attack.t1595

Potential Hello-World Scraper Botnet Activity

Oct 1, 2025 · attack.reconnaissance attack.t1595 ·

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

PUA - PingCastle Execution

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

PUA - PingCastle Execution From Potentially Suspicious Parent

Dec 1, 2024 · attack.reconnaissance attack.t1595 ·

Share on:

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.