Network component
network_component:sysvol
Active Directory domain share from which Tinker retrieved policies, scripts, users, host names, and other information.
Active Directory domain share from which Tinker retrieved policies, scripts, users, host names, and other information.
“I logged into SYSVOL on the main controller”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Tinker Secor | Explicit | 36 |
Tinker Secor USES SYSVOL
Tinker used a stolen user's credentials to access SYSVOL and retrieve domain scripts and configuration information.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I logged into SYSVOL on the main controller”
“You can mount SYSVOL and get all the group post preference.”