Mimikatz

Splunk-ShadowRoast

April 14, 2026

Splunk SOC SIEM Log Analysis DFIR Windows Sysmon Active Directory AS-REP Roasting Rubeus Mimikatz Credential Dumping Process Injection Fileless Malware PowerShell RDP

A masqueraded AdobeUpdater.exe binary established persistence via a registry Run key, injected into cmd.exe, performed AS-REP Roasting with Rubeus against four AD accounts, laterally moved to FileServer using cracked tcooper credentials, enabled RDP, and staged share data for exfiltration.

Splunk-GoldenSpray

April 10, 2026

ELK SOC SIEM Log Analysis Active Directory RDP PowerShell Lsass Mimikatz BruteForce PsExec

An attacker from 77.91.78.115 brute-forced mwilliams credentials, connected via RDP, dropped OfficeUpdater.exe with registry persistence, staged Backup_Tools including mimikatz, dumped lsass to obtain jsmith credentials, laterally moved to ST-DC01 and ST-FS01, established scheduled task persistence on the DC, and archived client data for exfiltration.

HTB-GhostTrace

January 31, 2026

SOC Log Analysis Windows Active Directory Event Viewer Mimikatz PowerView

Analyzed Windows Event Logs revealing a complete AD compromise chain: phishing email with macro-enabled document → credential dumping with Mimikatz → lateral movement via PsExec → DCSync attack → domain admin compromise → persistence via scheduled task, service, and registry run key.

↑