NightEagle: Lateral Movement via Compromised AD Credentials Across Hosts

Ibrahim Saud@tektrix

•updated 23 days ago•4•0•3

Detects instances where a service account (indicated by a trailing $ in the username, excluding computer accounts) authenticates to three or more distinct hosts within a short time frame. This behavior is indicative of potential lateral movement or automated discovery activities using a compromised service credential.