attack.t1078

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Impossible Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

New Country

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Suspicious Browser Activity

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Unfamiliar Sign-In Properties

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Password Provided In Command Line Of Net.EXE

Aug 28, 2023 · attack.defense_evasion attack.initial_access attack.persistence attack.privilege_escalation attack.lateral_movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

Root Account Enable Via Dsenableroot

Aug 22, 2023 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial_access attack.persistence ·

Share on:

Detects attempts to enable the root account via "dsenableroot"

Suspicious Computer Machine Password by PowerShell

May 15, 2023 · attack.initial_access attack.t1078 ·

Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

External Remote RDP Logon from Public IP

May 2, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

External Remote SMB Logon from Public IP

May 2, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Failed Logon From Public IP

May 2, 2023 · attack.initial_access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·

Share on:

A login from a public IP can indicate a misconfigured firewall or network boundary.

Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Authentications To Important Apps Using Single Factor Authentication

Mar 29, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detect when authentications to important application(s) only required single-factor authentication

Guest Users Invited To Tenant By Non Approved Inviters

Mar 29, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects guest users being invited to tenant by non-approved inviters

User Added to Local Administrators

Feb 27, 2023 · attack.privilege_escalation attack.t1078 attack.persistence attack.t1098 ·

Share on:

This rule triggers on user accounts that are added to the local Administrators group, which could be legitimate activity or a sign of privilege escalation activity

Guest Account Enabled Via Sysadminctl

Feb 20, 2023 · attack.initial_access attack.t1078 attack.t1078.001 ·

Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Account Tampering - Suspicious Failed Logon Reasons

Feb 1, 2023 · attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

PIM Alert Setting Changes To Disabled

Jan 29, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects when PIM alerts are set to disabled.

User Added to an Administrator's Azure AD Role

Jan 29, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 attack.t1078 ·

Share on:

User Added to an Administrator's Azure AD Role

External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Cisco BGP Authentication Failures

Jan 23, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Huawei BGP Authentication Failures

Jan 23, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Juniper BGP Missing MD5

Jan 23, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Cisco LDP Authentication Failures

Jan 12, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Suspicious SignIns From A Non Registered Device

Jan 10, 2023 · attack.defense_evasion attack.t1078 ·

Share on:

Detects risky authencaition from a non AD registered device without MFA being required.

Azure Domain Federation Settings Modified

Jan 10, 2023 · attack.initial_access attack.t1078 ·

Share on:

Identifies when an user or application modified the federation settings on the domain.

Win Susp Computer Name Containing Samtheadmin

Jan 4, 2023 · cve.2021.42278 cve.2021.42287 attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Azure Subscription Permission Elevation Via AuditLogs

Dec 27, 2022 · attack.initial_access attack.t1078 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

AWS Suspicious SAML Activity

Dec 18, 2022 · attack.initial_access attack.t1078 attack.lateral_movement attack.t1548 attack.privilege_escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Azure Kubernetes Admission Controller

Dec 18, 2022 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Azure Unusual Authentication Interruption

Dec 18, 2022 · attack.initial_access attack.t1078 ·

Share on:

Detects when there is a interruption in the authentication process.

Google Cloud Kubernetes Admission Controller

Dec 18, 2022 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Account Created And Deleted Within A Close Time Frame

Oct 25, 2022 · attack.defense_evasion attack.t1078 ·

Share on:

Detects when an account was created and deleted in a short period of time.

Application Using Device Code Authentication Flow

Oct 25, 2022 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Oct 25, 2022 · attack.t1078 attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.