Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
eSentire will be participating in the Avant Partner Summit.
Join eSentire and Telarus for a day of golfing.
Insurance firms, agencies and brokers are now a lucrative target for…
PetitPotam is a variant of NTLM Relay attacks discovered by security researcher Gilles Lionel. Proof of Concept code released last week  relies on the Encrypting File System Remote (EFSRPC) protocol to provoke a Windows host into performing an NTLM authentication request against an attacker-controlled server, exposing NTLM authentication details or authentication certificates. This information can be used by an attacker to elevate their privileges in a domain environment.
Microsoft has released mitigations for the attack. Security updates are not available at time of writing. In the wild attacks abusing PetitPotam have not been observed at this time.
In response to PetitPotam, Microsoft has released mitigations for this attack .
Detailed mitigation steps are available in Microsoft’s knowledge base article .
PetitPotam is a form of NTLM Relay attack which abuses the EFSRPC protocol. In an attack scenario, an attacker with local network access would abuse this protocol to coerce an NTLM authentication request to a server under an attacker’s control. Researchers have successfully relayed NTLM requests retrieved using PetitPotam to Active Directory Certificate Services (AD CS) servers to sign a certificate using the relayed NTLM credentials. An attacker can then leverage this signed certificate to elevate their access and compromise the domain. This attack method is described in detail by SANS .
Known attack methods abusing PetitPotam require the following conditions to be met: