other | Detection.FYI

Multiple Modsecurity Blocks

Apr 21, 2023 · attack.impact attack.t1499 ·
Share on:

Detects multiple blocks by the mod_security module (Web Application Firewall)

Read More

Recent Posts

DNS Query To Remote Access Software Domain From Non-Browser App
New AWS Lambda Function URL Configuration Created
AWS SAML Provider Deletion Activity
Register new Logon Process by Rubeus
AWS Key Pair Import Activity
DNS Query Request By QuickAssist.EXE
QuickAssist Execution
File Creation Related To RAT Clients

Language

SIGMA 3900 ELASTIC 1240 MQL 496

Tags

ATTACK.DEFENSE-EVASION 1271 USE-CASE-THREAT-DETECTION 850 ATTACK.EXECUTION 829 DOMAIN-ENDPOINT 771 DATA-SOURCE-ELASTIC-DEFEND 619 ATTACK.PERSISTENCE 571 OS-WINDOWS 441 ATTACK.PRIVILEGE-ESCALATION 373 DATA-SOURCE-ELASTIC-ENDGAME 343 DETECTION.EMERGING-THREATS 330 TACTIC-DEFENSE-EVASION 307 ATTACK.CREDENTIAL-ACCESS 298 RESOURCES-INVESTIGATION-GUIDE 282 OS-LINUX 279