A database and set of services that allows administrators to manage permissions, access to network resources, and stored data objects (user, group, application, or devices)[1]
A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
A user requested active directory credentials, such as a ticket or token (ex: Windows EID 4769)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1558 | Steal or Forge Kerberos Tickets | |
| .001 | Golden Ticket | ||
| .003 | Kerberoasting | ||
| .004 | AS-REP Roasting | ||
| Enterprise | T1550 | Use Alternate Authentication Material | |
| .002 | Pass the Hash | ||
| .003 | Pass the Ticket | ||
Opening of an active directory object, typically to collect/read its value (ex: Windows EID 4661)
Opening of an active directory object, typically to collect/read its value (ex: Windows EID 4661)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1615 | Group Policy Discovery | |
| Enterprise | T1003 | OS Credential Dumping | |
| .006 | DCSync | ||
Initial construction of a new active directory object (ex: Windows EID 5137)
Initial construction of a new active directory object (ex: Windows EID 5137)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1484 | Domain Policy Modification | |
| .001 | Group Policy Modification | ||
| .002 | Domain Trust Modification | ||
| Enterprise | T1207 | Rogue Domain Controller | |
Removal of an active directory object (ex: Windows EID 5141)
Removal of an active directory object (ex: Windows EID 5141)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1484 | Domain Policy Modification | |
| .001 | Group Policy Modification | ||
Changes made to an active directory object (ex: Windows EID 5163 or 5136)
Changes made to an active directory object (ex: Windows EID 5163 or 5136)
| Domain | ID | Name | |
|---|---|---|---|
| Enterprise | T1134 | Access Token Manipulation | |
| .005 | SID-History Injection | ||
| Enterprise | T1531 | Account Access Removal | |
| Enterprise | T1098 | Account Manipulation | |
| .001 | Additional Cloud Credentials | ||
| Enterprise | T1037 | Boot or Logon Initialization Scripts | |
| .003 | Network Logon Script | ||
| Enterprise | T1484 | Domain Policy Modification | |
| .001 | Group Policy Modification | ||
| .002 | Domain Trust Modification | ||
| Enterprise | T1222 | File and Directory Permissions Modification | |
| .001 | Windows File and Directory Permissions Modification | ||
| Enterprise | T1207 | Rogue Domain Controller | |