mirror of
https://github.com/valitydev/atomic-threat-coverage.git
synced 2024-11-06 17:45:23 +00:00
15 lines
867 B
YAML
15 lines
867 B
YAML
title: RA_0011_eradication_revoke_compromised_credentials
|
||
stage: eradication
|
||
author: Daniil Yugoslavskiy
|
||
creation_date: 31.01.2019
|
||
references:
|
||
- https://adsecurity.org/?p=556
|
||
- https://adsecurity.org/?p=483
|
||
description: >
|
||
Response Action for revokation of compromised credentials.
|
||
workflow: |
|
||
On this step you supposed to know what kind of credentials have beed compromised.
|
||
You need to revoke them in your Identity and Access Management system where they were created (like, Windows AD) using native functionality.
|
||
Warning:
|
||
- If adversary has generated Golden Ticket in Windows Domain/forest, you have to revoke KRBTGT Account password **twice** for each domain in a forest and proceed monitor malicious activity for next 20 minutes (Domain Controller KDC service doesn’t perform validate the user account until the TGT is older than 20 minutes old)
|