API Reference
Class
PassTheCredentialDetector
Detects potential pass-the-credential activity using Security log events.
Inheritance
- Object
- PassTheCredentialDetector
Constructors
public PassTheCredentialDetector(Func<String, IEnumerable<PassTheCredentialEvent>> getEvents = null) #Initializes a new instance of the PassTheCredentialDetector class.
Parameters
- getEvents System.Func{System.String,System.Collections.Generic.IEnumerable{ADPlayground.Audit.PassTheCredentialEvent}} = null
- Delegate retrieving credential logon events.
Methods
public IEnumerable<PassTheCredentialEvent> GetSuspiciousEvents(String computerName = null, Nullable<TimeSpan> observationWindow = null) #Returns:
IEnumerable<PassTheCredentialEvent>Enumerates suspicious credential usage events on the specified computer.
Parameters
- computerName System.String = null
- Target computer or null for local.
- observationWindow System.Nullable{System.TimeSpan} = null
- Time window to correlate events.
Returns
Collection of suspicious credential events.