attack.t1018

This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP

Renamed AdFind Execution

Aug 12, 2024 · attack.discovery attack.t1018 attack.t1087.002 attack.t1482 attack.t1069.002 ·

Share on:

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Share And Session Enumeration Using Net.EXE

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Suspicious Scan Loop Network

Aug 12, 2024 · attack.execution attack.t1059 attack.discovery attack.t1018 ·

Share on:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Webshell Detection With Command Line Keywords

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain command line parameters often used during reconnaissance activity via web shells

Webshell Hacking Activity Patterns

Aug 12, 2024 · attack.persistence attack.t1505.003 attack.t1018 attack.t1033 attack.t1087 ·

Share on:

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

AdFind Discovery

Feb 23, 2024 · attack.discovery attack.t1018 attack.t1482 attack.t1069.002 attack.t1087.002 attack.s0552 ·

Share on:

AdFind has been seen in numerous intrusions. The threat actor(s) ran these commands.