CrushFTP Server Side Template Injection
|
CrushFTP
|
Exploit Public-Facing Application
|
TTP
|
CrushFTP Vulnerabilities
|
2024-09-30
|
Detect New Login Attempts to Routers
|
|
N/A
|
TTP
|
Router and Infrastructure Security
|
2024-10-17
|
Detect Risky SPL using Pretrained ML Model
|
|
Command and Scripting Interpreter
|
Anomaly
|
Splunk Vulnerabilities
|
2024-10-17
|
Email Attachments With Lots Of Spaces
|
|
N/A
|
Anomaly
|
Data Destruction, Emotet Malware DHS Report TA18-201A, Hermetic Wiper, Suspicious Emails
|
2024-10-17
|
Email servers sending high volume traffic to hosts
|
|
Email Collection
Remote Email Collection
|
Anomaly
|
Collection and Staging, HAFNIUM Group
|
2024-10-17
|
Ivanti VTM New Account Creation
|
Ivanti VTM Audit
|
Exploit Public-Facing Application
|
TTP
|
Ivanti Virtual Traffic Manager CVE-2024-7593
|
2024-09-30
|
Monitor Email For Brand Abuse
|
|
N/A
|
TTP
|
Brand Monitoring, Suspicious Emails
|
2024-10-17
|
Okta Authentication Failed During MFA Challenge
|
Okta
|
Compromise Accounts
Cloud Accounts
Valid Accounts
Cloud Accounts
Multi-Factor Authentication Request Generation
|
TTP
|
Okta Account Takeover
|
2024-09-30
|
Okta IDP Lifecycle Modifications
|
Okta
|
Cloud Account
|
Anomaly
|
Suspicious Okta Activity
|
2024-09-30
|
Okta MFA Exhaustion Hunt
|
Okta
|
Brute Force
|
Hunting
|
Okta Account Takeover, Okta MFA Exhaustion
|
2024-10-17
|
Okta Mismatch Between Source and Response for Verify Push Request
|
Okta
|
Multi-Factor Authentication Request Generation
|
TTP
|
Okta Account Takeover, Okta MFA Exhaustion
|
2024-11-19
|
Okta Multi-Factor Authentication Disabled
|
Okta
|
Modify Authentication Process
Multi-Factor Authentication
|
TTP
|
Okta Account Takeover
|
2024-09-30
|
Okta Multiple Accounts Locked Out
|
Okta
|
Brute Force
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
Okta Multiple Failed MFA Requests For User
|
Okta
|
Multi-Factor Authentication Request Generation
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
Okta Multiple Failed Requests to Access Applications
|
Okta
|
Web Session Cookie
Cloud Service Dashboard
|
Hunting
|
Okta Account Takeover
|
2024-10-17
|
Okta Multiple Users Failing To Authenticate From Ip
|
Okta
|
Password Spraying
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
Okta New API Token Created
|
Okta
|
Valid Accounts
Default Accounts
|
TTP
|
Okta Account Takeover
|
2024-09-30
|
Okta New Device Enrolled on Account
|
Okta
|
Account Manipulation
Device Registration
|
TTP
|
Okta Account Takeover
|
2024-09-30
|
Okta Phishing Detection with FastPass Origin Check
|
Okta
|
Valid Accounts
Default Accounts
Modify Authentication Process
|
TTP
|
Okta Account Takeover
|
2024-10-17
|
Okta Risk Threshold Exceeded
|
Okta
|
Valid Accounts
Brute Force
|
Correlation
|
Okta Account Takeover, Okta MFA Exhaustion, Suspicious Okta Activity
|
2024-09-30
|
Okta Successful Single Factor Authentication
|
Okta
|
Compromise Accounts
Cloud Accounts
Valid Accounts
Cloud Accounts
Multi-Factor Authentication Request Generation
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
Okta Suspicious Activity Reported
|
Okta
|
Valid Accounts
Default Accounts
|
TTP
|
Okta Account Takeover
|
2024-09-30
|
Okta Suspicious Use of a Session Cookie
|
Okta
|
Steal Web Session Cookie
|
Anomaly
|
Okta Account Takeover, Suspicious Okta Activity
|
2024-09-30
|
Okta ThreatInsight Threat Detected
|
Okta
|
Valid Accounts
Cloud Accounts
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
Okta Unauthorized Access to Application
|
Okta
|
Cloud Account
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
Okta User Logins from Multiple Cities
|
Okta
|
Cloud Accounts
|
Anomaly
|
Okta Account Takeover
|
2024-09-30
|
PingID Mismatch Auth Source and Verification Response
|
PingID
|
Multi-Factor Authentication Request Generation
Multi-Factor Authentication
Device Registration
|
TTP
|
Compromised User Account
|
2024-09-30
|
PingID Multiple Failed MFA Requests For User
|
PingID
|
Multi-Factor Authentication Request Generation
Valid Accounts
Brute Force
|
TTP
|
Compromised User Account
|
2024-09-30
|
PingID New MFA Method After Credential Reset
|
PingID
|
Multi-Factor Authentication Request Generation
Multi-Factor Authentication
Device Registration
|
TTP
|
Compromised User Account
|
2024-09-30
|
PingID New MFA Method Registered For User
|
PingID
|
Multi-Factor Authentication Request Generation
Multi-Factor Authentication
Device Registration
|
TTP
|
Compromised User Account
|
2024-09-30
|
Suspicious Email Attachment Extensions
|
|
Spearphishing Attachment
Phishing
|
Anomaly
|
Data Destruction, Emotet Malware DHS Report TA18-201A, Hermetic Wiper, Suspicious Emails
