Skip to content
Threat Feed
Subscribe

Tag

Attack.defense_evasion

2 briefs RSS
medium advisory

This rule detects changes to AWS CloudTrail configurations that could indicate a security risk, specifically disabling or altering trails, or failing a security configuration check. Such actions can significantly reduce visibility into AWS activity.

AWS CloudTrail attack.impact attack.defense_evasion attack.t1562.001 attack.t1562.006
3r
high advisory

ESXi Firewall Disabled Detection

This detection identifies when the ESXi firewall is disabled or set to permissive mode, potentially exposing the host to unauthorized access and network-based attacks, often preceding lateral movement, data exfiltration, or malware installation.

ESXi +3 firewall lateral_movement data_exfiltration ransomware attack.defense_evasion
2r