Browse Rules

OCI - Discovery activity

'Detects possible discovery activity.'

Snowflake - Possible discovery activity

'Detects possible discovery activity.'

System Information Discovery

Detects system information discovery commands

ApexOne - Attack Discovery Detection

'Detects Attack Discovery Detection events.'

Password Policy Discovery - Linux

Detects password policy discovery commands

System Information Discovery - Auditd

Detects System Information Discovery commands

[AWS-SES] Simple Email Service Discovery Event Detected (GetAccount)

[AWS-SES] Simple Email Service Discovery Event Detected (GetAccount)

[AWS-SES] Simple Email Service Discovery Event Detected (GetAccountSendingEnabled)

[AWS-SES] Simple Email Service Discovery Event Detected (GetAccountSendingEnabled)

[AWS-SES] Simple Email Service Discovery Event Detected (ListIdentities)

[AWS-SES] Simple Email Service Discovery Event Detected (ListIdentities)

[AWS-SES] Simple Email Service Discovery Event Detected (ListVerifiedEmailAddresses)

[AWS-SES] Simple Email Service Discovery Event Detected (ListVerifiedEmailAddresses)

AWS EC2 Download Instance User Data

An entity has accessed the user data scripts of multiple EC2 instances.

AWS CloudTrail SES Enumeration

[MICROSOFT-ATP] Discovery alert

[MICROSOFT-ATP] Discovery alert

[PASSWORDSTATE] Discovery Job Deleted

[PASSWORDSTATE] Discovery Job Deleted

[PASSWORDSTATE] Discovery Job Removed

[PASSWORDSTATE] Discovery Job Removed

[PASSWORDSTATE] Discovery Job Updated

[PASSWORDSTATE] Discovery Job Updated

Snowflake - Possible privileges discovery activity

'Detects possible privileges discovery activity.'

System and Hardware Information Discovery

Detects system information discovery commands

AWS EC2 Discovery Commands Executed

Multiple different discovery commands were executed by the same EC2 instance. This could indicate a compromised instance.

[AWS-SES] Simple Email Service Discovery Command Event Detected (GetSendQuota)

[AWS-SES] Simple Email Service Discovery Command Event Detected (GetSendQuota)

[MCAS] ALERT_DISCOVERY_ANOMALY_DETECTION

[MCAS] ALERT_DISCOVERY_ANOMALY_DETECTION

[PASSWORDSTATE] Discovery Job Permissions Added

[PASSWORDSTATE] Discovery Job Permissions Added

[SCREENCONNECT] Suspicious Discovery Command (ipconfig)

[SCREENCONNECT] Suspicious Discovery Command (ipconfig)

[SCREENCONNECT] Suspicious Discovery Command (net)

[SCREENCONNECT] Suspicious Discovery Command (net)

[SCREENCONNECT] Suspicious Discovery Command (systeminfo)

[SCREENCONNECT] Suspicious Discovery Command (systeminfo)