mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
21 lines
1.1 KiB
YAML
21 lines
1.1 KiB
YAML
name: Network Discovery
|
|
id: af228995-f182-49d7-90b3-2a732944f00f
|
|
version: 2
|
|
creation_date: '2022-02-14'
|
|
modification_date: '2026-05-13'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more.
|
|
narrative: Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1016/
|
|
- https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf
|
|
- https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|