As cited
Copy frozen at (site build).
threat intel
Defence Impairment Olympics
Huntress documented a credential dumping attack in which threat actors disabled Windows Defender, terminated monitoring tools, and deployed Mimikatz to extract credentials. The attack demonstrates a coordinated approach to evade defenses and establish persistence within compromised environments.
Why it matters: Security operations teams need to detect and respond to Defender disablement and monitoring tool termination as early indicators of active credential theft, as these techniques precede lateral movement and data exfiltration.
- Source published
- First seen by Cybersecurity Tracker