Windows AdFind Exe
Remote System Discovery
Discovery
Local Account Discovery With Wmic
Account Discovery, Local Account
Local Account Discovery With Wmic
Account Discovery, Local Account
Local Account Discovery with Net
Account Discovery, Local Account
Local Account Discovery with Net
Account Discovery, Local Account
Account Discovery With Net App
Domain Account, Account Discovery
Account Discovery With Net App
Domain Account, Account Discovery
Check Elevated CMD using whoami
System Owner/User Discovery
Wmic Group Discovery
Permission Groups Discovery, Local Groups
Wmic Group Discovery
Permission Groups Discovery, Local Groups
Powershell Get LocalGroup Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
Powershell Get LocalGroup Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
PowerShell Get LocalGroup Discovery
Permission Groups Discovery, Local Groups
PowerShell Get LocalGroup Discovery
Permission Groups Discovery, Local Groups
Net Localgroup Discovery
Permission Groups Discovery, Local Groups
Net Localgroup Discovery
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery
Permission Groups Discovery, Local Groups
User Discovery With Env Vars PowerShell Script Block
System Owner/User Discovery
User Discovery With Env Vars PowerShell
System Owner/User Discovery
System User Discovery With Whoami
System Owner/User Discovery
System User Discovery With Query
System Owner/User Discovery
GetCurrent User with PowerShell Script Block
System Owner/User Discovery
GetCurrent User with PowerShell
System Owner/User Discovery
Network Connection Discovery With Netstat
System Network Connections Discovery
Network Connection Discovery With Net
System Network Connections Discovery
Network Connection Discovery With Arp
System Network Connections Discovery
GetNetTcpconnection with PowerShell Script Block
System Network Connections Discovery
System Information Discovery Detection
System Information Discovery
SchCache Change By App Connect And Create ADSI Object
Domain Account, Account Discovery
SchCache Change By App Connect And Create ADSI Object
Domain Account, Account Discovery
GetWmiObject Ds Computer with PowerShell
Remote System Discovery
GetDomainController with PowerShell
Remote System Discovery
GetDomainComputer with PowerShell
Remote System Discovery
GetAdComputer with PowerShell
Remote System Discovery
GetDomainController with PowerShell Script Block
Remote System Discovery
GetDomainComputer with PowerShell Script Block
Remote System Discovery
Get-ForestTrust with PowerShell Script Block
Domain Trust Discovery
Get-ForestTrust with PowerShell
Domain Trust Discovery
Remote System Discovery with Wmic
Remote System Discovery
Remote System Discovery with Adsisearcher
Remote System Discovery
GetWmiObject Ds Computer with PowerShell Script Block
Remote System Discovery
GetAdComputer with PowerShell Script Block
Remote System Discovery
Domain Group Discovery With Dsquery
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Dsquery
Permission Groups Discovery, Domain Groups
Domain Controller Discovery with Wmic
Remote System Discovery
Remote System Discovery with Dsquery
Remote System Discovery
Remote System Discovery with Net
Remote System Discovery
Domain Controller Discovery with Nltest
Remote System Discovery
Password Policy Discovery with Net
Password Policy Discovery
GetDomainGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetDomainGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
Get DomainPolicy with Powershell Script Block
Password Policy Discovery
Get DomainPolicy with Powershell
Password Policy Discovery
Get ADUserResultantPasswordPolicy with Powershell Script Block
Password Policy Discovery
Get ADUserResultantPasswordPolicy with Powershell
Password Policy Discovery
Get ADDefaultDomainPasswordPolicy with Powershell Script Block
Password Policy Discovery
Get ADDefaultDomainPasswordPolicy with Powershell
Password Policy Discovery
GetWmiObject Ds Group with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetWmiObject Ds Group with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetWmiObject Ds Group with PowerShell
Permission Groups Discovery, Domain Groups
GetWmiObject Ds Group with PowerShell
Permission Groups Discovery, Domain Groups
GetNetTcpconnection with PowerShell
System Network Connections Discovery
GetDomainGroup with PowerShell
Permission Groups Discovery, Domain Groups
GetDomainGroup with PowerShell
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Elevated Group Discovery with PowerView
Permission Groups Discovery, Domain Groups
Elevated Group Discovery with PowerView
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Net
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Net
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Net
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Net
Permission Groups Discovery, Domain Groups
Domain Group Discovery with Adsisearcher
Permission Groups Discovery, Domain Groups
Domain Group Discovery with Adsisearcher
Permission Groups Discovery, Domain Groups
Kubernetes Scanner Image Pulling
Cloud Service Discovery
GetWmiObject DS User with PowerShell Script Block
Domain Account, Account Discovery
GetWmiObject DS User with PowerShell Script Block
Domain Account, Account Discovery
GetWmiObject DS User with PowerShell
Domain Account, Account Discovery
GetWmiObject DS User with PowerShell
Domain Account, Account Discovery
Get DomainUser with PowerShell Script Block
Domain Account, Account Discovery
Get DomainUser with PowerShell Script Block