|
2024-10-17
|
Suspicious Java Classes
|
|
N/A
|
Anomaly
|
Apache Struts Vulnerability
|
2024-10-17
|
Circle CI Disable Security Job
|
CircleCI
|
Compromise Host Software Binary
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Circle CI Disable Security Step
|
CircleCI
|
Compromise Host Software Binary
|
Anomaly
|
Dev Sec Ops
|
2024-10-17
|
Detect S3 access from a new IP
|
|
Data from Cloud Storage
|
Anomaly
|
Suspicious AWS S3 Activities
|
2024-10-17
|
Gdrive suspicious file sharing
|
|
Phishing
|
Hunting
|
Data Exfiltration, Spearphishing Attachments
|
2024-10-17
|
GitHub Actions Disable Security Workflow
|
GitHub
|
Compromise Software Supply Chain
Supply Chain Compromise
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Github Commit Changes In Master
|
GitHub
|
Trusted Relationship
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Github Commit In Develop
|
GitHub
|
Trusted Relationship
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
GitHub Dependabot Alert
|
GitHub
|
Compromise Software Dependencies and Development Tools
Supply Chain Compromise
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
GitHub Pull Request from Unknown User
|
GitHub
|
Compromise Software Dependencies and Development Tools
Supply Chain Compromise
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Gsuite Drive Share In External Email
|
G Suite Drive
|
Exfiltration to Cloud Storage
Exfiltration Over Web Service
|
Anomaly
|
Dev Sec Ops, Insider Threat
|
2024-10-17
|
GSuite Email Suspicious Attachment
|
G Suite Gmail
|
Spearphishing Attachment
Phishing
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Gsuite Email Suspicious Subject With Attachment
|
G Suite Gmail
|
Spearphishing Attachment
Phishing
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Gsuite Email With Known Abuse Web Service Link
|
G Suite Gmail
|
Spearphishing Attachment
Phishing
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
Gsuite Outbound Email With Attachment To External Domain
|
G Suite Gmail
|
Exfiltration Over Unencrypted Non-C2 Protocol
Exfiltration Over Alternative Protocol
|
Hunting
|
Dev Sec Ops, Insider Threat
|
2024-10-17
|
Gsuite suspicious calendar invite
|
|
Phishing
|
Hunting
|
Spearphishing Attachments
|
2024-10-17
|
Gsuite Suspicious Shared File Name
|
G Suite Drive
|
Spearphishing Attachment
Phishing
|
Anomaly
|
Dev Sec Ops
|
2024-09-30
|
High Number of Login Failures from a single source
|
O365 UserLoginFailed
|
Password Guessing
Brute Force
|
Anomaly
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Add App Role Assignment Grant User
|
O365 Add app role assignment grant to user.
|
Cloud Account
Create Account
|
TTP
|
Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Added Service Principal
|
O365
|
Cloud Account
Create Account
|
TTP
|
Cloud Federated Credential Abuse, NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Admin Consent Bypassed by Service Principal
|
O365 Add app role assignment to service principal.
|
Additional Cloud Roles
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Advanced Audit Disabled
|
O365 Change user license.
|
Impair Defenses
Disable or Modify Cloud Logs
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Application Available To Other Tenants
|
|
Additional Cloud Roles
Account Manipulation
|
TTP
|
Azure Active Directory Account Takeover, Azure Active Directory Persistence, Data Exfiltration
|
2024-09-30
|
O365 Application Registration Owner Added
|
O365 Add owner to application.
|
Account Manipulation
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 ApplicationImpersonation Role Assigned
|
O365
|
Account Manipulation
Additional Email Delegate Permissions
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Block User Consent For Risky Apps Disabled
|
O365 Update authorization policy.
|
Impair Defenses
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Bypass MFA via Trusted IP
|
O365 Set Company Information.
|
Disable or Modify Cloud Firewall
Impair Defenses
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Compliance Content Search Exported
|
|
Email Collection
Remote Email Collection
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 Compliance Content Search Started
|
|
Email Collection
Remote Email Collection
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 Concurrent Sessions From Different Ips
|
O365 UserLoggedIn
|
Browser Session Hijacking
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Cross-Tenant Access Change
|
|
Trust Modification
|
TTP
|
Azure Active Directory Persistence
|
2024-09-30
|
O365 Disable MFA
|
O365 Disable Strong Authentication.
