Splunk SPL Queries for Detecting gMSA Attacks

1    Introduction What is a group Managed Service Account (gMSA)? If your job is to break into networks, a gMSA can be a prime target for a path to escalate privileges, perform credential access, move laterally or even persist in a domain via a ‘golden’ opportunity. If you’re an enterprise defender, it’s something you need...

The post Splunk SPL Queries for Detecting gMSA Attacks appeared first on TrustedSec.

active directory security review attacks incident response incident response & forensics penetration testing program assessment & compliance security testing & analysis splunk threat hunting