Product
medium
advisory
Detection of Internal Horizontal Port Scanning Activity
1 rule 1 TTPDetection logic identifying internal hosts performing broad network reconnaissance by scanning 250+ unique IP addresses across NMAP's top 20 common ports.
AWS CloudWatch +1
reconnaissance
network-discovery
internal-scanning
nmap
1r
1t
high
advisory
Cisco Privileged Account Creation Followed by HTTP Command Execution
1 rule 3 TTPsAttackers create privileged accounts on Cisco IOS devices and then execute commands remotely via HTTP to gain privileged access.
IOS +1
cisco
network
privilege escalation
command execution
1r
3t