Tag
WordPress Easy PayPal Events & Tickets Plugin Information Disclosure Vulnerability
2 rules 1 TTP 1 CVEAn information disclosure vulnerability in the Easy PayPal Events & Tickets WordPress plugin (versions 1.3 and earlier) allows unauthenticated attackers to enumerate and retrieve all customer order records via the scan_qr.php endpoint.
Rapid Enumeration of AWS S3 Buckets
2 rules 4 TTPsAn AWS principal rapidly enumerates S3 bucket posture using read-only APIs, indicative of reconnaissance, scanning, or post-compromise activity.
Kubernetes Endpoint Permission Enumeration
2 rules 1 TTPA single user and source IP attempts to enumerate Kubernetes endpoints, issuing API requests across multiple endpoints to identify accessible resources for further exploitation.
Potential Enumeration via Active Directory Web Service
2 rules 3 TTPsAdversaries may abuse the Active Directory Web Service (ADWS) to enumerate network resources and user accounts, by loading AD-related modules followed by a network connection to the ADWS dedicated TCP port.
Kubernetes Cluster Enumeration via Audit Logs
3 rules 2 TTPsAttackers attempt to enumerate and discover sensitive information within a Kubernetes cluster by leveraging common shells, utilities, and specialized tools, as reflected in audit logs.
Suspicious Enumeration Commands Spawned via WMIPrvSE
2 rules 12 TTPsThis rule detects suspicious execution of system enumeration commands by the Windows Management Instrumentation Provider Service (WMIPrvSE), indicating potential reconnaissance or malicious activity on Windows systems.