zeek | Detection.FYI

Domain User Enumeration Network Recon 01

Oct 18, 2023 · attack.discovery attack.t1087.002 attack.t1082 ·
Share on:

Domain user and group enumeration via network reconnaissance. Seen in APT 29 and other common tactics and actors. Detects a set of RPC (remote procedure calls) used to enumerate a domain controller. The rule was created based off the datasets and hackathon from https://github.com/OTRF/detection-hackathon-apt29

Read More
Potential Exfiltration of Compressed Files

Apr 21, 2023 · attack.exfiltration attack.t1560.001 attack.t1005 ·
Share on:

This rule detects potential exfiltration by looking for a few compression extensions in the uri and signs of compression in the mime type, file type, and http body

Read More