Windows Ldifde Directory Object Behavior
Ingress Tool Transfer, Domain Groups
Discovery
Network Share Discovery Via Dir Command
Network Share Discovery
Windows AdFind Exe
Remote System Discovery
Windows PowerView AD Access Control List Enumeration
Domain Accounts, Permission Groups Discovery
Windows Query Registry UnInstall Program List
Query Registry
Windows Query Registry Browser List Application
Query Registry
Windows PowerView AD Access Control List Enumeration
Domain Accounts, Permission Groups Discovery
AdsiSearcher Account Discovery
Domain Account, Account Discovery
AdsiSearcher Account Discovery
Domain Account, Account Discovery
Ping Sleep Batch Command
Virtualization/Sandbox Evasion, Time Based Evasion
Ping Sleep Batch Command
Virtualization/Sandbox Evasion, Time Based Evasion
Windows Root Domain linked policies Discovery
Domain Account, Account Discovery
Windows Root Domain linked policies Discovery
Domain Account, Account Discovery
Linux System Network Discovery
System Network Configuration Discovery
Windows Linked Policies In ADSI Discovery
Domain Account, Account Discovery
Windows Linked Policies In ADSI Discovery
Domain Account, Account Discovery
GetWmiObject User Account with PowerShell
Account Discovery, Local Account
GetWmiObject User Account with PowerShell
Account Discovery, Local Account
System User Discovery With Whoami
System Owner/User Discovery
GetWmiObject User Account with PowerShell Script Block
Account Discovery, Local Account, PowerShell
GetWmiObject User Account with PowerShell Script Block
Account Discovery, Local Account, PowerShell
Windows Special Privileged Logon On Multiple Hosts
Account Discovery, SMB/Windows Admin Shares, Network Share Discovery
Windows Special Privileged Logon On Multiple Hosts
Account Discovery, SMB/Windows Admin Shares, Network Share Discovery
Windows Administrative Shares Accessed On Multiple Hosts
Network Share Discovery
Windows File Share Discovery With Powerview
Network Share Discovery
Windows Large Number of Computer Service Tickets Requested
Network Share Discovery, Valid Accounts
Okta Multiple Failed Requests to Access Applications
Web Session Cookie, Cloud Service Dashboard
AWS High Number Of Failed Authentications For User
Password Policy Discovery
AWS Password Policy Changes
Password Policy Discovery
Account Discovery With Net App
Domain Account, Account Discovery
Account Discovery With Net App
Domain Account, Account Discovery
Windows Modify Registry Reg Restore
Query Registry
Windows Query Registry Reg Save
Query Registry
Windows System Network Config Discovery Display DNS
System Network Configuration Discovery
Windows System Network Connections Discovery Netsh
System Network Connections Discovery
Windows Information Discovery Fsutil
System Information Discovery
Windows System User Discovery Via Quser
System Owner/User Discovery
Get DomainUser with PowerShell Script Block
Domain Account, Account Discovery
Get DomainUser with PowerShell Script Block
Domain Account, Account Discovery
Windows System Discovery Using Qwinsta
System Owner/User Discovery
Windows System Discovery Using ldap Nslookup
System Owner/User Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Get ADUser with PowerShell Script Block
Domain Account, Account Discovery
Get ADUser with PowerShell Script Block
Domain Account, Account Discovery
Splunk Account Discovery Drilldown Dashboard Disclosure
Account Discovery
Windows System Time Discovery W32tm Delay
System Time Discovery
Linux Kernel Module Enumeration
System Information Discovery, Rootkit
Remote System Discovery with Adsisearcher
Remote System Discovery
Splunk Identified SSL TLS Certificates
Network Sniffing
GetWmiObject DS User with PowerShell Script Block
Domain Account, Account Discovery
GetWmiObject DS User with PowerShell Script Block
Domain Account, Account Discovery
GetDomainComputer with PowerShell Script Block
Remote System Discovery
GetAdComputer with PowerShell Script Block
Remote System Discovery
Get DomainPolicy with Powershell Script Block
Password Policy Discovery
Get-DomainTrust with PowerShell Script Block
Domain Trust Discovery
Get ADUserResultantPasswordPolicy with Powershell Script Block
