Learn AI, Data Science & Business — Earn Certificates That Get You Hired
Live Online Classes in Design, Coding & AI — Small Classes, Free Retakes
Overview
Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
This course explains Windows logon sessions, access tokens, UAC, and network authentication before examining NETONLY, pass-the-ticket, and overpass-the-hash techniques. It then presents hook-based and native telemetry approaches for detecting token manipulation and related credential abuse.
Syllabus
Intro
Objectives
Agenda
Logon Sessions and Access Tokens
Network Authentication
Impersonation
Initial Compromise
Token Manipulation: The Art of the possible
NETONLY
CreateProcessWithLogonW
Pass-The-Ticket
Overpass-the-hash
Frida Basic Shocking template
Detecting Access Token Manipulation
Conclusion
Taught by
Black Hat