PetitPotam – NTLM Relay to AD CS
Tags
attack-pattern: Direct Credentials - T1589.001 Dcsync - T1003.006 Golden Ticket - T1558.001 Pass The Hash - T1550.002 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Web Service - T1481 Tool - T1588.002 Pass The Hash - T1075 Powershell - T1086 Web Service - T1102
Show in Graph
Common Information
Type Value
UUID 8ce63a2b-7678-4454-ad29-137c1488badb
Fingerprint b838c8130dc13980
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 14, 2021, 9 p.m.
Added to db Jan. 18, 2023, 10:08 p.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline PetitPotam – NTLM Relay to AD CS
Title PetitPotam – NTLM Relay to AD CS
Detected Hints/Tags/Attributes 47/1/17
Source URLs
Redirection Url
Details Source https://pentestlab.blog/2021/09/14/petitpotam-ntlm-relay-to-ad-cs/
URL Provider
Details Provider Source level domain
Details pentestlab.blog pentestlab.blog
Attributes
Details Type #Events CTI Value
Details Domain 23 
ntlmrelayx.py
Details Domain 5 
petitpotam.py
Details Domain 49 
wmiexec.py
Details File 226 
certutil.exe
Details File 22 
ntlmrelayx.py
Details File 4 
certfnsh.asp
Details File 5 
petitpotam.py
Details File 1 
petitpotam.exe
Details File 1 
invoke-petitpotam.ps1
Details File 29 
rubeus.exe
Details File 45 
wmiexec.py
Details File 2 
adcspwn.exe
Details md5 2 
58a478135a93ac3bf058a5ea0e8fdb71
Details IPv4 34 
10.0.0.2
Details IPv4 97 
10.0.0.1
Details Url 1 
http://ca.purple.lab/certsrv
Details Url 1 
http://ca/certsrv/certfnsh.asp