Password Policy Discovery
GetWmiObject Ds Group with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetWmiObject Ds Group with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetDomainController with PowerShell Script Block
Remote System Discovery
GetWmiObject Ds Computer with PowerShell Script Block
Remote System Discovery
GetDomainGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetDomainGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
Path traversal SPL injection
File and Directory Discovery
Powershell Get LocalGroup Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
Powershell Get LocalGroup Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
NLTest Domain Trust Discovery
Domain Trust Discovery
GetNetTcpconnection with PowerShell Script Block
System Network Connections Discovery
Windows PowerView Constrained Delegation Discovery
Remote System Discovery
Windows PowerView Unconstrained Delegation Discovery
Remote System Discovery
Windows Get-AdComputer Unconstrained Delegation Discovery
Remote System Discovery
GetAdGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell Script Block
Permission Groups Discovery, Domain Groups
GetCurrent User with PowerShell Script Block
System Owner/User Discovery
User Discovery With Env Vars PowerShell Script Block
System Owner/User Discovery
Get WMIObject Group Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery with Script Block Logging
Permission Groups Discovery, Local Groups
GetLocalUser with PowerShell Script Block
Account Discovery, Local Account, PowerShell
GetLocalUser with PowerShell Script Block
Account Discovery, Local Account, PowerShell
Get ADDefaultDomainPasswordPolicy with Powershell Script Block
Password Policy Discovery
Get-ForestTrust with PowerShell Script Block
Domain Trust Discovery, PowerShell
Network Discovery Using Route Windows App
System Network Configuration Discovery, Internet Connection Discovery
Network Discovery Using Route Windows App
System Network Configuration Discovery, Internet Connection Discovery
AWS IAM AccessDenied Discovery Events
Cloud Infrastructure Discovery
Local Account Discovery with Net
Account Discovery, Local Account
Local Account Discovery with Net
Account Discovery, Local Account
Local Account Discovery With Wmic
Account Discovery, Local Account
Local Account Discovery With Wmic
Account Discovery, Local Account
Check Elevated CMD using whoami
System Owner/User Discovery
PowerShell Get LocalGroup Discovery
Permission Groups Discovery, Local Groups
PowerShell Get LocalGroup Discovery
Permission Groups Discovery, Local Groups
Wmic Group Discovery
Permission Groups Discovery, Local Groups
Wmic Group Discovery
Permission Groups Discovery, Local Groups
Net Localgroup Discovery
Permission Groups Discovery, Local Groups
Net Localgroup Discovery
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery
Permission Groups Discovery, Local Groups
Get WMIObject Group Discovery
Permission Groups Discovery, Local Groups
System User Discovery With Query
System Owner/User Discovery
GetCurrent User with PowerShell
System Owner/User Discovery
User Discovery With Env Vars PowerShell
System Owner/User Discovery
Network Connection Discovery With Arp
System Network Connections Discovery
Network Connection Discovery With Net
System Network Connections Discovery
Network Connection Discovery With Netstat
System Network Connections Discovery
GetDomainComputer with PowerShell
Remote System Discovery
GetAdComputer with PowerShell
Remote System Discovery
SchCache Change By App Connect And Create ADSI Object
Domain Account, Account Discovery
SchCache Change By App Connect And Create ADSI Object
Domain Account, Account Discovery
System Information Discovery Detection
System Information Discovery
GetDomainController with PowerShell
Remote System Discovery
GetWmiObject Ds Computer with PowerShell
Remote System Discovery
Get-ForestTrust with PowerShell
Domain Trust Discovery
Domain Group Discovery With Dsquery
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Dsquery
Permission Groups Discovery, Domain Groups
Remote System Discovery with Wmic
