Credential Access

Query Registry, System Network Connections Discovery, Permission Groups Discovery, System Network Configuration Discovery, OS Credential Dumping, System Info...

Windows Post Exploitation Risk Behavior

Query Registry, System Network Connections Discovery, Permission Groups Discovery, System Network Configuration Discovery, OS Credential Dumping, System Info...

O365 Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

O365 Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

O365 Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Windows PowerView Kerberos Service Ticket Request

Steal or Forge Kerberos Tickets, Kerberoasting

Windows PowerView Kerberos Service Ticket Request

Steal or Forge Kerberos Tickets, Kerberoasting

Detect Copy of ShadowCopy with Script Block Logging

Security Account Manager, OS Credential Dumping

Detect Copy of ShadowCopy with Script Block Logging

Security Account Manager, OS Credential Dumping

AWS Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

PetitPotam Suspicious Kerberos TGT Request

OS Credential Dumping

Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Credential Dumping via Copy Command from Shadow Copy

NTDS, OS Credential Dumping

Credential Dumping via Copy Command from Shadow Copy

NTDS, OS Credential Dumping

Windows Private Keys Discovery

Private Keys, Unsecured Credentials

Windows Private Keys Discovery

Private Keys, Unsecured Credentials

Azure AD User Consent Blocked for Risky Application

Steal Application Access Token

Okta Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

PingID Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation, Valid Accounts, Brute Force

PingID Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation, Valid Accounts, Brute Force

Attacker Tools On Endpoint

Match Legitimate Name or Location, Masquerading, OS Credential Dumping, Active Scanning

Splunk Low Privilege User Can View Hashed Splunk Password

Exploitation for Credential Access

Okta Suspicious Use of a Session Cookie

Steal Web Session Cookie

Azure AD High Number Of Failed Authentications For User

Brute Force, Password Guessing

Azure AD High Number Of Failed Authentications For User

Brute Force, Password Guessing

AWS Console Login Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

Azure AD New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Azure AD New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Disabled Kerberos Pre-Authentication Discovery With Get-ADUser

