{"componentChunkName":"component---src-templates-resource-2-js","path":"/resources/detecting-sunburst-with-smokescreen/","result":{"data":{"wordpressWpResources":{"title":"Detecting Sunburst With Smokescreen","content":"\n<h2>Inside You&#8217;ll Find</h2>\n\n\n\n<p>A technique-by-technique deconstruction of the Sunburst attack mapped to deception tactics can detect the techniques.</p>\n\n\n\n<ul><li>Perimeter and network decoys that detect credential stuffing attacks on OWA pages.</li><li>Active Directory and endpoint decoys that detect enumeration of privileged accounts, managed service accounts, and kerberoasting.</li><li>Network and high-interaction Windows decoys that detect reconnaissance prior to lateral movement.</li><li>Network and high-interaction Windows decoys in the Active Directory that detect lateral movement using WMI and SMB.</li></ul>\n","excerpt":"Inside You’ll Find A technique-by-technique deconstruction of the Sunburst attack mapped to deception tactics can detect the techniques. Perimeter and network decoys that detect credential stuffing attacks on OWA pages. Active Directory and endpoint decoys that detect enumeration of privileged accounts, managed service accounts, and kerberoasting. Network and high-interaction Windows decoys that detect reconnaissance prior […]\n","slug":"detecting-sunburst-with-smokescreen","date":"2021-02-05T09:48:01.000Z","status":"publish","modified":"2021-02-05T10:15:57.000Z","acf":{"pdf_link":{"source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/CHEATSHEET-Detecting-sunburst-with-smokescreen-.pdf"},"type":"whitepaper","v2_template_image":{"alt_text":"Detect Sunburst with Smokescreen","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAcCAYAAABh2p9gAAAACXBIWXMAAAsTAAALEwEAmpwYAAAEkElEQVRIx51US1NiRxRuzYh6FRC5vphMGJ2kssg2qegIY5VVJtkli2yyyipZDVOVxSyS7ZSb1Mxiyprd/Ij8Fl+AAgIiAvJSHhduY5+cr3kYA1Opyi2Pfbrp/s53zvm6hWmaX7tcrpdu58zzqcmJkMPxIOScNULzHnfIM+fqjWy9cc7tDrnZnGxi3BUSgs3pfu52OV+u+HxBYRjGGyEETRkz5PEukbmwQhOOacLaf9mPDwX99pkg/4PunIO9F7MzxitMFufHrS/WJuXn/in5eGVMPvQK+WhByLUV0fXN7jhnCMn75R+rQtIvY5J+n5ThHwxrmjFmPHNvhcvp3NWAptN+4p9Xq4/m1BO/V61+Yqo1vznwP328wLaofEseJcRH6q/AhKIXhqJfHar6k8N2jY/RrGd+T4yNj2tAw5i1V3wfK3NhmbzeRVpa8mnzmku0vOyjacNJjsm7UgRmBIW/G6PUlqCfTWFrjCnHntje3t4NBAIUDAZtNrW1tUXPngVpk9dg8INs6xvrtLGxQZubm3r9y/VN2t54St8EA/TV06ANjJ2dnT3RtKxd4q9hd+xsvamo9zU7ipq33WnZalOpJbXfkLeUrVuUb7ao1JZkdffY+Hd9fb0n6vW6BuTRTp9nVL3eoE6nQ5eXl5ROp6larVKxVKL0+bleL5crdJZM0nkmQ4VCga7591arpQErlcodoM1fvVZTPMCnk5MTOj09pWKxhGB0dXVFt7e