A security event popped up, alerting security of a suspicious user gaining access to, and copying files from, the %systemroot%\n

Question

3 years ago

11

tds\ file path on a server. what is the user trying to do?

1 answer:

daser333 [38] · Answer 1 · 2022-12-29T02:12:26+03:00

There are different kinds of event. What the user trying to do is to gather employee login credentials.

<h3>What is a credential harvester?</h3>

Credential Harvesting is a term that is also called Account Harvesting. This is known to be a type of MITM attacks, DNS poisoning, phishing, etc.

It is often used to gather a lot of high numbers of credentials (such as username /or password combinations) and it is done mainly for reuse.

Learn more about security event from