Elastic Defend high stable eql
Dumping Account Hashes via Built-In Commands
Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement.
Detection Logic
process where event.type == "start" and
process.name in ("defaults", "mkpassdb") and process.args like~ ("ShadowHashData", "-dump")Field Validations
Loading…
Comments (0)
Loading comments...