INC/Gentlemen Affiliate AD Recon, Kerberoasting and noPac/Zerologon Tooling

Suraj A@cytech

•updated yesterday•0•0•4

Detects Windows process creation for Active Directory reconnaissance and Kerberoasting tooling (Rubeus, SharpHound, net group queries for domain admins, nltest) and noPac / Zerologon follow-on tooling associated with the INC and The Gentlemen ransomware intrusion chain.