Skip to content
Threat Feed
Subscribe

Tag

Lateral_movement

5 briefs RSS
high advisory

Windows SQL Server xp_cmdshell Configuration Change Detected

Detection of changes to the xp_cmdshell configuration in SQL Server, a feature often abused by attackers for privilege escalation and lateral movement by enabling execution of operating system commands.

SQL Server +3 sql_server xp_cmdshell privilege_escalation lateral_movement windows
2r 1t
low threat

AWS STS AssumeRole with New MFA Device

This rule identifies when a user has assumed a role using a new MFA device in AWS, which can be indicative of persistence and privilege escalation attempts by threat actors.

exploited AWS Security Token Service +1 aws cloudtrail sts assume_role mfa persistence privilege_escalation lateral_movement
2r 4t
high advisory

Suspicious mkfifo Execution on Linux

This brief covers the suspicious execution of commands following the use of 'mkfifo' on Linux systems, often indicating malicious activity such as establishing named pipes for command and control or data exfiltration.

Linux mkfifo named_pipe command_execution lateral_movement
2r 2t
medium advisory

Suspicious AWS EC2 Key Pair Creation from Non-Cloud AS

An AWS EC2 CreateKeyPair event triggered by a new principal originating from a network autonomous system (AS) organization not associated with major cloud providers, indicating potential unauthorized access or persistence activity.

Amazon EC2 aws ec2 keypair persistence credential_access lateral_movement
2r 3t
high advisory

ESXi Firewall Disabled Detection

This detection identifies when the ESXi firewall is disabled or set to permissive mode, potentially exposing the host to unauthorized access and network-based attacks, often preceding lateral movement, data exfiltration, or malware installation.

ESXi +3 firewall lateral_movement data_exfiltration ransomware attack.defense_evasion
2r