ProcessusT/HEKATOMB
@ProcessusTHekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.
Stars
523
Forks
56
Language
Python
License
GPL-3.0
Last push
2 years ago
Related intel (0)
No related intel yet
This repo has not appeared in any of the sources the radar tracks. The collector runs on a schedule — check back once it covers this repo.