attack.t1005

ADFS Database Named Pipe Connection By Uncommon Tool

Aug 12, 2024 · attack.collection attack.t1005 ·

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

AWS EC2 VM Export Failure

Aug 12, 2024 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·

Share on:

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Cisco Collect Data

Aug 12, 2024 · attack.discovery attack.credential-access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·

Share on:

Collect pertinent data from the configuration files

Esentutl Steals Browser Information

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

OpenCanary - SMB File Open Request

Aug 12, 2024 · attack.lateral-movement attack.collection attack.t1021 attack.t1005 ·

Share on:

Detects instances where an SMB service on an OpenCanary node has had a file open request.

Potential Conti Ransomware Database Dumping Activity Via SQLCmd

Aug 12, 2024 · attack.collection attack.t1005 detection.emerging-threats ·

Share on:

Detects a command used by conti to dump database

SQLite Chromium Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·

Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

SQLite Firefox Profile Data DB Access

Aug 12, 2024 · attack.credential-access attack.t1539 attack.collection attack.t1005 ·

Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Veeam Backup Database Suspicious Query

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

Detects dump of credentials in VeeamBackup dbo

Potential Exfiltration of Compressed Files

Apr 21, 2023 · attack.exfiltration attack.t1560.001 attack.t1005 ·

Share on:

This rule detects potential exfiltration by looking for a few compression extensions in the uri and signs of compression in the mime type, file type, and http body