Steal or Forge Kerberos Tickets, AS-REP Roasting

Disabled Kerberos Pre-Authentication Discovery With Get-ADUser

Steal or Forge Kerberos Tickets, AS-REP Roasting

Okta Multiple Users Failing To Authenticate From Ip

Password Spraying

Okta Risk Threshold Exceeded

Valid Accounts, Brute Force

Azure AD Device Code Authentication

Steal Application Access Token, Phishing, Spearphishing Link

Add DefaultUser And Password In Registry

Credentials in Registry, Unsecured Credentials

Add DefaultUser And Password In Registry

Credentials in Registry, Unsecured Credentials

Windows Unusual Count Of Users Failed To Auth Using Kerberos

Password Spraying, Brute Force

Windows Unusual Count Of Users Failed To Auth Using Kerberos

Password Spraying, Brute Force

Detect AWS Console Login by New User

Compromise Accounts, Cloud Accounts, Unsecured Credentials

Windows Password Managers Discovery

Password Managers

Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos

Password Spraying, Brute Force

Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos

Password Spraying, Brute Force

Windows Multiple Users Remotely Failed To Authenticate From Host

Password Spraying, Brute Force

Windows Multiple Users Remotely Failed To Authenticate From Host

Password Spraying, Brute Force

Detect Credential Dumping through LSASS access

LSASS Memory, OS Credential Dumping

Detect Credential Dumping through LSASS access

LSASS Memory, OS Credential Dumping

Kubernetes Abuse of Secret by Unusual User Name

Container API

Windows Credentials from Password Stores Query

Credentials from Password Stores

Possible Browser Pass View Parameter

Credentials from Web Browsers, Credentials from Password Stores

Possible Browser Pass View Parameter

Credentials from Web Browsers, Credentials from Password Stores

Detect Certipy File Modifications

Steal or Forge Authentication Certificates, Archive Collected Data

Kerberos Service Ticket Request Using RC4 Encryption

Steal or Forge Kerberos Tickets, Golden Ticket

Kerberos Service Ticket Request Using RC4 Encryption

Steal or Forge Kerberos Tickets, Golden Ticket

O365 File Permissioned Application Consent Granted by User

Steal Application Access Token

O365 Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation

Azure AD Successful Authentication From Different Ips

Brute Force, Password Guessing, Password Spraying

Azure AD Successful Authentication From Different Ips

Brute Force, Password Guessing, Password Spraying

Azure AD Successful Authentication From Different Ips

Brute Force, Password Guessing, Password Spraying

Okta Successful Single Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

PetitPotam Network Share Access Request

Forced Authentication

Steal or Forge Authentication Certificates Behavior Identified

Steal or Forge Authentication Certificates

Detect Mimikatz With PowerShell Script Block Logging

OS Credential Dumping, PowerShell

Windows Multiple Users Failed To Authenticate From Host Using NTLM

Password Spraying, Brute Force

Windows Multiple Users Failed To Authenticate From Host Using NTLM

Password Spraying, Brute Force

O365 User Consent Blocked for Risky Application

Steal Application Access Token

Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos

Password Spraying, Brute Force

Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos

Password Spraying, Brute Force

Detect Certify Command Line Arguments

Steal or Forge Authentication Certificates, Ingress Tool Transfer

GCP Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

GCP Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

Kubernetes Abuse of Secret by Unusual User Group

Container API

Windows Multiple Users Failed To Authenticate From Process

Password Spraying, Brute Force

Windows Multiple Users Failed To Authenticate From Process

Password Spraying, Brute Force

Non Chrome Process Accessing Chrome Default Dir

Credentials from Password Stores, Credentials from Web Browsers

Non Chrome Process Accessing Chrome Default Dir

Credentials from Password Stores, Credentials from Web Browsers

High Number of Login Failures from a single source

Password Guessing, Brute Force

High Number of Login Failures from a single source

Password Guessing, Brute Force

Linux Possible Access To Credential Files

/etc/passwd and /etc/shadow, OS Credential Dumping

Linux Possible Access To Credential Files

/etc/passwd and /etc/shadow, OS Credential Dumping

Windows Steal Authentication Certificates - ESC1 Authentication

Steal or Forge Authentication Certificates, Use Alternate Authentication Material

GCP Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

GCP Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

GCP Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Windows Steal Authentication Certificates Certificate Request

Steal or Forge Authentication Certificates

Windows LSA Secrets NoLMhash Registry

LSA Secrets

Azure AD OAuth Application Consent Granted By User

Steal Application Access Token

Kerberos Pre-Authentication Flag Disabled in UserAccountControl

Steal or Forge Kerberos Tickets, AS-REP Roasting

Kerberos Pre-Authentication Flag Disabled in UserAccountControl

Steal or Forge Kerberos Tickets, AS-REP Roasting

AWS Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS High Number Of Failed Authentications From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS High Number Of Failed Authentications From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS High Number Of Failed Authentications From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS IAM Assume Role Policy Brute Force

Cloud Infrastructure Discovery, Brute Force

GCP Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

O365 Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

O365 Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

O365 Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Extraction of Registry Hives

Security Account Manager, OS Credential Dumping

Extraction of Registry Hives

Security Account Manager, OS Credential Dumping

Splunk Identified SSL TLS Certificates

Network Sniffing

Azure AD Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

Azure AD Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

GCP Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

GCP Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

GCP Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Creation of lsass Dump with Taskmgr

LSASS Memory, OS Credential Dumping

Creation of lsass Dump with Taskmgr

LSASS Memory, OS Credential Dumping

SAM Database File Access Attempt

Security Account Manager, OS Credential Dumping

SAM Database File Access Attempt

Security Account Manager, OS Credential Dumping

ASL AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

ASL AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

ASL AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

Windows Unsecured Outlook Credentials Access In Registry

Unsecured Credentials

O365 User Consent Denied for OAuth Application

Steal Application Access Token

Azure Active Directory High Risk Sign-in

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying

Azure Active Directory High Risk Sign-in

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying

PingID Mismatch Auth Source and Verification Response

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID Mismatch Auth Source and Verification Response

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Kubernetes Abuse of Secret by Unusual User Agent

Container API

Windows PowerShell Export PfxCertificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows PowerShell Export PfxCertificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows PowerShell Export PfxCertificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows Remote Access Software BRC4 Loaded Dll

