Suspicious access to Unattended Panther files

Identifies suspicious to access to unattend.xml files where credentials are commonly stored within the Panther directory. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

• Platform: Windows
• Severity: High
• MITRE Tactic: Credential Access
• MITRE Techniques: T1552, T1552.001

Back to all rules