|
Modify Authentication Process
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 DLP Rule Triggered
|
|
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service
|
Anomaly
|
Data Exfiltration
|
2024-09-30
|
O365 Elevated Mailbox Permission Assigned
|
|
Account Manipulation
Additional Email Delegate Permissions
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 Email Access By Security Administrator
|
|
Exfiltration Over Web Service
Email Collection
Remote Email Collection
|
TTP
|
Azure Active Directory Account Takeover, Data Exfiltration, Office 365 Account Takeover
|
2024-09-30
|
O365 Email Reported By Admin Found Malicious
|
|
Phishing
Spearphishing Attachment
Spearphishing Link
|
TTP
|
Spearphishing Attachments, Suspicious Emails
|
2024-09-30
|
O365 Email Reported By User Found Malicious
|
|
Phishing
Spearphishing Attachment
Spearphishing Link
|
TTP
|
Spearphishing Attachments, Suspicious Emails
|
2024-09-30
|
O365 Email Security Feature Changed
|
|
Impair Defenses
Disable or Modify Cloud Logs
Disable or Modify Tools
|
TTP
|
Office 365 Account Takeover, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Email Suspicious Behavior Alert
|
|
Email Collection
Email Forwarding Rule
|
TTP
|
Office 365 Account Takeover, Office 365 Collection Techniques, Suspicious Emails
|
2024-09-30
|
O365 Excessive Authentication Failures Alert
|
|
Brute Force
|
Anomaly
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Excessive SSO logon errors
|
O365 UserLoginFailed
|
Modify Authentication Process
|
Anomaly
|
Cloud Federated Credential Abuse, Office 365 Account Takeover
|
2024-09-30
|
O365 External Guest User Invited
|
|
Cloud Account
|
TTP
|
Azure Active Directory Persistence
|
2024-09-30
|
O365 External Identity Policy Changed
|
|
Cloud Account
|
TTP
|
Azure Active Directory Persistence
|
2024-09-30
|
O365 File Permissioned Application Consent Granted by User
|
O365 Consent to application.
|
Steal Application Access Token
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 FullAccessAsApp Permission Assigned
|
O365 Update application.
|
Additional Email Delegate Permissions
Additional Cloud Roles
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 High Number Of Failed Authentications for User
|
O365 UserLoginFailed
|
Brute Force
Password Guessing
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 High Privilege Role Granted
|
O365 Add member to role.
|
Account Manipulation
Additional Cloud Roles
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Mail Permissioned Application Consent Granted by User
|
O365 Consent to application.
|
Steal Application Access Token
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Mailbox Email Forwarding Enabled
|
|
Email Collection
Email Forwarding Rule
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 Mailbox Folder Read Permission Assigned
|
|
Account Manipulation
Additional Email Delegate Permissions
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 Mailbox Folder Read Permission Granted
|
|
Account Manipulation
Additional Email Delegate Permissions
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 Mailbox Inbox Folder Shared with All Users
|
O365 ModifyFolderPermissions
|
Email Collection
Remote Email Collection
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Mailbox Read Access Granted to Application
|
O365 Update application.
|
Remote Email Collection
Email Collection
Account Manipulation
Additional Cloud Roles
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Multi-Source Failed Authentications Spike
|
O365 UserLoginFailed
|
Compromise Accounts
Cloud Accounts
Brute Force
Password Spraying
Credential Stuffing
|
Hunting
|
NOBELIUM Group, Office 365 Account Takeover
|
2024-10-17
|
O365 Multiple AppIDs and UserAgents Authentication Spike
|
O365 UserLoggedIn, O365 UserLoginFailed
|
Valid Accounts
|
Anomaly
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Multiple Failed MFA Requests For User
|
O365 UserLoginFailed
|
Multi-Factor Authentication Request Generation
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Multiple Mailboxes Accessed via API
|
O365 MailItemsAccessed
|
Remote Email Collection
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques
|
2024-09-30
|
O365 Multiple Service Principals Created by SP
|
O365 Add service principal.
|
Cloud Account
|
Anomaly
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Multiple Service Principals Created by User
|
O365 Add service principal.
|
Cloud Account
|
Anomaly
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Multiple Users Failing To Authenticate From Ip
|
O365 UserLoginFailed
|
Compromise Accounts
Cloud Accounts
Brute Force
Password Spraying
Credential Stuffing
|
TTP
|
NOBELIUM Group, Office 365 Account Takeover
|
2024-09-30
|
O365 New Email Forwarding Rule Created
|
|
Email Collection
Email Forwarding Rule
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 New Email Forwarding Rule Enabled
|
|
Email Collection
Email Forwarding Rule
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 New Federated Domain Added
|
O365
|
Cloud Account
Create Account
|
TTP
|
Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 New Forwarding Mailflow Rule Created
|
|
Email Collection
|
TTP
|
Office 365 Collection Techniques
|
2024-09-30
|
O365 New MFA Method Registered
|
O365 Update user.
|
Account Manipulation
Device Registration
|
TTP
|
Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 OAuth App Mailbox Access via EWS
|
O365 MailItemsAccessed
|
Remote Email Collection
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques
|
2024-09-30
|
O365 OAuth App Mailbox Access via Graph API
|
O365 MailItemsAccessed
|
Remote Email Collection
|
TTP
|
NOBELIUM Group, Office 365 Collection Techniques
|
2024-09-30
|
O365 Privileged Graph API Permission Assigned
|
O365 Update application.
