T1595 Active Scanning
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather.…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- DNS Query to External Service Interaction Domainshightest · dns
- PUA - PingCastle Execution From Potentially Suspicious Parenthightest · windows
- Grixba Malware Reconnaissance Activityhighexperimental · windows
- PUA - PingCastle Executionmediumtest · windows
- Potential Hello-World Scraper Botnet Activitymediumexperimental · proxy
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.