Open K4ack2013 opened 4 months ago
Thank you for sharing. Currently Hayabusa does detect all of the attacks mentioned here: https://github.com/Qihoo360/WatchAD2.0/blob/master/README_EN.md#iii-currently-supported-specific-detection-functions But of course the proper logging has to be turned on. If you want to share any specific .evtx files with us, we can write rules to detect them. We will look into if we can incorporate any methods in WatchAD into Hayabusa.
Strengthen the log detection of domain control, and recommend you a https://github.com/Qihoo360/WatchAD2.0 item There are domain-related attack detections here, and I hope the next version of the tool will be updated.
Shortcoming: Currently, the tool cannot detect common domain attack tools such as mimikatz and Impacket, including log detection of common domain control attacks.