| elastic |
Potential Local NTLM Relay via HTTP |
production |
2026-09-18 |
| elastic |
Rare Connection to WebDAV Target |
production |
2026-09-18 |
| elastic |
Active Directory Forced Authentication from Linux Host - SMB Named Pipes |
production |
2026-09-18 |
| elastic |
Potential Computer Account NTLM Relay Activity |
production |
2026-09-18 |
| elastic |
Potential Kerberos Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Rare SMB Connection to the Internet |
production |
2026-09-18 |
| elastic |
Potential NTLM Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Potential Machine Account Relay Attack via SMB |
production |
2026-09-18 |
| elastic |
Potential Kerberos SPN Spoofing via Suspicious DNS Query |
production |
2026-09-18 |
| elastic |
Potential Kerberos Coercion via DNS-Based SPN Spoofing |
production |
2026-09-18 |
| splunk |
DNS Kerberos Coercion |
production |
2026-09-08 |
| sigma |
NTLM Hash Leak Via Curl NTLM Authentication |
test |
2026-06-04 |
| splunk |
Windows Short Lived DNS Record |
production |
2026-05-13 |
| splunk |
PetitPotam Network Share Access Request |
production |
2026-05-13 |
| splunk |
Windows Credential Target Information Structure in Commandline |
production |
2026-05-13 |
| splunk |
Windows Kerberos Coercion via DNS |
production |
2026-05-13 |
| splunk |
Windows Theme File Creation in Unusual Location |
production |
2026-05-13 |
| sigma |
Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI |
test |
2026-04-28 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network |
experimental |
2025-06-20 |
| sigma |
Attempts of Kerberos Coercion Via DNS SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit |
experimental |
2025-04-20 |
| sigma |
Potential PetitPotam Attack Via EFS RPC Calls |
test |
2022-11-28 |
| sigma |
PetitPotam Suspicious Kerberos TGT Request |
test |
2022-10-05 |
| sigma |
Possible PetitPotam Coerce Authentication Attempt |
test |
2022-08-11 |