|
Security Account Manager
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Privileged Role Assigned
|
|
Account Manipulation
Additional Cloud Roles
|
TTP
|
Azure Active Directory Persistence
|
2024-09-30
|
O365 Privileged Role Assigned To Service Principal
|
|
Account Manipulation
Additional Cloud Roles
|
TTP
|
Azure Active Directory Privilege Escalation
|
2024-09-30
|
O365 PST export alert
|
O365
|
Email Collection
|
TTP
|
Data Exfiltration, Office 365 Collection Techniques
|
2024-09-30
|
O365 Safe Links Detection
|
|
Phishing
Spearphishing Attachment
|
TTP
|
Office 365 Account Takeover, Spearphishing Attachments
|
2024-09-30
|
O365 Security And Compliance Alert Triggered
|
|
Valid Accounts
Cloud Accounts
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 Service Principal New Client Credentials
|
O365
|
Account Manipulation
Additional Cloud Credentials
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 SharePoint Allowed Domains Policy Changed
|
|
Cloud Account
|
TTP
|
Azure Active Directory Persistence
|
2024-09-30
|
O365 SharePoint Malware Detection
|
|
Malicious File
User Execution
|
TTP
|
Azure Active Directory Persistence, Office 365 Account Takeover, Ransomware Cloud
|
2024-09-30
|
O365 Tenant Wide Admin Consent Granted
|
O365 Consent to application.
|
Account Manipulation
Additional Cloud Roles
|
TTP
|
NOBELIUM Group, Office 365 Persistence Mechanisms
|
2024-09-30
|
O365 Threat Intelligence Suspicious Email Delivered
|
|
Phishing
Spearphishing Attachment
Spearphishing Link
|
Anomaly
|
Spearphishing Attachments, Suspicious Emails
|
2024-09-30
|
O365 Threat Intelligence Suspicious File Detected
|
|
Malicious File
User Execution
|
TTP
|
Azure Active Directory Account Takeover, Office 365 Account Takeover, Ransomware Cloud
|
2024-09-30
|
O365 User Consent Blocked for Risky Application
|
O365 Consent to application.
|
Steal Application Access Token
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 User Consent Denied for OAuth Application
|
O365
|
Steal Application Access Token
|
TTP
|
Office 365 Account Takeover
|
2024-09-30
|
O365 ZAP Activity Detection
|
|
Phishing
Spearphishing Attachment
Spearphishing Link
|
Anomaly
|
Spearphishing Attachments, Suspicious Emails
|
2024-09-30
|
Risk Rule for Dev Sec Ops by Repository
|
|
Malicious Image
User Execution
|
Correlation
|
Dev Sec Ops
|
2024-10-22
|
Clients Connecting to Multiple DNS Servers
|
|
Exfiltration Over Unencrypted Non-C2 Protocol
|
TTP
|
Command And Control, DNS Hijacking, Host Redirection, Suspicious DNS Traffic
|
2024-10-17
|
Correlation by Repository and Risk
|
|
Malicious Image
User Execution
|
Correlation
|
Dev Sec Ops
|
2024-10-17
|
Correlation by User and Risk
|
|
Malicious Image
User Execution
|
Correlation
|
Dev Sec Ops
|
2024-10-17
|
Detect API activity from users without MFA
|
|
N/A
|
Hunting
|
AWS User Monitoring
|
2024-10-17
|
Detect DNS requests to Phishing Sites leveraging EvilGinx2
|
|
Spearphishing via Service
|
TTP
|
Common Phishing Frameworks
|
2024-10-17
|
Detect Long DNS TXT Record Response
|
|
Exfiltration Over Unencrypted Non-C2 Protocol
|
TTP
|
Command And Control, Suspicious DNS Traffic
|
2024-10-17
|
Detect new API calls from user roles
|
|
Cloud Accounts
|
Anomaly
|
AWS User Monitoring
|
2024-10-17
|
Detect Spike in Security Group Activity
|
|
Cloud Accounts
|
Anomaly
|
AWS User Monitoring
|
2024-10-17
|
Detect USB device insertion
|
|
N/A
|
TTP
|
Data Protection
|
2024-10-17
|
Detect web traffic to dynamic domain providers
|
|
Web Protocols
|
TTP
|
Dynamic DNS
|
2024-10-17
|
Detection of DNS Tunnels
|
|
Exfiltration Over Unencrypted Non-C2 Protocol
|
TTP
|
Command And Control, Data Protection, Suspicious DNS Traffic
|
2024-10-17
|
DNS Query Requests Resolved by Unauthorized DNS Servers
|
|
DNS
|
TTP
|
Command And Control, DNS Hijacking, Host Redirection, Suspicious DNS Traffic
|
2024-10-17
|
DNS record changed
|
|
DNS
|
TTP
|
DNS Hijacking
|
2024-10-17
|
EC2 Instance Modified With Previously Unseen User
|
|
Cloud Accounts
|
Anomaly
|
Unusual AWS EC2 Modifications
|
2024-10-17
|
EC2 Instance Started In Previously Unseen Region
|
|
Unused/Unsupported Cloud Regions
|
Anomaly
|
AWS Cryptomining, Suspicious AWS EC2 Activities
|
2024-10-17
|
EC2 Instance Started With Previously Unseen AMI
|
|
N/A
|
Anomaly
|
AWS Cryptomining
|
2024-10-17
|
EC2 Instance Started With Previously Unseen Instance Type
