T1087 Account Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- AD Privileged Users or Groups Reconnaissancehightest · windows
- BloodHound Collection Fileshightest · windows
- Chopper Webshell Process Patternhightest · windows
- Discovery Using AzureHoundhightest · azure
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- HackTool - SOAPHound Executionhightest · windows
- HackTool - winPEAS Executionhightest · windows
- Hacktool Rulerhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- Network Reconnaissance Activityhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- PUA - Seatbelt Executionhightest · windows
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest · windows
- Potential Pikabot Discovery Activityhightest · windows
- Reconnaissance Activityhightest · windows
- Renamed AdFind Executionhightest · windows
- SharpHound Recon Account Discoveryhightest · rpc_firewall
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Webshell Detection With Command Line Keywordshightest · windows
- Webshell Hacking Activity Patternshightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Active Directory Structure Export Via Csvde.EXEmediumtest · windows
- Potential AD User Enumeration From Non-Machine Accountmediumtest · windows
Mostrando 25 de 34.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.