Initial Access | Detection.FYI

Auditd Login Attempt at Forbidden Time

Jul 26, 2022 · Elastic Host Linux Threat Detection Initial Access ·
Share on:

Identifies that a login attempt occurred at a forbidden time.

Read More
Auditd Login from Forbidden Location

Jul 26, 2022 · Elastic Host Linux Threat Detection Initial Access ·
Share on:

Identifies that a login attempt has happened from a forbidden location.

Read More
Auditd Max Failed Login Attempts

Jul 26, 2022 · Elastic Host Linux Threat Detection Initial Access ·
Share on:

Identifies that the maximum number of failed login attempts has been reached for a user.

Read More
Auditd Max Login Sessions

Jul 26, 2022 · Elastic Host Linux Threat Detection Initial Access ·
Share on:

Identifies that the maximum number login sessions has been reached for a user.

Read More
RDP (Remote Desktop Protocol) to the Internet

Jul 29, 2021 · Elastic Host Network Threat Detection Initial Access ·
Share on:

This rule detects network events that may indicate the use of RDP traffic to the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.

Read More