How to Detect Pass-the-Ticket Attacks
Tags
attack-pattern: Data Impersonation - T1656 Lsass Memory - T1003.001 Pass The Ticket - T1550.003 Server - T1583.004 Server - T1584.004 Sharepoint - T1213.002 Software - T1592.002 Tool - T1588.002 Dcshadow - T1207 Pass The Ticket - T1097
Show in Graph
Common Information
Type Value
UUID 54893644-fb81-44ec-957d-8276569802a5
Fingerprint b77899192d228a8e
Analysis status DONE
Considered CTI value -2
Text language
Published Feb. 19, 2019, 3:33 p.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 18, 2024, 1:38 a.m.
Headline How to Detect Pass-the-Ticket Attacks
Title How to Detect Pass-the-Ticket Attacks
Detected Hints/Tags/Attributes 55/1/2
Source URLs
Redirection Url
Details Source https://blog.stealthbits.com/detect-pass-the-ticket-attacks
URL Provider
Details Provider Source level domain
Details stealthbits.com blog.stealthbits.com
Attributes
Details Type #Events CTI Value
Details File 29 
rubeus.exe
Details File 2127 
cmd.exe