Remote Access Software, OS Credential Dumping

AWS Credential Access GetPasswordData

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

AWS Credential Access GetPasswordData

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

PingID New MFA Method After Credential Reset

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID New MFA Method After Credential Reset

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Windows Unusual Count Of Users Failed To Authenticate From Process

Password Spraying, Brute Force

Windows Unusual Count Of Users Failed To Authenticate From Process

Password Spraying, Brute Force

Windows Multiple Invalid Users Fail To Authenticate Using Kerberos

Password Spraying, Brute Force

Windows Multiple Invalid Users Fail To Authenticate Using Kerberos

Password Spraying, Brute Force

Credential Dumping via Symlink to Shadow Copy

NTDS, OS Credential Dumping

Credential Dumping via Symlink to Shadow Copy

NTDS, OS Credential Dumping

Azure AD Privileged Authentication Administrator Role Assigned

Security Account Manager

Windows Computer Account Created by Computer Account

Steal or Forge Kerberos Tickets

Okta Multiple Failed MFA Requests For User

Multi-Factor Authentication Request Generation

SecretDumps Offline NTDS Dumping Tool

NTDS, OS Credential Dumping

SecretDumps Offline NTDS Dumping Tool

NTDS, OS Credential Dumping

Windows AD Replication Request Initiated from Unsanctioned Location

DCSync, OS Credential Dumping

Windows AD Replication Request Initiated from Unsanctioned Location

DCSync, OS Credential Dumping

Azure AD Multiple Failed MFA Requests For User

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts

Kubernetes Nginx Ingress RFI

Exploitation for Credential Access

Creation of Shadow Copy

NTDS, OS Credential Dumping

Creation of Shadow Copy

NTDS, OS Credential Dumping

Non Firefox Process Access Firefox Profile Dir

Credentials from Password Stores, Credentials from Web Browsers

Non Firefox Process Access Firefox Profile Dir

Credentials from Password Stores, Credentials from Web Browsers

Windows AD Replication Service Traffic

OS Credential Dumping, DCSync, Rogue Domain Controller

Windows AD Replication Service Traffic

OS Credential Dumping, DCSync, Rogue Domain Controller

Okta Mismatch Between Source and Response for Verify Push Request

Multi-Factor Authentication Request Generation

Disabling Windows Local Security Authority Defences via Registry

Modify Authentication Process

Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM

Password Spraying, Brute Force

Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM

Password Spraying, Brute Force

Kubernetes Nginx Ingress LFI

Exploitation for Credential Access

Azure AD Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

O365 Excessive Authentication Failures Alert

Brute Force

Azure AD Multiple Denied MFA Requests For User

Multi-Factor Authentication Request Generation

Windows Unusual Count Of Users Remotely Failed To Auth From Host

Password Spraying, Brute Force

Windows Unusual Count Of Users Remotely Failed To Auth From Host

Password Spraying, Brute Force

Windows Credentials from Password Stores Creation

Credentials from Password Stores

Azure AD User Consent Denied for OAuth Application

Steal Application Access Token

Windows Computer Account With SPN

Steal or Forge Kerberos Tickets

Okta MFA Exhaustion Hunt

Brute Force

Windows PowerShell Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows PowerShell Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows PowerShell Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

ASL AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

ASL AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Creation of Shadow Copy with wmic and powershell

NTDS, OS Credential Dumping

Creation of Shadow Copy with wmic and powershell

NTDS, OS Credential Dumping

Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials

Password Spraying, Brute Force

Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials

Password Spraying, Brute Force

O365 Excessive SSO logon errors

Modify Authentication Process

Windows Multiple Invalid Users Failed To Authenticate Using NTLM

Password Spraying, Brute Force

Windows Multiple Invalid Users Failed To Authenticate Using NTLM

Password Spraying, Brute Force

Windows Computer Account Requesting Kerberos Ticket

Steal or Forge Kerberos Tickets

Windows Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows Export Certificate

