Robuta

Sponsor of the Day: Jerkmate

https://attack.mitre.org/techniques/T1003/007/ OS Credential Dumping: Proc Filesystem, Sub-technique T1003.007 - Enterprise | MITRE ATT&CK® os credential dumping sub technique t1003 007 enterprise mitre proc filesystem https://attack.mitre.org/techniques/T1003/002/ OS Credential Dumping: Security Account Manager, Sub-technique T1003.002 - Enterprise | MITRE... os credential dumping sub technique t1003 002 enterprise mitre security account manager https://attack.mitre.org/techniques/T1003/001/ OS Credential Dumping: LSASS Memory, Sub-technique T1003.001 - Enterprise | MITRE ATT&CK® os credential dumping sub technique t1003 001 enterprise mitre lsass memory https://detection.fyi/sigmahq/sigma/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script/ Veeam Backup Servers Credential Dumping Script Execution | Detection.FYI Detects execution of a PowerShell script that contains calls to the execution detection fyi veeam backup credential dumping servers script https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering/ Potential Credential Dumping Via WER | Detection.FYI Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass credential dumping detection fyi potential via wer