EXPLORE

← Back to Explore

T1187

Forced Authentication

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the curren...

Windows

23

Detections

3

Sources

2

Threat Actors

BY SOURCE

10elastic7sigma6splunk_escu

PROCEDURES (16)

Network Connection Monitoring3 detections

Auto-extracted: 3 detections for network connection monitoring

Authentication Monitoring2 detections

Auto-extracted: 2 detections for authentication monitoring

Base642 detections

Auto-extracted: 2 detections for base64

Base642 detections

Auto-extracted: 2 detections for base64

Inject2 detections

Auto-extracted: 2 detections for inject

Base641 detections

Auto-extracted: 1 detections for base64

Credential1 detections

Auto-extracted: 1 detections for credential

Service1 detections

Auto-extracted: 1 detections for service

Inject1 detections

Auto-extracted: 1 detections for inject

Kerbero1 detections

Auto-extracted: 1 detections for kerbero

Remote1 detections

Auto-extracted: 1 detections for remote

Remote1 detections

Auto-extracted: 1 detections for remote

Remote1 detections

Auto-extracted: 1 detections for remote

Dns1 detections

Auto-extracted: 1 detections for dns

Inject1 detections

Auto-extracted: 1 detections for inject

Unusual1 detections

Auto-extracted: 1 detections for unusual

THREAT ACTORS (2)

DarkHydrus Dragonfly

DETECTIONS (23)

Active Directory Forced Authentication from Linux Host - SMB Named Pipes

Attempts of Kerberos Coercion Via DNS SPN Spoofing

DNS Kerberos Coercion

NTLM Hash Leak Via Curl NTLM Authentication

PetitPotam Network Share Access Request

PetitPotam Suspicious Kerberos TGT Request

Possible PetitPotam Coerce Authentication Attempt

Potential Computer Account NTLM Relay Activity

Potential Kerberos Coercion via DNS-Based SPN Spoofing

Potential Kerberos Relay Attack against a Computer Account

Potential Kerberos SPN Spoofing via Suspicious DNS Query

Potential Local NTLM Relay via HTTP

Potential Machine Account Relay Attack via SMB

Potential NTLM Relay Attack against a Computer Account

Potential PetitPotam Attack Via EFS RPC Calls

Rare Connection to WebDAV Target

Rare SMB Connection to the Internet

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network

Windows Credential Target Information Structure in Commandline

Windows Kerberos Coercion via DNS

Windows Short Lived DNS Record

Windows Theme File Creation in Unusual Location