Private Keys, Unsecured Credentials, Steal or Forge Authentication Certificates

Windows Credentials in Registry Reg Query

Credentials in Registry, Unsecured Credentials

Windows Credentials in Registry Reg Query

Credentials in Registry, Unsecured Credentials

AWS Credential Access Failed Login

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

AWS Credential Access Failed Login

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

Windows Steal Authentication Certificates CryptoAPI

Steal or Forge Authentication Certificates

Windows Rapid Authentication On Multiple Hosts

Security Account Manager

Kerberoasting spn request with RC4 encryption

Steal or Forge Kerberos Tickets, Kerberoasting

Kerberoasting spn request with RC4 encryption

Steal or Forge Kerberos Tickets, Kerberoasting

Windows AD Replication Request Initiated by User Account

DCSync, OS Credential Dumping

Windows AD Replication Request Initiated by User Account

DCSync, OS Credential Dumping

Windows Credentials from Password Stores Deletion

Credentials from Password Stores

Windows Multiple Users Failed To Authenticate Using Kerberos

Password Spraying, Brute Force

Windows Multiple Users Failed To Authenticate Using Kerberos

Password Spraying, Brute Force

O365 High Number Of Failed Authentications for User

Brute Force, Password Guessing

O365 High Number Of Failed Authentications for User

Brute Force, Password Guessing

Windows Local Administrator Credential Stuffing

Brute Force, Credential Stuffing

Windows Local Administrator Credential Stuffing

Brute Force, Credential Stuffing

Okta Phishing Detection with FastPass Origin Check

Valid Accounts, Default Accounts, Modify Authentication Process

Unusual Number of Kerberos Service Tickets Requested

Steal or Forge Kerberos Tickets, Kerberoasting

Unusual Number of Kerberos Service Tickets Requested

Steal or Forge Kerberos Tickets, Kerberoasting

Azure AD Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Unusual Number of Failed Authentications From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

AWS Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication

O365 Mail Permissioned Application Consent Granted by User

Steal Application Access Token

O365 Privileged Graph API Permission Assigned

Security Account Manager

Windows Kerberos Local Successful Logon

Steal or Forge Kerberos Tickets

Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials

Password Spraying, Brute Force

Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials

Password Spraying, Brute Force

Azure AD Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Multi-Source Failed Authentications Spike

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Windows PowerView SPN Discovery

Steal or Forge Kerberos Tickets, Kerberoasting

Windows PowerView SPN Discovery

Steal or Forge Kerberos Tickets, Kerberoasting

Azure AD Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Azure AD Multiple Users Failing To Authenticate From Ip

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying, Credential Stuffing

Okta Multi-Factor Authentication Disabled

Modify Authentication Process, Multi-Factor Authentication

Okta Multi-Factor Authentication Disabled

Modify Authentication Process, Multi-Factor Authentication

AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

AWS New MFA Method Registered For User

Modify Authentication Process, Multi-Factor Authentication

Windows Steal or Forge Kerberos Tickets Klist

Steal or Forge Kerberos Tickets

Detect Certify With PowerShell Script Block Logging

Steal or Forge Authentication Certificates, Command and Scripting Interpreter, PowerShell

Detect IPv6 Network Infrastructure Threats

Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning

Detect IPv6 Network Infrastructure Threats

Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning

Disabled Kerberos Pre-Authentication Discovery With PowerView

Steal or Forge Kerberos Tickets, AS-REP Roasting

Disabled Kerberos Pre-Authentication Discovery With PowerView

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows Unusual Count Of Users Failed To Authenticate Using NTLM

Password Spraying, Brute Force

Windows Unusual Count Of Users Failed To Authenticate Using NTLM

Password Spraying, Brute Force

Kerberos Pre-Authentication Flag Disabled with PowerShell

Steal or Forge Kerberos Tickets, AS-REP Roasting

Kerberos Pre-Authentication Flag Disabled with PowerShell

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows Domain Admin Impersonation Indicator

Steal or Forge Kerberos Tickets

Enable WDigest UseLogonCredential Registry

Modify Registry, OS Credential Dumping

Windows PowerSploit GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows PowerSploit GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows Steal Authentication Certificates - ESC1 Abuse

