Tag
Entra ID Excessive Account Lockouts Detected
2 rules 3 TTPsA high volume of failed Microsoft Entra ID sign-in attempts resulting in account lockouts indicates potential brute-force attacks, such as password spraying or credential stuffing, targeting user accounts.
PowerShell Kerberos Ticket Request via KerberosRequestorSecurityToken
2 rules 1 TTPThis rule detects PowerShell scripts that request Kerberos service tickets using KerberosRequestorSecurityToken, potentially indicating Kerberoasting attacks for offline password cracking of service accounts.
Suspicious AWS EC2 Key Pair Creation from Non-Cloud AS
2 rules 3 TTPsAn AWS EC2 CreateKeyPair event triggered by a new principal originating from a network autonomous system (AS) organization not associated with major cloud providers, indicating potential unauthorized access or persistence activity.
Potential Kerberos Relay Attack via Coerced Authentication against a Computer Account
3 rules 1 TTP 1 CVEDetects potential Kerberos relay attacks by identifying coercion attempts followed by authentication events using a target server's computer account, originating from a different host, indicating an attacker has captured and relayed Kerberos authentication material to execute code on behalf of the compromised system.
LSASS Memory Dump Creation Detection
2 rules 1 TTPThis rule identifies the creation of LSASS memory dump files, often indicative of credential access attempts using tools like Task Manager, SQLDumper, Dumpert, or AndrewSpecial, by monitoring for specific filenames and excluding legitimate dump locations.