[Emerging-Sigs] DCSYNC rule

Kevin Ross kevross33 at googlemail.com
Fri Feb 28 05:48:46 HST 2020


Try taking a look at these for lateral stuff and modifying
https://github.com/MrAnde7son/Snort/blob/master/local rules. Zeeks bzar
mitre plugin might work too for lateral movement stuff.

On Fri, 28 Feb 2020, 15:36 James Lay, <jlay at slave-tothe-box.net> wrote:

> Anyone know if this was updated?
>
>
> https://blog.didierstevens.com/2017/10/08/quickpost-mimikatz-dcsync-detection/
>
> IN a recent engagement I did not see this hit.  Thank you!
>
> James
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at lists.emergingthreats.net
> https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> Support Emerging Threats! Subscribe to Emerging Threats Pro
> http://www.emergingthreats.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20200228/fa731444/attachment.html>


More information about the Emerging-sigs mailing list