Domain Account, Account Discovery
Get DomainUser with PowerShell
Domain Account, Account Discovery
Get DomainUser with PowerShell
Domain Account, Account Discovery
Get ADUser with PowerShell Script Block
Domain Account, Account Discovery
Get ADUser with PowerShell Script Block
Domain Account, Account Discovery
Get ADUser with PowerShell
Domain Account, Account Discovery
Get ADUser with PowerShell
Domain Account, Account Discovery
Get-DomainTrust with PowerShell Script Block
Domain Trust Discovery
Get-DomainTrust with PowerShell
Domain Trust Discovery
Domain Account Discovery with Wmic
Domain Account, Account Discovery
Domain Account Discovery with Wmic
Domain Account, Account Discovery
Domain Account Discovery With Net App
Domain Account, Account Discovery
Domain Account Discovery With Net App
Domain Account, Account Discovery
Domain Account Discovery with Dsquery
Domain Account, Account Discovery
Domain Account Discovery with Dsquery
Domain Account, Account Discovery
AdsiSearcher Account Discovery
Domain Account, Account Discovery
AdsiSearcher Account Discovery
Domain Account, Account Discovery
GetWmiObject User Account with PowerShell Script Block
Account Discovery, Local Account
GetWmiObject User Account with PowerShell Script Block
Account Discovery, Local Account
GetWmiObject User Account with PowerShell
Account Discovery, Local Account
GetWmiObject User Account with PowerShell
Account Discovery, Local Account
GetLocalUser with PowerShell Script Block
Account Discovery, Local Account
GetLocalUser with PowerShell Script Block
Account Discovery, Local Account
GetLocalUser with PowerShell
Account Discovery, Local Account
GetLocalUser with PowerShell
Account Discovery, Local Account
Excessive number of taskhost processes
System Owner/User Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Enumerate Users Local Group Using Telegram
Account Discovery
AWS Excessive Security Scanning
Cloud Service Discovery
AWS IAM AccessDenied Discovery Events
Cloud Infrastructure Discovery
AWS IAM Assume Role Policy Brute Force
Cloud Infrastructure Discovery, Brute Force
DSQuery Domain Discovery
Domain Trust Discovery
AWS IAM Successful Group Deletion
Cloud Groups, Account Manipulation, Permission Groups Discovery
AWS IAM Successful Group Deletion
Cloud Groups, Account Manipulation, Permission Groups Discovery
NLTest Domain Trust Discovery
Domain Trust Discovery
Detect processes used for System Network Configuration Discovery
System Network Configuration Discovery
Reconnaissance of Connectivity via PowerSploit modules
Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares
Reconnaissance and Access to Shared Resources via PowerSploit modules
Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares
Reconnaissance and Access to Shared Resources via Mimikatz modules
Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares
Reconnaissance and Access to Processes and Services via Mimikatz modules
System Service Discovery, Network Service Scanning, Process Discovery
Reconnaissance and Access to Processes and Services via Mimikatz modules
System Service Discovery, Network Service Scanning, Process Discovery
Reconnaissance and Access to Processes and Services via Mimikatz modules
System Service Discovery, Network Service Scanning, Process Discovery
Reconnaissance and Access to Operating System Elements via PowerSploit modules
Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumenta...
Reconnaissance and Access to Operating System Elements via PowerSploit modules
Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumenta...
Reconnaissance and Access to Operating System Elements via PowerSploit modules
Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumenta...
Reconnaissance and Access to Operating System Elements via PowerSploit modules
Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumenta...
Reconnaissance and Access to Operating System Elements via PowerSploit modules
Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumenta...
Reconnaissance and Access to Operating System Elements via PowerSploit modules
Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumenta...
Reconnaissance and Access to Computers and Domains via PowerSploit modules
Gather Victim Host Information, Gather Victim Network Information, Account Discovery
Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules
Trusted Relationship, Domain Trust Discovery, Gather Victim Network Information, Gather Victim Org Information, Active Scanning
Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
Valid Accounts, Account Discovery, Domain Policy Modification
Reconnaissance and Access to Accounts and Groups via Mimikatz modules
Valid Accounts, Account Discovery, Domain Policy Modification
Assessment of Credential Strength via DSInternals modules
Valid Accounts, Account Manipulation, Account Discovery, Password Policy Discovery, Unsecured Credentials, Credentials from Password Stores
Assessment of Credential Strength via DSInternals modules
Valid Accounts, Account Manipulation, Account Discovery, Password Policy Discovery, Unsecured Credentials, Credentials from Password Stores
GCP Kubernetes cluster pod scan detection
Cloud Service Discovery
Amazon EKS Kubernetes Pod scan detection
Cloud Service Discovery
Amazon EKS Kubernetes cluster scan detection
Cloud Service Discovery
Web Servers Executing Suspicious Processes
System Information Discovery
Detect attackers scanning for vulnerable JBoss servers
System Information Discovery