-
DCsynced to abc/aa - worked fine
Tried to dcsync to abc/aa1 - expected is to start the dcSync from scratch
But in this case the dcSync starts from where the previous finished.
-
Hi,
I came across a possible bug in one of your rules.
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dcsync.yml#L29
The rule didn't match this event…
-
Hi,
The dcsync module is not parsing correctly the output of Mimikatz, it is sometimes capturing the Security ID instead of the Realm, and the Relative ID instead of the password's hash
![image](h…
-
Good evening. I received a Golden Ticket and saved it to a file. No errors occurred. It binds to the user, but when I run the lsadump :: dcsync command I get an error.
ERROR kuhl_m_lsadump_dcsync; Ge…
-
Could this be implemented?
-
When executing dcsync with qp, the condition of qp doesn't apply on the defined parent and on all its children which are parents themselves, but only on child infotons, and because of that they are no…
-
### Configuration
impacket version: current master
Python version: 3.8
Target OS: Kali Rolling
### Debug Output With Command String
```
root@kali:/opt/impacket/examples# python3 ntlmr…
-
start of dcsync with qp is incorrect because the lastindextime search is ommiting the qp query
curl 'http://cm-well:9000/proc/dc/dc1?qp=system.parent.parent_hierarchy:/data.com/,type.rdf::http://www.…
-
Windows Resource Activity class (201003) is not aligned with fields exist in Windows event 4662 - “An operation was performed on an object”.
https://learn.microsoft.com/en-us/previous-versions/window…
-
Hey there, I've ran the script using 1 iteration but the resultant payload still got flagged, also importing the encrypted script took a very long time, is that normal?
```
PS D:\Tools\AVtest> Inv…