Network Service Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the...
BY SOURCE
PROCEDURES (23)
Auto-extracted: 9 detections for network connection monitoring
Auto-extracted: 5 detections for process creation monitoring
Auto-extracted: 5 detections for general monitoring
Auto-extracted: 4 detections for service
Auto-extracted: 4 detections for remote
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for kubernetes
Auto-extracted: 2 detections for dump
Auto-extracted: 2 detections for lateral
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for suspicious