|
|
N/A
|
Anomaly
|
AWS Cryptomining
|
2024-10-17
|
EC2 Instance Started With Previously Unseen User
|
|
Cloud Accounts
|
Anomaly
|
AWS Cryptomining, Suspicious AWS EC2 Activities
|
2024-10-17
|
Extended Period Without Successful Netbackup Backups
|
|
N/A
|
Hunting
|
Monitor Backup Solution
|
2024-10-17
|
Identify New User Accounts
|
|
Domain Accounts
|
Hunting
|
N/A
|
2024-10-17
|
Monitor DNS For Brand Abuse
|
|
N/A
|
TTP
|
Brand Monitoring
|
2024-10-17
|
Multiple Okta Users With Invalid Credentials From The Same IP
|
|
Password Spraying
Valid Accounts
Default Accounts
|
TTP
|
Suspicious Okta Activity
|
2024-10-17
|
O365 Suspicious Admin Email Forwarding
|
|
Email Forwarding Rule
Email Collection
|
Anomaly
|
Data Exfiltration, Office 365 Collection Techniques
|
2024-10-17
|
O365 Suspicious Rights Delegation
|
|
Remote Email Collection
Email Collection
Additional Email Delegate Permissions
Account Manipulation
|
TTP
|
Office 365 Collection Techniques
|
2024-10-17
|
O365 Suspicious User Email Forwarding
|
|
Email Forwarding Rule
Email Collection
|
Anomaly
|
Data Exfiltration, Office 365 Collection Techniques
|
2024-10-17
|
Okta Account Locked Out
|
|
Brute Force
|
Anomaly
|
Okta MFA Exhaustion, Suspicious Okta Activity
|
2024-10-17
|
Okta Account Lockout Events
|
|
Valid Accounts
Default Accounts
|
Anomaly
|
Suspicious Okta Activity
|
2024-10-17
|
Okta Failed SSO Attempts
|
|
Valid Accounts
Default Accounts
|
Anomaly
|
Suspicious Okta Activity
|
2024-10-17
|
Okta ThreatInsight Login Failure with High Unknown users
|
|
Valid Accounts
Default Accounts
Credential Stuffing
|
TTP
|
Suspicious Okta Activity
|
2024-10-17
|
Okta ThreatInsight Suspected PasswordSpray Attack
|
|
Valid Accounts
Default Accounts
Password Spraying
|
TTP
|
Suspicious Okta Activity
|
2024-10-17
|
Okta Two or More Rejected Okta Pushes
|
|
Brute Force
|
TTP
|
Okta MFA Exhaustion, Suspicious Okta Activity
|
2024-10-17
|
Osquery pack - ColdRoot detection
|
|
N/A
|
TTP
|
ColdRoot MacOS RAT
|
2024-10-17
|
Spectre and Meltdown Vulnerable Systems
|
|
N/A
|
TTP
|
Spectre And Meltdown Vulnerabilities
|
2024-10-17
|
Suspicious Email - UBA Anomaly
|
|
Phishing
|
Anomaly
|
Suspicious Emails
|
2024-10-17
|
Unsuccessful Netbackup backups
|
|
N/A
|
Hunting
|
Monitor Backup Solution
|
2024-10-17
|
Web Fraud - Account Harvesting
|
|
Create Account
|
TTP
|
Web Fraud Detection
|
2024-10-17
|
Web Fraud - Anomalous User Clickspeed
|
|
Valid Accounts
|
Anomaly
|
Web Fraud Detection
|
2024-10-17
|
Web Fraud - Password Sharing Across Accounts
|
|
N/A
|
Anomaly
|
Web Fraud Detection
|
2024-10-17
|
Active Directory Lateral Movement Identified
|
|
Exploitation of Remote Services
|
Correlation
|
Active Directory Lateral Movement
|
2024-09-30
|
Active Directory Privilege Escalation Identified
|
|
Domain or Tenant Policy Modification
|
Correlation
|
Active Directory Privilege Escalation
|
2024-09-30
|
Crowdstrike Admin Weak Password Policy
|
|
Brute Force
|
TTP
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike Admin With Duplicate Password
|
|
Brute Force
|
TTP
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike High Identity Risk Severity
|
|
Brute Force
|
TTP
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike Medium Identity Risk Severity
|
|
Brute Force
|
TTP
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike Medium Severity Alert
|
|
Brute Force
|
Anomaly
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike Multiple LOW Severity Alerts
|
|
Brute Force
|
Anomaly
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike Privilege Escalation For Non-Admin User
|
|
Brute Force
|
Anomaly
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike User Weak Password Policy
|
|
Brute Force
|
Anomaly
|
Compromised Windows Host
|
2024-09-30
|
Crowdstrike User with Duplicate Password
|
|
Brute Force
|
Anomaly
|
Compromised Windows Host
|
2024-09-30
|
Detect Baron Samedit CVE-2021-3156
|
|
Exploitation for Privilege Escalation
|
TTP
|
Baron Samedit CVE-2021-3156
|
2024-10-17
|
Detect Baron Samedit CVE-2021-3156 Segfault
|
|
Exploitation for Privilege Escalation
|
TTP
|
Baron Samedit CVE-2021-3156
|
2024-10-17
|
Detect Baron Samedit CVE-2021-3156 via OSQuery
|
|
Exploitation for Privilege Escalation
|
TTP
|
Baron Samedit CVE-2021-3156
|
2024-10-17
|
Detect Excessive Account Lockouts From Endpoint
|
|
Valid Accounts
