Why You Need to Detect More Than PtH
summary
Compromised credentials remain inevitable so detection focuses on specifics not slogans: Rapid7 lab reproduces a hash dump, metasploit/psexec lateral use, and a surprising domain‑controller trace tying back to the original rip source; NTLM hash reuse authenticates via NTLMSSP and often leaves no DC record for local‑account impersonations. Endpoint Windows logs (not just DC logs) show event 4624 on endpoints and real workstation/process names, so detection combines local event details, process names and anomalous workstation origins rather than only PtH IoCs.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:15Who are we
- 0:43Agenda
- 1:35Primer
- 3:15Pass a Hash
- 4:26Attacker Mindset
- 5:20Credentials
- 6:06One Entry Point
- 6:35Expanding
- 7:37How to Detect
- 9:17Centralized Logging
- 10:42Event Logs
- 14:25Example
- 17:05A logon
- 20:14Metasploit
- 22:47Domain Domain User
- 25:43Conclusion
- 27:27Questions
related talks
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
58mHacking in 2016 - How is our systems broken?
52mStart covering your bases & Stop chasing APT headlines
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
37mThreat Hunting in Active Directory Environment
42mStart Covering Your Bases And Stop Chasing APT Headlines
41mSimulation Hacking, the Good, Bad and the Ugly