Initial commit

Other parameters besides \query may also be useful for credential dumping. This should be researched.
2020-10-07 15:33:26 -04:00
parent 986c80e593
commit aea3c13d01
1 changed files with 25 additions and 0 deletions
@@ -0,0 +1,25 @@
+title: Nltest Credential Hash Theft
+description: Detects nltest query commands which may leak credential hashes
+references:
+    - https://twitter.com/sysopfb/status/986799053668139009
+date: 2018/04/18
+modified: 2020/10/06
+tags:
+    - attack.credential_access
+    - attack.t1003
+status: experimental
+author: Craig Young
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_1:
+        CommandLine|contains:
+            - nltest
+    selection_2:
+        CommandLine|contains:
+            - \query
+    condition: selection_1 and selection_2
+falsepositives:
+    - Legitimate administration
+level: medium