Elastic Defend high stable eql
Potential Access to Kerberos Cached Credentials
Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credentials to obtain account login information in the form of a ticket. These tickets can be leveraged for lateral movement.
Detection Logic
process where event.type == "start" and event.action == "exec" and
process.name == "kcc" and process.command_line like~ "*copy_cred_cache*"Field Validations
Loading…
Comments (0)
Loading comments...