corpus.blog
41,554 blogs · 5,217,468 posts Claim your blog
Record · corpus.blog/posts/01a0ca8d-f7d6-72a2-9c6d-21f5b29bc20c

Anomaly detection in certificate-based TGT requests

Kaspersky Securelist · published 28 July 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at securelist.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
44
Words captured
2,100

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://en.wikipedia.org/wiki/Key_distribution_center
en.wikipedia.org
https://en.wikipedia.org/wiki/Active_Directory
en.wikipedia.org
https://en.wikipedia.org/wiki/Kerberos_(protocol
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074621/Forged-certificates_01.png
media.kasperskycontenthub.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/d0cf1763-3541-4008-a75f-a577fa5e8c5b
learn.microsoft.com
https://en.wikipedia.org/wiki/Certificate_authority
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074630/Forged-certificates_02.png
media.kasperskycontenthub.com
https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification
learn.microsoft.com
https://ericonidentity.com/2022/03/23/windows-hello-for-business-hybrid-cloud-trust/
ericonidentity.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/f70afbcc-780e-4d91-850c-cfadce5bb15c
learn.microsoft.com
https://github.com/eladshamir/Whisker
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074640/Forged-certificates_03.png
media.kasperskycontenthub.com
https://github.com/GhostPack/Rubeus
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074651/Forged-certificates_04.png
media.kasperskycontenthub.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47
learn.microsoft.com
https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
thehacker.recipes
https://github.com/gentilkiwi/mimikatz
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074703/Forged-certificates_05.png
media.kasperskycontenthub.com
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
learn.microsoft.com
https://github.com/deviantony/docker-elk
github.com
https://www.elastic.co/guide/en/beats/winlogbeat/8.7/winlogbeat-installation-configuration.html
elastic.co
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074715/Forged-certificates_06.png
media.kasperskycontenthub.com
https://learn.microsoft.com/en-us/windows/win32/seccng/key-storage-property-identifiers
learn.microsoft.com
https://en.wikipedia.org/wiki/Trusted_Platform_Module
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074724/Forged-certificates_07.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074732/Forged-certificates_08.png
media.kasperskycontenthub.com
https://github.com/eladshamir/Whisker/blob/main/Whisker/Program.cs
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074740/Forged-certificates_09.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074751/Forged-certificates_10.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074802/Forged-certificates_11.png
media.kasperskycontenthub.com
https://datatracker.ietf.org/doc/id/draft-ietf-krb-wg-kerberos-referrals-12.html
datatracker.ietf.org
https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names
learn.microsoft.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074815/Forged-certificates_12.png
media.kasperskycontenthub.com
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831740(v=ws.11
learn.microsoft.com
https://www.thehacker.recipes/ad/movement/ad-cs
thehacker.recipes
https://posts.specterops.io/certified-pre-owned-d95910965cd2
posts.specterops.io
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/07/27074825/Forged-certificates_13.png
media.kasperskycontenthub.com
https://github.com/GhostPack/Rubeus/blob/master/Rubeus/lib/krb_structures/KDC_REQ_BODY.cs
github.com
https://github.com/fortra/impacket/blob/5026d261d21b01f56ed4c8b39abac0028637a7f6/impacket/krb5/kerberosv5.py
github.com
https://github.com/fortra/impacket/
github.com
https://github.com/gam4er/FindCraftedMsDSKeyCredential
github.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/a99409ea-4982-4f72-b7ef-8596013a36c7
learn.microsoft.com
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/701a55dc-d062-4032-a2da-dbdfc384c8cf
learn.microsoft.com
https://github.com/ShutdownRepo/The-Hacker-Recipes/blob/master/.gitbook/assets/Pass%20the%20things.png
github.com