All Detections

Qilin browser credential theft: SharpDecryptPwd, WebBrowserPassView, Mimikatz on

avatar
ills3c Intel&Coffee@Ills3C
updated 6 days ago102

Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.

Splunk (SPL)