attack.reconnaissance

PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.

AADInternals PowerShell Cmdlets Execution - ProccessCreation

Aug 12, 2024 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

AADInternals PowerShell Cmdlets Execution - PsScript

Aug 12, 2024 · attack.execution attack.reconnaissance attack.discovery attack.credential-access attack.impact ·

Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Azure AD Account Credential Leaked

Aug 12, 2024 · attack.t1589 attack.reconnaissance ·

Share on:

Indicates that the user's valid credentials have been leaked.

Bitbucket User Details Export Attempt Detected

Aug 12, 2024 · attack.collection attack.reconnaissance attack.discovery attack.t1213 attack.t1082 attack.t1591.004 ·

Share on:

Detects user data export activity.

Bitbucket User Permissions Export Attempt

Aug 12, 2024 · attack.reconnaissance attack.t1213 attack.t1082 attack.t1591.004 ·

Share on:

Detects user permission data export attempt.

Cat Sudoers

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·

Share on:

Detects the execution of a cat /etc/sudoers to list all users that have sudo rights

DNS Query to External Service Interaction Domains

Aug 12, 2024 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002 ·

Share on:

Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE

Failed DNS Zone Transfer

Aug 12, 2024 · attack.reconnaissance attack.t1590.002 ·

Share on:

Detects when a DNS zone transfer failed.

Linux Recon Indicators

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 attack.credential-access attack.t1552.001 ·

Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Potential Active Directory Enumeration Using AD Module - ProcCreation

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Potential Active Directory Enumeration Using AD Module - PsModule

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Potential Active Directory Enumeration Using AD Module - PsScript

Aug 12, 2024 · attack.reconnaissance attack.discovery attack.impact ·

Share on:

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.