Threat Intelligence
Pass-the-Ticket Attacks: Risks and Protection for Small Businesses
Ticket-granting tickets remain valid until expiration, allowing attackers to move laterally without passwords or local admin rights on the compromised host.
lateral movement
Everything Sandbox Desk has reported about lateral movement: 3 stories, newest first. Part of our Threat Intelligence coverage.
Threat Intelligence
Remote Desktop Abuse: The Step-by-Step Attack Chain
Remote desktop abuse rarely begins with a brute-force login; it usually starts with a stolen credential moving silently through lateral pathways before the session opens.
Threat Intelligence
Spotting NTLM Relay Attacks: Early Warning Signs and Response Steps
NTLM relay attacks exploit legacy authentication protocols to escalate privileges without ever stealing the actual password hash from the network traffic.