Nasreddine Bencherchali

Reported Context (2)

Acknowledged for helping review the article. Correlating Windows Events 5156 and 1644 to Attribute ADWS Queries
Reviewed SharpHound source code and provided links confirming where SDFlags is implemented. Detecting Active Directory Attack-Path Enumeration with SDFlags

People (8)

MITRE ATT&CK (4)

Vendors (1)

Products (7)

Tools (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.