| elastic |
Potential Computer Account NTLM Relay Activity |
production |
2026-09-18 |
| elastic |
Creation of a DNS-Named Record |
production |
2026-09-18 |
| elastic |
Potential PowerShell Pass-the-Hash/Relay Script |
production |
2026-09-18 |
| elastic |
Potential Machine Account Relay Attack via SMB |
production |
2026-09-18 |
| elastic |
Potential Kerberos SPN Spoofing via Suspicious DNS Query |
production |
2026-09-18 |
| elastic |
Potential Kerberos Coercion via DNS-Based SPN Spoofing |
production |
2026-09-18 |
| elastic |
Potential NTLM Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Potential Kerberos Relay Attack against a Computer Account |
production |
2026-09-18 |
| splunk |
DNS Kerberos Coercion |
production |
2026-09-08 |
| splunk |
Windows Kerberos Coercion via DNS |
production |
2026-05-13 |
| splunk |
Windows Credential Target Information Structure in Commandline |
production |
2026-05-13 |
| splunk |
Windows Short Lived DNS Record |
production |
2026-05-13 |
| splunk |
Windows Theme File Creation in Unusual Location |
production |
2026-05-13 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network |
experimental |
2025-06-20 |
| sigma |
Attempts of Kerberos Coercion Via DNS SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
WinDivert Driver Load |
test |
2024-11-23 |
| sigma |
Local Privilege Escalation Indicator TabTip |
test |
2023-04-14 |
| sigma |
Potential SMB Relay Attack Tool Execution |
test |
2023-02-14 |
| sigma |
HackTool - Impacket Tools Execution |
test |
2023-02-07 |
| sigma |
HackTool - ADCSPwn Execution |
test |
2023-02-04 |
| sigma |
RottenPotato Like Attack Pattern |
test |
2022-12-22 |
| sigma |
Potential PetitPotam Attack Via EFS RPC Calls |
test |
2022-11-28 |