TOR Traffic
Proxy, Multi-hop Proxy
Network_Traffic
Detect Remote Access Software Usage Traffic
Remote Access Software
Protocol or Port Mismatch
Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol
Remote Desktop Network Traffic
Remote Desktop Protocol, Remote Services
SMB Traffic Spike
SMB/Windows Admin Shares, Remote Services
DLLHost with no Command Line Arguments with Network
Process Injection
Outbound Network Connection from Java Using Default Ports
Exploit Public-Facing Application, External Remote Services
GPUpdate with no Command Line Arguments with Network
Process Injection
Detect Outbound SMB Traffic
File Transfer Protocols, Application Layer Protocol
Windows InstallUtil Uninstall Option with Network
InstallUtil, System Binary Proxy Execution
Detect Large Outbound ICMP Packets
Non-Application Layer Protocol
Windows InstallUtil Remote Network Connection
InstallUtil, System Binary Proxy Execution
Detect Windows DNS SIGRed via Zeek
Exploitation for Client Execution
SMB Traffic Spike - MLTK
SMB/Windows Admin Shares, Remote Services
Detect Outbound LDAP Traffic
Exploit Public-Facing Application, Command and Scripting Interpreter
Rundll32 with no Command Line Arguments with Network
System Binary Proxy Execution, Rundll32
Detect Software Download To Network Device
TFTP Boot, Pre-OS Boot
SearchProtocolHost with no Command Line with Network
Process Injection
Unknown Process Using The Kerberos Protocol
Use Alternate Authentication Material
Windows AD Replication Service Traffic
OS Credential Dumping, DCSync, Rogue Domain Controller
Email servers sending high volume traffic to hosts
Email Collection, Remote Email Collection
Network Traffic to Active Directory Web Services Protocol
Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery
Remote Desktop Network Bruteforce
Remote Desktop Protocol, Remote Services
Log4Shell JNDI Payload Injection with Outbound Connection
Exploit Public-Facing Application, External Remote Services
Windows Suspect Process With Authentication Traffic
Account Discovery, Domain Account, User Execution, Malicious File
Hosts receiving high volume of network traffic from email server
Remote Email Collection, Email Collection
Windows Rundll32 WebDav With Network Connection
Exfiltration Over Unencrypted Non-C2 Protocol
Prohibited Network Traffic Allowed
Exfiltration Over Alternative Protocol
LOLBAS With Network Traffic
Ingress Tool Transfer, Exfiltration Over Web Service, System Binary Proxy Execution
Internal Vertical Port Scan
Network Service Discovery
Internal Horizontal Port Scan
Network Service Discovery