Skip to content
Threat Feed
Subscribe

Tag

Attack.initial-Access

9 briefs RSS
medium advisory

Suspicious User-Agents Related To Recon Tools

This brief details the detection of reconnaissance and scanning tools through their characteristic User-Agent strings observed in web server logs, providing an early warning of potential targeted scanning activity against public-facing applications by adversaries seeking initial access.

reconnaissance web-security attack.initial-access attack.t1190
1r 3t
high advisory

Malicious Usage of AWS IMDS Credentials Outside of Expected Services

Compromised EC2 instances may be leveraged to exfiltrate and misuse AWS Instance Metadata Service (IMDS) credentials to perform actions outside of the expected AWS Simple Systems Manager (SSM) service, indicating potential lateral movement or data exfiltration.

EC2 attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078 attack.t1078.002
2r 3t
high advisory

Azure AD Sign-in from New Country/Region

Detection of Azure AD sign-ins originating from countries or regions not previously associated with a user, indicating potential account compromise or anomalous activity.

Entra ID attack.stealth attack.t1078 attack.persistence attack.privilege-escalation attack.initial-access
2r 1t
medium advisory

Azure AD Authentication to Important Apps Using Single-Factor Authentication

Detection of successful Azure AD authentications to critical applications that only required single-factor authentication, potentially indicating a security lapse or policy violation leading to unauthorized access.

Azure Active Directory attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078
2r 3t
high advisory

Detection of Azure Subscription Permission Elevation

Detection of a user being assigned the 'User Access Administrator' role, which grants the ability to manage all Azure Subscriptions, potentially leading to privilege escalation and unauthorized access.

Azure attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078
2r 1t
medium advisory

Azure AD Successful Authentication Increase

This detection identifies a statistically significant (10% or greater) increase in successful sign-ins to Azure Active Directory, potentially indicating credential compromise or account takeover attempts.

Azure Active Directory attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078
2r 1t
medium advisory

Azure AD User Added to Administrator Role

An adversary adds a user to an Azure Active Directory administrative role to gain initial access, persist in the environment, escalate privileges, and potentially operate stealthily.

Azure Active Directory attack.initial-access attack.persistence attack.privilege-escalation attack.stealth attack.t1098.003 attack.t1078
2r 4t
medium advisory

Suspicious dMSA Service Account Creation Attempting BadSuccessor Abuse

The creation of a delegated managed service account (dMSA) in specific Active Directory organizational units (OUs) via PowerShell, especially when the initiating user lacks proper permissions, indicates a potential attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025 environments.

Active Directory +1 attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078.002 attack.t1098
2r 4t
high advisory

Azure PIM - Role Assignment Outside of Privileged Identity Management

Detection of privilege role assignments outside of Azure Privileged Identity Management (PIM) can indicate potential attacker activity related to initial access, stealth, persistence, or privilege escalation within the Azure environment.

Azure Active Directory azure pim role-assignment attack.initial-access attack.stealth attack.t1078 attack.persistence attack.privilege-escalation
2r 4t