Forced Authentication
Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the curren...
BY SOURCE
PROCEDURES (16)
Auto-extracted: 3 detections for network connection monitoring
Auto-extracted: 2 detections for base64
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for base64
Auto-extracted: 2 detections for authentication monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for base64