attack.t1078 | Detection.FYI

AWS Key Pair Import Activity

Dec 19, 2024 · attack.initial-access attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Read More
Account Created And Deleted Within A Close Time Frame

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when an account was created and deleted in a short period of time.

Read More
Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
Authentications To Important Apps Using Single Factor Authentication

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detect when authentications to important application(s) only required single-factor authentication

Read More
AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Azure Domain Federation Settings Modified

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Identifies when an user or application modified the federation settings on the domain.

Read More
Azure Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Azure Subscription Permission Elevation Via AuditLogs

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Unusual Authentication Interruption

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when there is a interruption in the authentication process.

Read More
Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
External Remote RDP Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More
External Remote SMB Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More
Failed Logon From Public IP

Aug 12, 2024 · attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·
Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Read More
Google Cloud Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Guest Account Enabled Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.t1078 attack.t1078.001 ·
Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Read More
Guest Users Invited To Tenant By Non Approved Inviters

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects guest users being invited to tenant by non-approved inviters

Read More
Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Read More
Increased Failed Authentications Of Any Type

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when sign-ins increased by 10% or greater.

Read More
Invalid PIM License

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
Kubernetes Admission Controller Modification

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Read More
Logon from a Risky IP Address

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Read More
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
Measurable Increase Of Successful Authentications

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects when successful sign-ins increased by 10% or greater.

Read More
Microsoft 365 - Impossible Travel Activity

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Read More
New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Read More
OpenCanary - SSH Login Attempt

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - SSH New Connection Attempt

Aug 12, 2024 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Read More
OpenCanary - Telnet Login Attempt

Aug 12, 2024 · attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·
Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Read More
Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
PIM Alert Setting Changes To Disabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
Roles Activated Too Frequently

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Root Account Enable Via Dsenableroot

Aug 12, 2024 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·
Share on:

Detects attempts to enable the root account via "dsenableroot"

Read More
Stale Accounts In A Privileged Role

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Read More
Suspicious Computer Machine Password by PowerShell

Aug 12, 2024 · attack.initial-access attack.t1078 ·
Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Read More
Suspicious Remote Logon with Explicit Credentials

Aug 12, 2024 · attack.t1078 attack.lateral-movement ·
Share on:

Detects suspicious processes logging on with explicit credentials

Read More
Suspicious SignIns From A Non Registered Device

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·
Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Read More
Too Many Global Admins

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Read More
User Added to an Administrator's Azure AD Role

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
User Added to Local Administrator Group

Aug 12, 2024 · attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·
Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Read More
Win Susp Computer Name Containing Samtheadmin

Aug 12, 2024 · cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·
Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Read More
Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Read More