Product
high
advisory
Unusual dMSA Account Creation for Privilege Escalation
3 rules 1 TTPDetects the creation of a delegated Managed Service Account (dMSA) by an unusual subject account, potentially indicating an attempt to abuse weak permissions for privilege escalation in Active Directory.
winlogbeat-* +2
privilege-escalation
windows
3r
1t
critical
advisory
Potential Invoke-Mimikatz PowerShell Script
2 rules 1 TTPThis rule detects the use of Invoke-Mimikatz or Mimikatz commands within PowerShell scripts to dump credentials, extract password stores, export certificates, or use alternate authentication material, indicating potential in-memory credential access.
winlogbeat-*
credential-access
mimikatz
powershell
2r
1t