attack.t1078

OpenCanary - SSH Login Attempt

Feb 3, 2025 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

OpenCanary - SSH New Connection Attempt

Feb 3, 2025 · attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·

Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

OpenCanary - Telnet Login Attempt

Feb 3, 2025 · attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·

Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Azure Login Bypassing Conditional Access Policies

Jan 19, 2025 · attack.defense-evasion attack.t1078 ·

Share on:

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

AWS Key Pair Import Activity

Dec 19, 2024 · attack.initial-access attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Account Created And Deleted Within A Close Time Frame

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when an account was created and deleted in a short period of time.

Account Tampering - Suspicious Failed Logon Reasons

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·

Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Authentications To Important Apps Using Single Factor Authentication

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detect when authentications to important application(s) only required single-factor authentication

AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·

Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Azure Domain Federation Settings Modified

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Identifies when an user or application modified the federation settings on the domain.

Azure Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Azure Subscription Permission Elevation Via AuditLogs

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Azure Unusual Authentication Interruption

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when there is a interruption in the authentication process.

Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

External Remote RDP Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

External Remote SMB Logon from Public IP

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Failed Logon From Public IP

Aug 12, 2024 · attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·

Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Google Cloud Kubernetes Admission Controller

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Guest Account Enabled Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.t1078 attack.t1078.001 ·

Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Guest Users Invited To Tenant By Non Approved Inviters

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects guest users being invited to tenant by non-approved inviters

Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Increased Failed Authentications Of Any Type

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when sign-ins increased by 10% or greater.

Invalid PIM License

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·

Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Kubernetes Admission Controller Modification

Aug 12, 2024 · attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·

Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Logon from a Risky IP Address

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.002 ·

Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Measurable Increase Of Successful Authentications

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when successful sign-ins increased by 10% or greater.

Microsoft 365 - Impossible Travel Activity

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·

Share on:

Detects a when net.exe is called with a password in the command line

PIM Alert Setting Changes To Disabled

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078 ·

Share on:

Detects when PIM alerts are set to disabled.

Roles Activated Too Frequently

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when the same privilege role has multiple activations by the same user.

Roles Activation Doesn't Require MFA

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when a privilege role can be activated without performing mfa.

Roles Are Not Being Used

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Roles Assigned Outside PIM

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Root Account Enable Via Dsenableroot

Aug 12, 2024 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·

Share on:

Detects attempts to enable the root account via "dsenableroot"

Stale Accounts In A Privileged Role

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies when an account hasn't signed in during the past n number of days.

Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Suspicious Computer Machine Password by PowerShell

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Suspicious Remote Logon with Explicit Credentials

Aug 12, 2024 · attack.t1078 attack.lateral-movement ·

Share on:

Detects suspicious processes logging on with explicit credentials

Suspicious SignIns From A Non Registered Device

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Too Many Global Admins

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·

Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

User Added to an Administrator's Azure AD Role

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·

Share on:

User Added to an Administrator's Azure AD Role

User Added to Local Administrator Group

Aug 12, 2024 · attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·

Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Win Susp Computer Name Containing Samtheadmin

Aug 12, 2024 · cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·

Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Failed Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

Failed NTLM Logins with Different Accounts from Single Source System

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects suspicious failed logins with different user accounts from a single source system

External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·

Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.