Detecting AD Credential Attacks (TryHackMe)

Mar 25 · 33 min read · Introduction In August 2024, The DFIR Report documented a BlackSuit ransomware intrusion(opens in new tab) where the attackers used Rubeus to Kerberoast service accounts, AS-REP Roasted an account wit