9 published detections cite this
Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Potential Credential Access via DCSync | Medium |
| Windows Service Installed via an Unusual Client | High |
| Suspicious CertUtil Commands | Medium |
| Process Execution from an Unusual Directory | Medium |
| NTDS or SAM Database File Copied | High |
| Connection to Commonly Abused Web Services | Low |
| Encrypting Files with WinRar or 7z | Medium |
| Exchange Mailbox Export via PowerShell | Medium |
| Exporting Exchange Mailbox via PowerShell | Medium |
Showing 9 of 9