MITRE ATT&CK technique
Gather Victim Identity Information detection rulesT1589
Gather Victim Identity Information (T1589) is a MITRE ATT&CK technique in the Reconnaissance tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1589 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target azure, windows, linux.
T1589 on attack.mitre.org3 rules
Tactic
Azure AD Account Credential Leaked
highIndicates that the user's valid credentials have been leaked.
azure
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
mediumDetects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
windows · ps_script
SSHD Error Message CVE-2018-15473
mediumDetects exploitation attempt using public exploit code for CVE-2018-15473
linux