Possible Shadow Credentials Added (f598ea0c-c25a-4f72-a219-50c44411c791)
Detects possible addition of shadow credentials to an active directory object.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84) | Attack Pattern | Possible Shadow Credentials Added (f598ea0c-c25a-4f72-a219-50c44411c791) | Sigma-Rules | 1 |