Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

Detecting Access Token Manipulation

Black Hat via YouTube

Overview

Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
This course explains Windows logon sessions, access tokens, UAC, and network authentication before examining NETONLY, pass-the-ticket, and overpass-the-hash techniques. It then presents hook-based and native telemetry approaches for detecting token manipulation and related credential abuse.

Syllabus

Intro
Objectives
Agenda
Logon Sessions and Access Tokens
Network Authentication
Impersonation
Initial Compromise
Token Manipulation: The Art of the possible
NETONLY
CreateProcessWithLogonW
Pass-The-Ticket
Overpass-the-hash
Frida Basic Shocking template
Detecting Access Token Manipulation
Conclusion

Taught by

Black Hat

Reviews

Start your review of Detecting Access Token Manipulation

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.