Tag
AI-Coded Malware Used for Active Directory Enumeration and Exfiltration
3 rules 8 TTPs 7 IOCsA threat actor was observed in early June 2026 using AI-generated PowerShell scripts for Active Directory enumeration and then deploying s5cmd for data exfiltration after gaining initial access via RDP, indicating a shift towards AI-augmented tradecraft for rapid and aggressive campaigns.
phpMyFAQ Unauthenticated Information Disclosure via Solution ID Enumeration
2 rules 1 TTP 1 CVEphpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via predictable URL patterns.
WordPress Easy PayPal Events & Tickets Plugin Information Disclosure Vulnerability
2 rules 1 TTP 1 CVEAn information disclosure vulnerability in the Easy PayPal Events & Tickets WordPress plugin (versions 1.3 and earlier) allows unauthenticated attackers to enumerate and retrieve all customer order records via the scan_qr.php endpoint.
Rapid Enumeration of AWS S3 Buckets
2 rules 4 TTPsAn AWS principal rapidly enumerates S3 bucket posture using read-only APIs, indicative of reconnaissance, scanning, or post-compromise activity.
Kubernetes Endpoint Permission Enumeration
2 rules 1 TTPA single user and source IP attempts to enumerate Kubernetes endpoints, issuing API requests across multiple endpoints to identify accessible resources for further exploitation.
AWS S3 Bucket Enumeration and Brute Force Attempts
2 rules 4 TTPsA high number of failed S3 operations (AccessDenied errors) against a single bucket from a single source address within a short timeframe can indicate attempts to enumerate bucket objects, brute-force object keys, or inflate AWS billing.
Potential Enumeration via Active Directory Web Service
2 rules 3 TTPsAdversaries may abuse the Active Directory Web Service (ADWS) to enumerate network resources and user accounts, by loading AD-related modules followed by a network connection to the ADWS dedicated TCP port.
Kubernetes Cluster Enumeration via Audit Logs
3 rules 2 TTPsAttackers attempt to enumerate and discover sensitive information within a Kubernetes cluster by leveraging common shells, utilities, and specialized tools, as reflected in audit logs.
BloodHound Suite User-Agent Detected in Entra ID Sign-ins
3 rules 6 TTPsDetection of BloodHound tools like AzureHound and SharpHound being used to enumerate Microsoft Entra ID and Microsoft 365 environments, potentially indicating reconnaissance activity by red teams or malicious actors.
Kubernetes Potential Endpoint Permission Enumeration by Anonymous User
2 rules 1 TTPAn anonymous user attempts to enumerate Kubernetes API endpoints, resulting in a series of failed API requests across multiple endpoints, potentially revealing the cluster's exposed surface.
Azure AD Service Principal Enumeration via Microsoft Graph API
2 rules 2 TTPsAn attacker uses Microsoft Graph API to enumerate multiple Azure AD service principals, potentially using tools like AzureHound or ROADtools, to gather information for privilege escalation or lateral movement.
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy
2 rules 3 TTPsDetects repeated failed attempts to update an IAM role's trust policy in an AWS account, consistent with role and user enumeration techniques, potentially indicating attacker-controlled infrastructure or offensive tooling.
MacOS Firewall Configuration Enumeration
2 rules 1 TTPAdversaries may enumerate MacOS firewall configurations to identify potential attack surfaces and determine active rules by executing commands like `defaults read /Library/Preferences/com.apple.alf` and `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`.
Suspicious Enumeration Commands Spawned via WMIPrvSE
2 rules 13 TTPsThis rule identifies suspicious activity where enumeration commands are spawned via the Windows Management Instrumentation Provider Service (WMIPrvSE) to gather system and network information.