Remote System Discovery
Domain Controller Discovery with Wmic
Remote System Discovery
Remote System Discovery with Dsquery
Remote System Discovery
Remote System Discovery with Net
Remote System Discovery
Domain Controller Discovery with Nltest
Remote System Discovery
Get DomainPolicy with Powershell
Password Policy Discovery
Get ADUserResultantPasswordPolicy with Powershell
Password Policy Discovery
Get ADDefaultDomainPasswordPolicy with Powershell
Password Policy Discovery
Password Policy Discovery with Net
Password Policy Discovery
Domain Group Discovery With Net
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Net
Permission Groups Discovery, Domain Groups
GetNetTcpconnection with PowerShell
System Network Connections Discovery
GetWmiObject Ds Group with PowerShell
Permission Groups Discovery, Domain Groups
GetWmiObject Ds Group with PowerShell
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Domain Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Net
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Net
Permission Groups Discovery, Domain Groups
GetDomainGroup with PowerShell
Permission Groups Discovery, Domain Groups
GetDomainGroup with PowerShell
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell
Permission Groups Discovery, Domain Groups
GetAdGroup with PowerShell
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Elevated Group Discovery With Wmic
Permission Groups Discovery, Domain Groups
Elevated Group Discovery with PowerView
Permission Groups Discovery, Domain Groups
Elevated Group Discovery with PowerView
Permission Groups Discovery, Domain Groups
Domain Group Discovery with Adsisearcher
Permission Groups Discovery, Domain Groups
Domain Group Discovery with Adsisearcher
Permission Groups Discovery, Domain Groups
Domain Account Discovery with Dsquery
Domain Account, Account Discovery
Domain Account Discovery with Dsquery
Domain Account, Account Discovery
Get DomainUser with PowerShell
Domain Account, Account Discovery
Get DomainUser with PowerShell
Domain Account, Account Discovery
Domain Account Discovery With Net App
Domain Account, Account Discovery
Domain Account Discovery With Net App
Domain Account, Account Discovery
Get-DomainTrust with PowerShell
Domain Trust Discovery
Kubernetes Scanner Image Pulling
Cloud Service Discovery
Domain Account Discovery with Wmic
Domain Account, Account Discovery
Domain Account Discovery with Wmic
Domain Account, Account Discovery
GetWmiObject DS User with PowerShell
Domain Account, Account Discovery
GetWmiObject DS User with PowerShell
Domain Account, Account Discovery
Get ADUser with PowerShell
Domain Account, Account Discovery
Get ADUser with PowerShell
Domain Account, Account Discovery
GetLocalUser with PowerShell
Account Discovery, Local Account
GetLocalUser with PowerShell
Account Discovery, Local Account
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound Command-Line Arguments
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect AzureHound File Modifications
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Detect SharpHound Usage
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Enumerate Users Local Group Using Telegram
Account Discovery
AWS Excessive Security Scanning
Cloud Service Discovery
AWS IAM Assume Role Policy Brute Force
Cloud Infrastructure Discovery, Brute Force
AWS IAM Successful Group Deletion
Cloud Groups, Account Manipulation, Permission Groups Discovery
AWS IAM Successful Group Deletion
Cloud Groups, Account Manipulation, Permission Groups Discovery
DSQuery Domain Discovery
Domain Trust Discovery
Detect processes used for System Network Configuration Discovery
System Network Configuration Discovery
GCP Kubernetes cluster pod scan detection
Cloud Service Discovery
Kubernetes Azure scan fingerprint
Cloud Service Discovery
Amazon EKS Kubernetes Pod scan detection
Cloud Service Discovery
GCP Kubernetes cluster scan detection
Cloud Service Discovery
Amazon EKS Kubernetes cluster scan detection
Cloud Service Discovery
Web Servers Executing Suspicious Processes
System Information Discovery
Detect attackers scanning for vulnerable JBoss servers
System Information Discovery