Search Open Technical Databases `T1596`

Tactic: Reconnaissance

Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommadCount`	1	`ge` 1	`8`
`aws::userAgent`	1	`starts_with` 1	`aws-cli`
`command`	1	`contains` 1	`suspiciouscommands`

Top indicator values (3 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`CommadCount`	`ge`	`8` kustoAWSCloudTrail - Suspicious AWS CLI Command Execution	1
`aws::userAgent`	`starts_with`	`aws-cli` kustoAWSCloudTrail - Suspicious AWS CLI Command Execution	1
`command`	`contains`	`suspiciouscommands` kustoAWSCloudTrail - Suspicious AWS CLI Command Execution	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Kusto 1 rule