Главная
Study mode:
on
1
Intro
2
Game of Thrones
3
Jared Atkinson
4
Robby Winchester
5
Hypothesisdriven hunting
6
Pyramid of pain
7
Tactics Techniques Procedures
8
How does this apply
9
The hunt hypothesis process
10
Case Study Detecting Access Token Manipulation
11
First Step Tactics
12
Access Token Manipulation
13
Windows Authentication
14
logon session types
15
token types
16
token theft
17
how it works
18
create process with token
19
make impersonate token
20
set thread token
21
identify collection requirements
22
collect data points
23
collect access tokens
24
get access token
25
benign impersonation
26
impersonating system token
27
ticket granting token
28
identify scope
29
exclude factors
30
exclude techniques
31
demo
Description:
Explore a hypothesis-driven hunting approach for detecting access token manipulation in Windows authentication systems. Learn about the Pyramid of Pain, Tactics Techniques Procedures (TTPs), and the hunt hypothesis process through a case study. Dive into Windows authentication concepts, including logon session types, token types, and token theft techniques. Discover how to identify collection requirements, collect data points and access tokens, and analyze benign impersonation scenarios. Gain practical insights through a demonstration and understand how to exclude factors and techniques to improve detection accuracy.

Process is No One Hunting for Token Manipulation

Add to list