Eyal Neemany Mar 07, 2017

Detect Pass-The-Ticket and Pass-The-Hash Using Powershell

By Eyal Neemany | March 7, 2017

PTH and PTT attacks are commonly known methods that attackers use for their lateral movement in a domain environment. We’ve seen them for a long time in the industry, but the constant pursuit after the detection of those attack methods isn’t over yet.

They’re really hard to detect because these attacks leverages legitimate Active Directory operations in order to achieve their goals, which is eventually – getting higher permissions inside the domain environment context, and being able to move laterally into more sensitive and desirable locations.

Read More..