Tinker Secor USES Net-NTLMv2
Tinker collected Net-NTLMv2 hashes from Responder activity.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I pulled down these hashes. Again, they’re Net-NTLMv2 hashes.”
Protocol
protocol:net_ntlmv2
Also: Net-NTLMv2 hashes
Windows network authentication hash format captured by Responder and subjected to cracking.
Windows network authentication hash format captured by Responder and subjected to cracking.
“This sent its typically Net-NTLMv2 or v1”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Tinker Secor | Explicit | 36 |
Tinker Secor USES Net-NTLMv2
Tinker collected Net-NTLMv2 hashes from Responder activity.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I pulled down these hashes. Again, they’re Net-NTLMv2 hashes.”