Microsoft Defender Reporting Successful Login Attempts

[ikspozd]

Hello,

Does SharpHound.ps1 attempt to log into workstations when querying AD?

Thanks

[StephenHinck]

Workstation logons will be attempted only if you are enumerating local group memberships and/or sessions. These will be non-interactive logons.

[ikspozd]

@StephenHinck is there a way to disable that feature?

[StephenHinck]

If you choose not to use those collection methods, it will not be attempted. You'd want to avoid methods such as All, ComputerOnly, Session, LoggedOn, etc

See: https://support.bloodhoundenterprise.io/hc/en-us/articles/17481375424795-All-SharpHound-Community-Edition-Flags-Explained

[ikspozd]

Excellent thanks!