#T1003.003

• 2026-06-23 04:05 UTC Cortex XDR : Hunt down and intercept attackers using the native 'Install from Media' feature to clone your Active Directory database for offline credential cracking.
  #alerts#detection#multi-tenant#xql#T1003.003