Steal or Forge Authentication Certificates

O365 Disable MFA

Modify Authentication Process

Okta Multiple Accounts Locked Out

Brute Force

Windows Steal Authentication Certificates CS Backup

Steal or Forge Authentication Certificates

Windows Steal Authentication Certificates Certificate Issued

Steal or Forge Authentication Certificates

Potential password in username

Local Accounts, Credentials In Files

Azure AD Privileged Graph API Permission Assigned

Security Account Manager

Windows Cached Domain Credentials Reg Query

Cached Domain Credentials, OS Credential Dumping

Windows Cached Domain Credentials Reg Query

Cached Domain Credentials, OS Credential Dumping

Kubernetes Abuse of Secret by Unusual Location

Container API

Windows Input Capture Using Credential UI Dll

GUI Input Capture, Input Capture

Windows Input Capture Using Credential UI Dll

GUI Input Capture, Input Capture

GCP Authentication Failed During MFA Challenge

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation

ServicePrincipalNames Discovery with PowerShell

Kerberoasting

AWS Multiple Users Failing To Authenticate From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS Multiple Users Failing To Authenticate From Ip

Brute Force, Password Spraying, Credential Stuffing

AWS Multiple Users Failing To Authenticate From Ip

Brute Force, Password Spraying, Credential Stuffing

Auto Admin Logon Registry Entry

Credentials in Registry, Unsecured Credentials

Auto Admin Logon Registry Entry

Credentials in Registry, Unsecured Credentials

AWS Credential Access RDS Password reset

Compromise Accounts, Cloud Accounts, Brute Force

Windows Mimikatz Crypto Export File Extensions

Steal or Forge Authentication Certificates

PingID New MFA Method Registered For User

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

PingID New MFA Method Registered For User

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Windows Multiple NTLM Null Domain Authentications

Brute Force, Password Spraying

Windows Multiple NTLM Null Domain Authentications

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Destinations By Source

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Destinations By Source

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Destinations By User

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Destinations By User

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Users By Source

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Users By Source

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Users By Destination

Brute Force, Password Spraying

Windows Unusual NTLM Authentication Users By Destination

Brute Force, Password Spraying

Multiple Okta Users With Invalid Credentials From The Same IP

Password Spraying, Valid Accounts, Default Accounts

ServicePrincipalNames Discovery with PowerShell

Kerberoasting

Detect Distributed Password Spray Attempts

Password Spraying, Brute Force

Detect Distributed Password Spray Attempts

Password Spraying, Brute Force

Detect Password Spray Attempts

Password Spraying, Brute Force

Detect Password Spray Attempts

Password Spraying, Brute Force

Detect Password Spray Attack Behavior From Source

Password Spraying, Brute Force

Detect Password Spray Attack Behavior From Source

Password Spraying, Brute Force

Detect Password Spray Attack Behavior On User

Password Spraying, Brute Force

Detect Password Spray Attack Behavior On User

Password Spraying, Brute Force

Windows PowerSploit GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows PowerSploit GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows File Share Discovery With Powerview

Unsecured Credentials, Group Policy Preferences

Windows File Share Discovery With Powerview

Unsecured Credentials, Group Policy Preferences

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows Findstr GPP Discovery

Unsecured Credentials, Group Policy Preferences

Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser

Steal or Forge Kerberos Tickets, AS-REP Roasting

Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser

Steal or Forge Kerberos Tickets, AS-REP Roasting

Okta Account Locked Out

Brute Force

Windows OS Credential Dumping with Procdump

LSASS Memory, OS Credential Dumping

Windows OS Credential Dumping with Procdump

LSASS Memory, OS Credential Dumping

Windows OS Credential Dumping with Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Windows OS Credential Dumping with Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Windows Rundll32 Comsvcs Memory Dump

NTDS, OS Credential Dumping

Windows Rundll32 Comsvcs Memory Dump

NTDS, OS Credential Dumping

Attempted Credential Dump From Registry via Reg exe

OS Credential Dumping, Security Account Manager

Attempted Credential Dump From Registry via Reg exe

OS Credential Dumping, Security Account Manager

Detect Mimikatz Using Loaded Images

LSASS Memory, OS Credential Dumping

Detect Mimikatz Using Loaded Images

LSASS Memory, OS Credential Dumping