mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
21 lines
824 B
YAML
21 lines
824 B
YAML
name: Credential Dumping Attack
|
|
id: 570dd98e-6cab-443c-bdd8-3dbb5fe4188d
|
|
version: 2
|
|
date: '2020-07-16'
|
|
description: This response workflow guide you through the investigation of a credential dumping attack.
|
|
author: Patrick Bareiss, Splunk
|
|
response_phase:
|
|
- identification:
|
|
- id: c5506139-ef86-4cd9-8535-0512aa732e79
|
|
name: Process Chain Analysis
|
|
- id: 6ee5c067-8228-4926-abb2-54f2c59d726e
|
|
name: Analyze Malicious File
|
|
- id: 1d7b437a-5114-4b94-a585-04c3362ba08f
|
|
name: Malware Hunt and Contain
|
|
- containment:
|
|
- id: 60c4cfa5-81b7-44e2-9ad4-71524e4a3e78
|
|
name: Quarantaine Infected Host
|
|
tags:
|
|
analytics_story: Credential Dumping
|
|
workflow: This workbook provides you a guide on how to investigate credential dumping with some automation to make data collection easier.
|