attack.t1592.004 | Detection.FYI

Cat Sudoers

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·
Share on:

Detects the execution of a cat /etc/sudoers to list all users that have sudo rights

Read More
Linux Recon Indicators

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 attack.credential-access attack.t1552.001 ·
Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Read More
Print History File Contents

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·
Share on:

Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance

Read More