Adam Georgeson USES credentialed remote access
Adam used saved credentials and Remote Desktop connections to access additional computers and servers.
Explicit Confidence 98% · Adam Georgeson EP 113 Details
“there was sort of saved credentials”
Technique
technique:credentialed_remote_access
Also: saved credentials abuse
Using saved credentials and remote-access entries on compromised systems to connect to additional infrastructure.
Using saved credentials and remote-access entries on compromised systems to connect to additional infrastructure.
“there was sort of saved credentials”
“there might be an RDP icon saved which saved credentials”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Adam Georgeson | Explicit | 113 |
| incoming | INVOLVES | Unnamed IT company network attack | Explicit | 113 |
Adam Georgeson USES credentialed remote access
Adam used saved credentials and Remote Desktop connections to access additional computers and servers.
Explicit Confidence 98% · Adam Georgeson EP 113 Details
“there was sort of saved credentials”
Unnamed IT company network attack INVOLVES credentialed remote access
The later attack used retained domain administrator credentials to access the employer’s network services.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down”