DFSP # 411 - NTLM Credential Validation

Digital Forensic Survival Podcast - A podcast by Digital Forensic Survival Podcast - Tuesdays

Try Bookbeat 60! days for free, click here

Try Bookbeat 60! days for free, click here

Enjoy a whole world of audiobooks and e-books, everything from new releases to the classics

 Sponsored

Categories:

Technology

This week I'm talking about detecting evidence of lateral movement on Window systems using NTLM credential validation events. Much like the episode I did on Kerberos, NTLM events offer the same advantage of being concentrated on domain controllers, which allows you, as the analyst, leverage a great resource for user account analysis. I will have the background, artifact breakdown, and triage strategy coming up right after this…..

Visit the podcast's native language site