备中。当前显示原文说明。

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

中文简介正在准备中。当前显示原文说明。

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM

中文简介正在准备中。当前显示原文说明。