[Emerging-Sigs] DCSYNC rule

James Lay jlay at slave-tothe-box.net
Fri Feb 28 06:40:50 HST 2020


On 2020-02-28 08:48, Kevin Ross wrote:
> Try taking a look at these for lateral stuff and modifying
> https://github.com/MrAnde7son/Snort/blob/master/local rules. Zeeks
> bzar mitre plugin might work too for lateral movement stuff.
> 
> On Fri, 28 Feb 2020, 15:36 James Lay, <jlay at slave-tothe-box.net>
> wrote:
> 
>> Anyone know if this was updated?
>> 
>> 
> https://blog.didierstevens.com/2017/10/08/quickpost-mimikatz-dcsync-detection/
>> 
>> IN a recent engagement I did not see this hit.  Thank you!
>> 
>> James
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at lists.emergingthreats.net
>> https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>> 
>> Support Emerging Threats! Subscribe to Emerging Threats Pro
>> http://www.emergingthreats.net

Thanks Kevin!

James


More information about the Emerging-sigs mailing list