메뉴
SkillsMP는 spydir/DFIR-Analysis-Skills에서 9개의 skill을 수집했습니다. skill을 열어 소스와 세부 정보를 확인하세요.
수집된 skill 9개 중 9개를 표시합니다.
Investigate whether an account experienced a burst of failed logons, particularly one followed by an eventual success, consistent with password brute forcing or credential stuffing. Use when given authentication logs and asked to check for brute force,…
원문 언어: 영어
Investigate whether a single account has overlapping active sessions on multiple different hosts at the same time, which is impossible for one person acting alone and suggests credential sharing or compromise. Use when given authentication/session logs and…
원문 언어: 영어
Investigate whether an account logged in from two locations too far apart to have been physically traveled in the elapsed time between logons (impossible travel). Use when given geolocated authentication logs and asked to check for account compromise,…
원문 언어: 영어
Investigate whether an account is fanning out to an unusually large number of distinct hosts from a single source in a short time window (indiscriminate lateral movement). Use when given authentication log exports and asked to check for lateral movement,…
원문 언어: 영어
Investigate whether an account performed an interactive (console) logon without a corresponding building badge-in, which can indicate account/credential sharing, a remote actor using stolen local credentials, or badge-system evasion. Use when given…
원문 언어: 영어
Investigate whether an account is probing hidden/administrative network shares (admin$, c$, ipc$) across one or many systems, consistent with post-compromise discovery or lateral-movement staging. Use when given share-access logs and asked to check for share…
원문 언어: 영어
Investigate whether an account moved through a directed chain of hosts (A to B, then B to C) rather than a broad fan-out, which is the signature of an operator pivoting toward a specific target. Use when given authentication logs and asked to trace a pivot…
원문 언어: 영어
Investigate whether a source machine attempted authentication using an unusually large number of distinct accounts against one or more systems, consistent with username enumeration or password spraying. Use when given authentication logs and asked to check…
원문 언어: 영어
Investigate whether one account logs into a system and a different account logs in from that same system shortly after, which can indicate a handoff between operators, credential theft, or a shared workstation being used to launder access. Use when given…
원문 언어: 영어