0xgrim- K
@EsKay0 followers2 downloads11 copies0 likes166 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Platforms
1
MITRE Techniques
1
1
IDS Classtypes
1
This alert triggers on a sign-in event with error code (50199) Login:Reprocess followed by or correlated with a graph api resource access event from the same user. This combination of event can be indicative of AiTM. As the associated blog suggests the current flow being login -> enumeration utilizing graph api. To increase the fidelity of the rule you can also add in |user_agent=/(OfficeHome)/ and feel free to pipe in additional suspicious user_agents.
Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)
Utilities, such as NinjaCopy, exist to perform these actions in PowerShell.(Citation: Github PowerSploit Ninjacopy) Adversaries may also use built-in or third-party utilities (such as vssadmin, wbadmin, and esentutl) to create shadow copies or backups of data from system volumes.(Citation: LOLBAS Esentutl)
I utilized Atomic Red Team to generate the telemetry and created these three queries to capture this activity.
Utilities, such as NinjaCopy, exist to perform these actions in PowerShell.(Citation: Github PowerSploit Ninjacopy) Adversaries may also use built-in or third-party utilities (such as vssadmin, wbadmin, and esentutl) to create shadow copies or backups of data from system volumes.(Citation: LOLBAS Esentutl)
I utilized Atomic Red Team to generate the telemetry and created these three queries to capture this activity.
This detection identifies a single source IP performing high-volume Kerberos AS-REQ authentication attempts against multiple user accounts (>5 unique accounts, >20 total requests), indicating enumeration or brute-force credential access. Attackers use AS-REQ enumeration to discover valid accounts and test credentials before lateral movement or privilege escalation. This pattern is characteristic of 2025 ransomware and APT campaigns targeting Active Directory environments.
I generated the telemetry utilizing atomic red team, pc + VM DC
I generated the telemetry utilizing atomic red team, pc + VM DC