Domain Accounts
|
Anomaly
|
Active Directory Password Spraying
|
2024-09-30
|
Detect Excessive User Account Lockouts
|
|
Valid Accounts
Local Accounts
|
Anomaly
|
Active Directory Password Spraying
|
2024-09-30
|
Detect Password Spray Attack Behavior From Source
|
|
Password Spraying
Brute Force
|
TTP
|
Compromised User Account
|
2024-09-30
|
Detect Password Spray Attack Behavior On User
|
|
Password Spraying
Brute Force
|
TTP
|
Compromised User Account
|
2024-09-30
|
Living Off The Land Detection
|
|
Ingress Tool Transfer
Exploit Public-Facing Application
Command and Scripting Interpreter
External Remote Services
|
Correlation
|
Living Off The Land
|
2024-09-30
|
Log4Shell CVE-2021-44228 Exploitation
|
|
Ingress Tool Transfer
Exploit Public-Facing Application
Command and Scripting Interpreter
External Remote Services
|
Correlation
|
CISA AA22-320A, Log4Shell CVE-2021-44228
|
2024-09-30
|
Microsoft Defender ATP Alerts
|
MS Defender ATP Alerts
|
N/A
|
TTP
|
Critical Alerts
|
2024-10-30
|
Microsoft Defender Incident Alerts
|
MS365 Defender Incident Alerts
|
N/A
|
TTP
|
Critical Alerts
|
2024-10-30
|
MOVEit Certificate Store Access Failure
|
|
Exploit Public-Facing Application
|
Hunting
|
MOVEit Transfer Authentication Bypass
|
2024-10-17
|
MOVEit Empty Key Fingerprint Authentication Attempt
|
|
Exploit Public-Facing Application
|
Hunting
|
MOVEit Transfer Authentication Bypass
|
2024-10-17
|
PaperCut NG Suspicious Behavior Debug Log
|
|
Exploit Public-Facing Application
External Remote Services
|
Hunting
|
PaperCut MF NG Vulnerability
|
2024-10-17
|
Processes Tapping Keyboard Events
|
|
N/A
|
TTP
|
ColdRoot MacOS RAT
|
2024-10-17
|
Steal or Forge Authentication Certificates Behavior Identified
|
|
Steal or Forge Authentication Certificates
|
Correlation
|
Windows Certificate Services
|
2024-09-30
|
Suspicious PlistBuddy Usage via OSquery
|
|
Launch Agent
Create or Modify System Process
|
TTP
|
Silver Sparrow
|
2024-10-17
|
WMI Permanent Event Subscription
|
|
Windows Management Instrumentation
|
TTP
|
Suspicious WMI Use
|
2024-10-17
|
WMI Temporary Event Subscription
|
|
Windows Management Instrumentation
|
TTP
|
Suspicious WMI Use
|
2024-10-17
|
Detect ARP Poisoning
|
|
Hardware Additions
Network Denial of Service
Adversary-in-the-Middle
ARP Cache Poisoning
|
TTP
|
Router and Infrastructure Security
|
2024-10-17
|
Detect DGA domains using pretrained model in DSDL
|
|
Domain Generation Algorithms
|
Anomaly
|
Command And Control, DNS Hijacking, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic
|
2024-10-17
|
Detect DNS Data Exfiltration using pretrained model in DSDL
|
|
Exfiltration Over Unencrypted Non-C2 Protocol
|
Anomaly
|
Command And Control, DNS Hijacking, Suspicious DNS Traffic
|
2024-10-17
|
Detect Outbound LDAP Traffic
|
Bro
|
Exploit Public-Facing Application
Command and Scripting Interpreter
|
Hunting
|
Log4Shell CVE-2021-44228
|
2024-10-17
|
Detect Outbound SMB Traffic
|
|
File Transfer Protocols
Application Layer Protocol
|
TTP
|
DHS Report TA18-074A, Hidden Cobra Malware, NOBELIUM Group
|
2024-10-16
|
Detect Port Security Violation
|
|
Hardware Additions
Network Denial of Service
Adversary-in-the-Middle
ARP Cache Poisoning
|
TTP
|
Router and Infrastructure Security
|
2024-10-17
|
Detect Rogue DHCP Server
|
|
Hardware Additions
Network Denial of Service
Adversary-in-the-Middle
|
TTP
|
Router and Infrastructure Security
|
2024-10-17
|
Detect SNICat SNI Exfiltration
|
|
Exfiltration Over C2 Channel
|
TTP
|
Data Exfiltration
|
2024-10-17
|
Detect suspicious DNS TXT records using pretrained model in DSDL
|
|
Domain Generation Algorithms
|
Anomaly
|
Command And Control, DNS Hijacking, Suspicious DNS Traffic
|
2024-10-17
|
Detect Traffic Mirroring
|
|
Hardware Additions
Automated Exfiltration
Network Denial of Service
Traffic Duplication
|
TTP
|
Router and Infrastructure Security
|
2024-10-17
|
Detect Unauthorized Assets by MAC address
|
|
N/A
|
TTP
|
Asset Tracking
|
2024-10-17
|
Detect Zerologon via Zeek
|
|
Exploit Public-Facing Application
|
TTP
|
Detect Zerologon Attack, Rhysida Ransomware
|
2024-10-17
|
DNS Query Length Outliers - MLTK
|
|
DNS
Application Layer Protocol
|
Anomaly
|
Command And Control, Hidden Cobra Malware, Suspicious DNS Traffic
|
2024-10-17
|
Excessive DNS Failures
|
|
DNS
Application Layer Protocol
|
Anomaly
|
Command And Control, Suspicious DNS Traffic
|
