Skip to content

Hide Navigation Hide TOC

Local Privilege Escalation Indicator TabTip (bc2e25ed-b92b-4daa-b074-b502bdd1982b)

Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Cluster A Galaxy A Cluster B Galaxy B Level
LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001 (650c784b-7504-4df7-ab2c-4ea882384d1e) Attack Pattern Local Privilege Escalation Indicator TabTip (bc2e25ed-b92b-4daa-b074-b502bdd1982b) Sigma-Rules 1
LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001 (650c784b-7504-4df7-ab2c-4ea882384d1e) Attack Pattern Adversary-in-the-Middle - T1557 (035bb001-ab69-4a0b-9f6c-2de8b09e1b9d) Attack Pattern 2