31Gw0qJAv4DCA9BrbMGC73bZrtbq6ubmhBh/KZi8ZpEiWZVGz2aQSs6zVanoOMFipVGbGZTC/A+TDGhCLHHHA8JxTvLjIDgDBFOsowdnZGWU45Uqlirrp7IYY8kY7HourZDKlATKZCwa8YMAWgxU5QEanWC6XKB6PUyJxRkmuJerJQUcz5E+BkZSSlBo0XNcwl8vrlMEwkUgwy6TOArXl/cMMmZXNTDQguomawdqcDRgDFEHwO9IEcLV6TXWut5SdYUCObnMqCrJA5xAdNQJILpejaDSqQfL5PO3vH9DR0REdHh5y+on7sumn3BOnwt8/04WPAKwCzbwLWiCoAf4Hm4IoLAGWTU13E3WCuOGjTmgAUodM4GMNbAHavyn3GEKczEaBDZjUGBisehu1TMAKnUZz8BvqiTkfGyGbSsUOhyMKkbER0giHwzolXLHj42PdGDQqGolSLBanKN8myGzk1cMiF18Xj2nq1NAg1BCp4vb0HgB9x6FRsE6lUlTjd2AIkAVs82YFFkinnxI0CR+AKAV87IFhDaPsjJAN/2izr/pAnL6WCmtMN+Dg4FDXsMg+5BKJRPQDcsIPCDQ81BTOzOaGoC+aFTqMLoIVCo9uYh2g0CjmYHfDDRp5U3ijzRsVagPp4FAqlWbZSN0I1OrucUhSipuBRwL77gHeMVQDhjgYi8W03vqiRmPwgfXBQfem7O/v6253/lXDV5hwFIuBJIxB8N6PNK6nDEcikp82yXKSfP9xxuoBvhUc+U1P2LpesP/7sUreCy7+t1yjdxzpTx5fw9h/zUz0+CFjdgPjvTj7jkv0/d9wkAoSh7lQIgAAAABJRU5ErkJggg==","aspectRatio":0.7194244604316546,"src":"/static/358c3076db37d80c44a87325b6337928/f2d7c/Detect-Sunburst-with-Smokescreen.png","srcSet":"/static/358c3076db37d80c44a87325b6337928/8ac63/Detect-Sunburst-with-Smokescreen.png 200w,\n/static/358c3076db37d80c44a87325b6337928/3891b/Detect-Sunburst-with-Smokescreen.png 400w,\n/static/358c3076db37d80c44a87325b6337928/f2d7c/Detect-Sunburst-with-Smokescreen.png 702w","srcWebp":"/static/358c3076db37d80c44a87325b6337928/a9902/Detect-Sunburst-with-Smokescreen.webp","srcSetWebp":"/static/358c3076db37d80c44a87325b6337928/6b183/Detect-Sunburst-with-Smokescreen.webp 200w,\n/static/358c3076db37d80c44a87325b6337928/fc32b/Detect-Sunburst-with-Smokescreen.webp 400w,\n/static/358c3076db37d80c44a87325b6337928/a9902/Detect-Sunburst-with-Smokescreen.webp 702w","sizes":"(max-width: 702px) 100vw, 702px"}}}}},"featured_media":{"id":"dc44d1cc-4d00-5bda-a283-f39a6d4452e3","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/Detect-Sunburst-with-Smokescreen.png","alt_text":"Detect Sunburst with Smokescreen","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAcCAYAAABh2p9gAAAACXBIWXMAAAsTAAALEwEAmpwYAAAEkElEQVRIx51US1NiRxRuzYh6FRC5vphMGJ2kssg2qegIY5VVJtkli2yyyipZDVOVxSyS7ZSb1Mxiyprd/Ij8Fl+AAgIiAvJSHhduY5+cr3kYA1Opyi2Pfbrp/s53zvm6hWmaX7tcrpdu58zzqcmJkMPxIOScNULzHnfIM+fqjWy9cc7tDrnZnGxi3BUSgs3pfu52OV+u+HxBYRjGGyEETRkz5PEukbmwQhOOacLaf9mPDwX99pkg/4PunIO9F7MzxitMFufHrS/WJuXn/in5eGVMPvQK+WhByLUV0fXN7jhnCMn75R+rQtIvY5J+n5ThHwxrmjFmPHNvhcvp3NWAptN+4p9Xq4/m1BO/V61+Yqo1vznwP328wLaofEseJcRH6q/AhKIXhqJfHar6k8N2jY/RrGd+T4yNj2tAw5i1V3wfK3NhmbzeRVpa8mnzmku0vOyjacNJjsm7UgRmBIW/G6PUlqCfTWFrjCnHntje3t4NBAIUDAZtNrW1tUXPngVpk9dg