2024-10-17
|
Internal Vulnerability Scan
|
|
Vulnerability Scanning
Network Service Discovery
|
TTP
|
Network Discovery
|
2024-10-17
|
Large Volume of DNS ANY Queries
|
|
Network Denial of Service
Reflection Amplification
|
Anomaly
|
DNS Amplification Attacks
|
2024-10-17
|
Protocol or Port Mismatch
|
|
Exfiltration Over Unencrypted Non-C2 Protocol
Exfiltration Over Alternative Protocol
|
Anomaly
|
Command And Control, Prohibited Traffic Allowed or Protocol Mismatch
|
2024-10-17
|
Protocols passing authentication in cleartext
|
|
N/A
|
TTP
|
Use of Cleartext Protocols
|
2024-10-17
|
SMB Traffic Spike
|
|
SMB/Windows Admin Shares
Remote Services
|
Anomaly
|
DHS Report TA18-074A, Emotet Malware DHS Report TA18-201A, Hidden Cobra Malware, Ransomware
|
2024-10-17
|
SMB Traffic Spike - MLTK
|
|
SMB/Windows Admin Shares
Remote Services
|
Anomaly
|
DHS Report TA18-074A, Emotet Malware DHS Report TA18-201A, Hidden Cobra Malware, Ransomware
|
2024-10-17
|
SSL Certificates with Punycode
|
|
Encrypted Channel
|
Hunting
|
OpenSSL CVE-2022-3602
|
2024-10-17
|
Zeek x509 Certificate with Punycode
|
|
Encrypted Channel
|
Hunting
|
OpenSSL CVE-2022-3602
|
2024-10-17
|
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities
|
2024-09-30
|
Adobe ColdFusion Access Control Bypass
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
|
2024-09-30
|
Adobe ColdFusion Unauthenticated Arbitrary File Read
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
|
2024-09-30
|
Cisco IOS XE Implant Access
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Cisco IOS XE Software Web Management User Interface vulnerability
|
2024-09-30
|
Citrix ADC and Gateway Unauthorized Data Disclosure
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966
|
2024-09-30
|
Citrix ShareFile Exploitation CVE-2023-24489
|
Suricata
|
Exploit Public-Facing Application
|
Hunting
|
Citrix ShareFile RCE CVE-2023-24489
|
2024-10-17
|
Confluence CVE-2023-22515 Trigger Vulnerability
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
|
2024-09-30
|
Confluence Data Center and Server Privilege Escalation
|
Nginx Access
|
Exploit Public-Facing Application
|
TTP
|
CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server, Confluence Data Center and Confluence Server Vulnerabilities
|
2024-09-30
|
Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Confluence Data Center and Confluence Server Vulnerabilities
|
2024-09-30
|
ConnectWise ScreenConnect Authentication Bypass
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
ConnectWise ScreenConnect Vulnerabilities
|
2024-09-30
|
Detect attackers scanning for vulnerable JBoss servers
|
|
System Information Discovery
External Remote Services
|
TTP
|
JBoss Vulnerability, SamSam Ransomware
|
2024-10-17
|
Detect F5 TMUI RCE CVE-2020-5902
|
|
Exploit Public-Facing Application
|
TTP
|
F5 TMUI RCE CVE-2020-5902
|
2024-10-17
|
Detect malicious requests to exploit JBoss servers
|
|
N/A
|
TTP
|
JBoss Vulnerability, SamSam Ransomware
|
2024-10-17
|
Exploit Public Facing Application via Apache Commons Text
|
Nginx Access
|
Web Shell
Server Software Component
Exploit Public-Facing Application
External Remote Services
|
Anomaly
|
Text4Shell CVE-2022-42889
|
2024-09-30
|
F5 TMUI Authentication Bypass
|
Suricata
|
N/A
|
TTP
|
F5 Authentication Bypass with TMUI
|
2024-09-30
|
High Volume of Bytes Out to Url
|
Nginx Access
|
Exfiltration Over Web Service
|
Anomaly
|
Data Exfiltration
|
2024-09-30
|
Hunting for Log4Shell
|
Nginx Access
|
Exploit Public-Facing Application
External Remote Services
|
Hunting
|
CISA AA22-320A, Log4Shell CVE-2021-44228
|
2024-10-17
|
Ivanti Connect Secure Command Injection Attempts
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities
|
2024-09-30
|
Ivanti Connect Secure SSRF in SAML Component
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Ivanti Connect Secure VPN Vulnerabilities
|
2024-09-30
|
Ivanti Connect Secure System Information Access via Auth Bypass
|
Suricata
|
Exploit Public-Facing Application
|
Anomaly
|
CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities
|
2024-09-30
|
Ivanti EPM SQL Injection Remote Code Execution
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Ivanti EPM Vulnerabilities
|
2024-09-30
|
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078
|
Suricata
|
Exploit Public-Facing Application
External Remote Services
|
TTP
|
