GitHub Repo

Reconnaissance Detections

Name Data Source Technique Type Analytic Story Date
HTTP Rapid POST with Mixed Status Codes Nginx Access T1071.001 T1190 T1595 Anomaly HTTP Request Smuggling 2026-05-13
Windows RDP File Execution Sysmon EventID 1, CrowdStrike ProcessRollup2, Windows Event Log Security 4688 T1021.001 T1598.002 TTP Spearphishing Attachments, Interlock Ransomware, Windows RDP Artifacts and Defense Evasion 2026-05-13
Windows Gather Victim Host Information Camera Powershell Script Block Logging 4104 T1592.001 Anomaly DarkCrystal RAT 2026-05-13
Windows Gather Victim Identity SAM Info Sysmon EventID 7 T1589.001 Hunting Brute Ratel C4 2026-05-13
Local LLM Framework DNS Query Sysmon EventID 22 T1590 Hunting Suspicious Local LLM Frameworks 2026-07-15
Kerberos User Enumeration Windows Event Log Security 4768 T1589.002 Anomaly Active Directory Kerberos Attacks 2026-05-13
Recon AVProduct Through Pwh or WMI Powershell Script Block Logging 4104 T1592 TTP XWorm, Windows Post-Exploitation, Qakbot, Starland RAT Campaign, Malicious PowerShell, Ransomware, Quasar RAT, MoonPeak, Prestige Ransomware, Hermetic Wiper, Data Destruction 2026-07-20
Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco Network Visibility Module Flow Data T1016 T1590.005 Anomaly Castle RAT, BlankGrabber Stealer, Cisco Network Visibility Module Analytics 2026-07-14
Windows WinPEAS PowerShell Script Execution Powershell Script Block Logging 4104 T1007 T1016 T1033 T1082 T1590 T1592.002 T1592.004 T1615 TTP Windows Post-Exploitation 2026-05-13
Recon Using WMI Class Powershell Script Block Logging 4104 T1059.001 T1592 Anomaly Malicious Inno Setup Loader, AsyncRAT, BlankGrabber Stealer, Qakbot, Industroyer2, LockBit Ransomware, Malicious PowerShell, Scattered Spider, VIP Keylogger, Quasar RAT, MoonPeak, Hermetic Wiper, Data Destruction, Axios Supply Chain Post Compromise 2026-05-13
WMI Recon Running Process Or Services Powershell Script Block Logging 4104 T1592 Anomaly Hermetic Wiper, Malicious PowerShell, Data Destruction 2026-05-13
Cisco Secure Firewall - Blocked Connection Cisco Secure Firewall Threat Defense Connection Event T1018 T1046 T1110 T1203 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors Cisco Secure Access Proxy T1595 Anomaly Cisco Secure Access Analytics 2026-06-09
Wermgr Process Connecting To IP Check Web Services Sysmon EventID 22 T1590.005 TTP Trickbot 2026-05-13
Cisco Secure Firewall - Rare Snort Rule Triggered Cisco Secure Firewall Threat Defense Intrusion Event T1583.006 T1598 Hunting Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Windows Gather Victim Network Info Through Ip Check Web Services Sysmon EventID 22 T1590.005 Anomaly Meduza Stealer, BlankGrabber Stealer, Handala Wiper, Starland RAT Campaign, 0bj3ctivity Stealer, Void Manticore, Snake Keylogger, VIP Keylogger, Quasar RAT, Water Gamayun, Azorult, Phemedrone Stealer, DarkCrystal RAT, Castle RAT, PXA Stealer 2026-07-20
Cisco Secure Firewall - Repeated Blocked Connections Cisco Secure Firewall Threat Defense Connection Event T1018 T1046 T1110 T1203 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity Cisco SD-WAN Service Proxy Access Logs T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-05-13
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1071 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Ollama Possible API Endpoint Scan Reconnaissance Ollama Server T1595 Anomaly Suspicious Ollama Activities 2026-05-13
Cisco ASA - Reconnaissance Command Activity Cisco ASA Logs T1082 T1590.001 T1590.005 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco SD-WAN Multiple SSH key Authentication from Same Source Cisco SD-WAN Auth Log T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-06-09
Cisco IOS XE Reconnaissance Command Activity Cisco IOS Logs T1016 T1082 T1590 Anomaly Salt Typhoon 2026-05-20
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication Cisco SD-WAN Auth Log T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-06-09
System Info Gathering Using Dxdiag Application Sysmon EventID 1, CrowdStrike ProcessRollup2, Windows Event Log Security 4688 T1592 Hunting Remcos 2026-05-13
Windows DNS Gather Network Info Sysmon EventID 1, CrowdStrike ProcessRollup2, Windows Event Log Security 4688 T1590.002 Anomaly Sandworm Tools, Volt Typhoon 2026-05-13
Attacker Tools On Endpoint Cisco Network Visibility Module Flow Data, CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 T1003 T1036.005 T1595 TTP Scattered Spider, CISA AA22-264A, XMRig, Compromised Windows Host, Unusual Processes, Cisco Network Visibility Module Analytics, PHP-CGI RCE Attack on Japanese Organizations, SamSam Ransomware 2026-07-14
Windows Netspy Network Scanner Execution Sysmon EventID 1, CrowdStrike ProcessRollup2, Windows Event Log Security 4688 T1018 T1595 Anomaly Network Discovery, Windows Discovery Techniques 2026-05-13
Linux Medusa Rootkit Sysmon for Linux EventID 11 T1014 T1589.001 TTP China-Nexus Threat Activity, Hellcat Ransomware, Medusa Rootkit, VoidLink Cloud-Native Linux Malware 2026-05-13
Windows Detect Network Scanner Behavior Sysmon EventID 3 T1595.001 T1595.002 Anomaly Network Discovery, Windows Discovery Techniques 2026-05-13
Internal Vulnerability Scan T1046 T1595.002 TTP Scattered Lapsus$ Hunters, Network Discovery 2026-05-13