GitHub Repo

Reconnaissance Detections

Name Data Source Technique Type Analytic Story Date
Windows Gather Victim Identity SAM Info Sysmon EventID 7 T1589.001 Hunting Brute Ratel C4 2026-05-13
Recon Using WMI Class Powershell Script Block Logging 4104 T1059.001 T1592 Anomaly Data Destruction, Quasar RAT, Malicious Inno Setup Loader, Scattered Spider, Industroyer2, Malicious PowerShell, Qakbot, MoonPeak, LockBit Ransomware, Hermetic Wiper, Axios Supply Chain Post Compromise, VIP Keylogger, AsyncRAT, BlankGrabber Stealer 2026-05-13
Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco Network Visibility Module Flow Data T1016 T1590.005 Anomaly Cisco Network Visibility Module Analytics, Castle RAT, BlankGrabber Stealer 2026-05-13
System Info Gathering Using Dxdiag Application Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1592 Hunting Remcos 2026-05-13
Recon AVProduct Through Pwh or WMI Powershell Script Block Logging 4104 T1592 TTP Quasar RAT, Data Destruction, XWorm, Malicious PowerShell, Qakbot, MoonPeak, Windows Post-Exploitation, Prestige Ransomware, Hermetic Wiper, Ransomware 2026-05-13
WMI Recon Running Process Or Services Powershell Script Block Logging 4104 T1592 Anomaly Hermetic Wiper, Data Destruction, Malicious PowerShell 2026-05-13
Kerberos User Enumeration Windows Event Log Security 4768 T1589.002 Anomaly Active Directory Kerberos Attacks 2026-05-13
Windows Gather Victim Host Information Camera Powershell Script Block Logging 4104 T1592.001 Anomaly DarkCrystal RAT 2026-05-13
Windows DNS Gather Network Info Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1590.002 Anomaly Sandworm Tools, Volt Typhoon 2026-05-13
Windows Detect Network Scanner Behavior Sysmon EventID 3 T1595.001 T1595.002 Anomaly Network Discovery, Windows Discovery Techniques 2026-05-13
Attacker Tools On Endpoint Sysmon EventID 1, Cisco Network Visibility Module Flow Data, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1003 T1036.005 T1595 TTP PHP-CGI RCE Attack on Japanese Organizations, SamSam Ransomware, Scattered Spider, CISA AA22-264A, Cisco Network Visibility Module Analytics, Unusual Processes, Compromised Windows Host, XMRig 2026-07-01
Windows Netspy Network Scanner Execution Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1018 T1595 Anomaly Network Discovery, Windows Discovery Techniques 2026-05-13
Windows WinPEAS PowerShell Script Execution Powershell Script Block Logging 4104 T1007 T1016 T1033 T1082 T1590 T1592.002 T1592.004 T1615 TTP Windows Post-Exploitation 2026-05-13
Local LLM Framework DNS Query Sysmon EventID 22 T1590 Hunting Suspicious Local LLM Frameworks 2026-05-13
Linux Medusa Rootkit Sysmon for Linux EventID 11 T1014 T1589.001 TTP Medusa Rootkit, Hellcat Ransomware, VoidLink Cloud-Native Linux Malware, China-Nexus Threat Activity 2026-05-13
Windows RDP File Execution Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1021.001 T1598.002 TTP Windows RDP Artifacts and Defense Evasion, Spearphishing Attachments, Interlock Ransomware 2026-05-13
HTTP Rapid POST with Mixed Status Codes Nginx Access T1071.001 T1190 T1595 Anomaly HTTP Request Smuggling 2026-05-13
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication Cisco SD-WAN Auth Log T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-06-09
Cisco ASA - Reconnaissance Command Activity Cisco ASA Logs T1082 T1590.001 T1590.005 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco IOS XE Reconnaissance Command Activity Cisco IOS Logs T1016 T1082 T1590 Anomaly Salt Typhoon 2026-05-20
Cisco SD-WAN Multiple SSH key Authentication from Same Source Cisco SD-WAN Auth Log T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-06-09
Ollama Possible API Endpoint Scan Reconnaissance Ollama Server T1595 Anomaly Suspicious Ollama Activities 2026-05-13
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors Cisco Secure Access Proxy T1595 Anomaly Cisco Secure Access Analytics 2026-06-09
Wermgr Process Connecting To IP Check Web Services Sysmon EventID 22 T1590.005 TTP Trickbot 2026-05-13
Cisco Secure Firewall - Blocked Connection Cisco Secure Firewall Threat Defense Connection Event T1018 T1046 T1110 T1203 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Repeated Blocked Connections Cisco Secure Firewall Threat Defense Connection Event T1018 T1046 T1110 T1203 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Internal Vulnerability Scan T1046 T1595.002 TTP Network Discovery, Scattered Lapsus$ Hunters 2026-05-13
Cisco Secure Firewall - Rare Snort Rule Triggered Cisco Secure Firewall Threat Defense Intrusion Event T1583.006 T1598 Hunting Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Windows Gather Victim Network Info Through Ip Check Web Services Sysmon EventID 22 T1590.005 Anomaly Snake Keylogger, Handala Wiper, Quasar RAT, Void Manticore, Phemedrone Stealer, DarkCrystal RAT, Castle RAT, Water Gamayun, PXA Stealer, Meduza Stealer, Azorult, 0bj3ctivity Stealer, VIP Keylogger, BlankGrabber Stealer 2026-05-13
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity Cisco SD-WAN Service Proxy Access Logs T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-05-13
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1071 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13