Impacket and Invoke-TheHash tooling used for pass-the-hash lateral movement

Ankit Mehta@Secvyn

•updated 28 days ago•2•0•3

Detects the execution of known offensive security tools often used for lateral movement, credential dumping, and remote code execution, such as Impacket modules and the 'Invoke-TheHash' PowerShell suite, via common command-line interpreters.