All Detections

TiFlux RMM - Credential Dumping Tool Execution (T1003)

avatar
Ibrahim Saud@tektrix
updated Jun 22, 2026002

Detects the threat actor utilizing the TiFlux backdoor access to run credential dumping tools (Mimikatz, Procdump) against LSASS.

Microsoft Sentinel (KQL)