Ivanti EPMM Remote Unauthenticated Access
|
2024-09-30
|
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082
|
Suricata
|
Exploit Public-Facing Application
External Remote Services
|
TTP
|
Ivanti EPMM Remote Unauthenticated Access
|
2024-09-30
|
Ivanti Sentry Authentication Bypass
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
Ivanti Sentry Authentication Bypass CVE-2023-38035
|
2024-09-30
|
Jenkins Arbitrary File Read CVE-2024-23897
|
Nginx Access
|
Exploit Public-Facing Application
|
TTP
|
Jenkins Server Vulnerabilities
|
2024-09-30
|
JetBrains TeamCity Authentication Bypass CVE-2024-27198
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
JetBrains TeamCity Vulnerabilities
|
2024-09-30
|
JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
JetBrains TeamCity Vulnerabilities
|
2024-09-30
|
JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
JetBrains TeamCity Vulnerabilities
|
2024-09-30
|
JetBrains TeamCity RCE Attempt
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
CISA AA23-347A, JetBrains TeamCity Unauthenticated RCE, JetBrains TeamCity Vulnerabilities
|
2024-09-30
|
Log4Shell JNDI Payload Injection Attempt
|
Nginx Access
|
Exploit Public-Facing Application
External Remote Services
|
Anomaly
|
CISA AA22-257A, CISA AA22-320A, Log4Shell CVE-2021-44228
|
2024-09-30
|
Log4Shell JNDI Payload Injection with Outbound Connection
|
|
Exploit Public-Facing Application
External Remote Services
|
Anomaly
|
CISA AA22-320A, Log4Shell CVE-2021-44228
|
2024-09-30
|
Microsoft SharePoint Server Elevation of Privilege
|
Suricata
|
Exploitation for Privilege Escalation
|
TTP
|
Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357
|
2024-09-30
|
Monitor Web Traffic For Brand Abuse
|
|
N/A
|
TTP
|
Brand Monitoring
|
2024-10-17
|
Nginx ConnectWise ScreenConnect Authentication Bypass
|
Nginx Access
|
Exploit Public-Facing Application
|
TTP
|
ConnectWise ScreenConnect Vulnerabilities
|
2024-09-30
|
PaperCut NG Remote Web Access Attempt
|
Suricata
|
Exploit Public-Facing Application
External Remote Services
|
TTP
|
PaperCut MF NG Vulnerability
|
2024-09-30
|
ProxyShell ProxyNotShell Behavior Detected
|
|
Exploit Public-Facing Application
External Remote Services
|
Correlation
|
BlackByte Ransomware, ProxyNotShell, ProxyShell
|
2024-09-30
|
Spring4Shell Payload URL Request
|
Nginx Access
|
Web Shell
Server Software Component
Exploit Public-Facing Application
External Remote Services
|
TTP
|
Spring4Shell CVE-2022-22965
|
2024-09-30
|
SQL Injection with Long URLs
|
|
Exploit Public-Facing Application
|
TTP
|
SQL Injection
|
2024-10-17
|
Supernova Webshell
|
|
Web Shell
External Remote Services
|
TTP
|
NOBELIUM Group
|
2024-10-17
|
Unusually Long Content-Type Length
|
|
N/A
|
Anomaly
|
Apache Struts Vulnerability
|
2024-10-17
|
Web JSP Request via URL
|
Nginx Access
|
Web Shell
Server Software Component
Exploit Public-Facing Application
External Remote Services
|
TTP
|
Spring4Shell CVE-2022-22965
|
2024-09-30
|
Web Remote ShellServlet Access
|
Nginx Access
|
Exploit Public-Facing Application
|
TTP
|
CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server
|
2024-09-30
|
WordPress Bricks Builder plugin RCE
|
Nginx Access
|
Exploit Public-Facing Application
|
TTP
|
WordPress Vulnerabilities
|
2024-09-30
|
WS FTP Remote Code Execution
|
Suricata
|
Exploit Public-Facing Application
|
TTP
|
WS FTP Server Critical Vulnerabilities
|
2024-09-30
|
Zscaler Adware Activities Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Behavior Analysis Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler CryptoMiner Downloaded Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Employment Search Web Activity
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Exploit Threat Blocked
|
|
Phishing
|
TTP
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Legal Liability Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Malware Activity Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Phishing Activity Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Potentially Abused File Download
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Privacy Risk Destinations Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Scam Destinations Threat Blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|
Zscaler Virus Download threat blocked
|
|
Phishing
|
Anomaly
|
Zscaler Browser Proxy Threats
|
2024-09-30
|