8INs6xvrtLGxQZubm3r9y/VN2t54St8EA/TV06ANjJ2dnT3RtKxd4q9hd+xsvamo9zU7ipq33WnZalOpJbXfkLeUrVuUb7ao1JZkdffY+Hd9fb0n6vW6BuTRTp9nVL3eoE6nQ5eXl5ROp6larVKxVKL0+bleL5crdJZM0nkmQ4VCga7591arpQErlcodoM1fvVZTPMCnk5MTOj09pWKxhGB0dXVFt7e31Gw0qJAv4DCA9BrbMGC73bZrtbq6ubmhBh/KZi8ZpEiWZVGz2aQSs6zVanoOMFipVGbGZTC/A+TDGhCLHHHA8JxTvLjIDgDBFOsowdnZGWU45Uqlirrp7IYY8kY7HourZDKlATKZCwa8YMAWgxU5QEanWC6XKB6PUyJxRkmuJerJQUcz5E+BkZSSlBo0XNcwl8vrlMEwkUgwy6TOArXl/cMMmZXNTDQguomawdqcDRgDFEHwO9IEcLV6TXWut5SdYUCObnMqCrJA5xAdNQJILpejaDSqQfL5PO3vH9DR0REdHh5y+on7sumn3BOnwt8/04WPAKwCzbwLWiCoAf4Hm4IoLAGWTU13E3WCuOGjTmgAUodM4GMNbAHavyn3GEKczEaBDZjUGBisehu1TMAKnUZz8BvqiTkfGyGbSsUOhyMKkbER0giHwzolXLHj42PdGDQqGolSLBanKN8myGzk1cMiF18Xj2nq1NAg1BCp4vb0HgB9x6FRsE6lUlTjd2AIkAVs82YFFkinnxI0CR+AKAV87IFhDaPsjJAN/2izr/pAnL6WCmtMN+Dg4FDXsMg+5BKJRPQDcsIPCDQ81BTOzOaGoC+aFTqMLoIVCo9uYh2g0CjmYHfDDRp5U3ijzRsVagPp4FAqlWbZSN0I1OrucUhSipuBRwL77gHeMVQDhjgYi8W03vqiRmPwgfXBQfem7O/v6253/lXDV5hwFIuBJIxB8N6PNK6nDEcikp82yXKSfP9xxuoBvhUc+U1P2LpesP/7sUreCy7+t1yjdxzpTx5fw9h/zUz0+CFjdgPjvTj7jkv0/d9wkAoSh7lQIgAAAABJRU5ErkJggg==","aspectRatio":0.7194244604316546,"src":"/static/358c3076db37d80c44a87325b6337928/10629/Detect-Sunburst-with-Smokescreen.png","srcSet":"/static/358c3076db37d80c44a87325b6337928/69585/Detect-Sunburst-with-Smokescreen.png 200w,\n/static/358c3076db37d80c44a87325b6337928/497c6/Detect-Sunburst-with-Smokescreen.png 400w,\n/static/358c3076db37d80c44a87325b6337928/10629/Detect-Sunburst-with-Smokescreen.png 702w","srcWebp":"/static/358c3076db37d80c44a87325b6337928/8f45d/Detect-Sunburst-with-Smokescreen.webp","srcSetWebp":"/static/358c3076db37d80c44a87325b6337928/61e93/Detect-Sunburst-with-Smokescreen.webp 200w,\n/static/358c3076db37d80c44a87325b6337928/1f5c5/Detect-Sunburst-with-Smokescreen.webp 400w,\n/static/358c3076db37d80c44a87325b6337928/8f45d/Detect-Sunburst-with-Smokescreen.webp 702w","sizes":"(max-width: 702px) 100vw, 702px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAcCAYAAABh2p9gAAAACXBIWXMAAAsTAAALEwEAmpwYAAAEkElEQVRIx51US1NiRxRuzYh6FRC5vphMGJ2kssg2qegIY5VVJtkli2yyyipZDVOVxSyS7ZSb1Mxiyprd/Ij8Fl+AAgIiAvJSHhduY5+cr3kYA1Opyi2Pfbrp/s53zvm6hWmaX7tcrpdu58zzqcmJkMPxIOScNULzHnfIM+fqjWy9cc7tDrnZnGxi3BUSgs3pfu52OV+u+HxBYRjGGyEETRkz5PEukbmwQhOOacLaf9mPDwX99pkg/4PunIO9F7MzxitMFufHrS/WJuXn/in5eGVMPvQK+WhByLUV0fXN7jhnCMn75R+rQtIvY5J+n5ThHwxrmjFmPHNvhcvp3NWAptN+4p9Xq4/m1BO/V61+Yqo1vznwP328wLaofEseJcRH6q/AhKIXhqJfHar6k8N2jY/RrGd+T4yNj2tAw5i1V3wfK3NhmbzeRVpa8mnzmku0vOyjacNJjsm7UgRmBIW/G6PUlqCfTWFrjCnHntje3t4NBAIUDAZtNrW1tUXPngVpk9dg8INs6xvrtLGxQZubm3r9y/VN2t54St8EA/TV06ANjJ2dnT3RtKxd4q9hd+xsvamo9zU7ipq33WnZalOpJbXfkLeUrVuUb7ao1JZkdffY+Hd9fb0n6vW6BuTRTp9nVL3eoE6nQ5eXl5ROp6larVKxVKL0+bleL5crdJZM0nkmQ4VCga7591arpQErlcodoM1fvVZTPMCnk5MTOj09pWKxhGB0dXVFt7e31Gw0qJAv4DCA9BrbMGC73bZrtbq6ubmhBh/KZi8ZpEiWZVGz2aQSs6zVanoOMFipVGbGZTC/A+TDGhCLHHHA8JxTvLjIDgDBFOsowdnZGWU45Uqlirrp7IYY8kY7HourZDKlATKZCwa8YMAWgxU5QEanWC6XKB6PUyJxRkmuJerJQUcz5E+BkZSSlBo0XNcwl8vrlMEwkUgwy6TOArXl/cMMmZXNTDQguomawdqcDRgDFEHwO9IEcLV6TXWut5SdYUCObnMqCrJA5xAdNQJILpejaDSqQfL5PO3vH9DR0REdHh5y+on7sumn3BOnwt8/04WPAKwCzbwLWiCoAf4Hm4IoLAGWTU13E3WCuOGjTmgAUodM4GMNbAHavyn3GEKczEaBDZjUGBisehu1TMAKnUZz8BvqiTkfGyGbSsUOhyMKkbER0giHwzolXLHj42PdGDQqGolSLBanKN8myGzk1cMiF18Xj2nq1NAg1BCp4vb0HgB9x6FRsE6lUlTjd2AIkAVs82YFFkinnxI0CR+AKAV87IFhDaPsjJAN/2izr/pAnL6WCmtMN+Dg4FDXsMg+5BKJRPQDcsIPCDQ81BTOzOaGoC+aFTqMLoIVCo9uYh2g0CjmYHfDDRp5U3ijzRsVagPp4FAqlWbZSN0I1OrucUhSipuBRwL77gHeMVQDhjgYi8W03vqiRmPwgfXBQfem7O/v6253/lXDV5hwFIuBJIxB8N6PNK6nDEcikp82yXKSfP9xxuoBvhUc+U1P2LpesP/7sUreCy7+t1yjdxzpTx5fw9h/zUz0+CFjdgPjvTj7jkv0/d9wkAoSh7lQIgAAAABJRU5ErkJggg==","aspectRatio":0.7183908045977011,"src":"/static/358c3076db37d80c44a87325b6337928/46604/Detect-Sunburst-with-Smokescreen.png","srcSet":"/static/358c3076db37d80c44a87325b6337928/62d80/Detect-Sunburst-with-Smokescreen.png 125w,\n/static/358c3076db37d80c44a87325b6337928/e1953/Detect-Sunburst-with-Smokescreen.png 250w,\n/static/358c3076db37d80c44a87325b6337928/46604/Detect-Sunburst-with-Smokescreen.png 500w,\n/static/358c3076db37d80c44a87325b6337928/10629/Detect-Sunburst-with-Smokescreen.png 702w","srcWebp":"/static/358c3076db37d80c44a87325b6337928/e9589/Detect-Sunburst-with-Smokescreen.webp","srcSetWebp":"/static/358c3076db37d80c44a87325b6337928/549da/Detect-Sunburst-with-Smokescreen.webp 125w,\n/static/358c3076db37d80c44a87325b6337928/7ca0e/Detect-Sunburst-with-Smokescreen.webp 250w,\n/static/358c3076db37d80c44a87325b6337928/e9589/Detect-Sunburst-with-Smokescreen.webp 500w,\n/static/358c3076db37d80c44a87325b6337928/8f45d/Detect-Sunburst-with-Smokescreen.webp 702w","sizes":"(max-width: 500px) 100vw, 500px"}}}},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"Use this cheat sheet as a reference guide for deception techniques that can detect Sunburst at different stages of the attack.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"44","yoast_wpseo_focuskw":"Sunburst","yoast_wpseo_canonical":""}}},"pageContext":{"id":"04109ff1-4e3b-5fb2-b2af-70effc0e94af"}},"staticQueryHashes":["1478079672"]}