Koh - The Token Stealer

Koh is a C and Beacon Object File BOF toolset that allows for the capture of user credential material via purposeful token/logon session leakage. Some code was inspired by Elad Shamir's Internal-Monologue project no license, as well as KB180548. For why this is possible and Koh's approeach, see t...

Microsoft Windows: Audit Logon

Audit Logon determines whether the operating system generates audit events when a user attempts to log on to a computer. These events are related to the creation of logon sessions and occur on the computer that was accessed. For an interactive logon, events are generated on the computer that was...

When WSCReconnectMode Value 8 is Set a Windows Logoff and Logon Happens, Existing Sessions Should Reconnect Automatically

When WSCReconnectMode value 8 is set the existing session does not reconnect on logon. The expected behavior is on logon the session will reconnect...