t1189 | LoFP

t1189

Title	Tags
internal vulnerability scanners can cause some serious fps when used, if you experience a lot of fps due to this think of adding more filters such as \"user agent\" strings and more response codes	t1189 t1190 t1221 sigma
javascripts,css files and png files	t1189 sigma
legitimate browser install, update and recovery scripts	t1059 t1189 t1203 macos sigma
split-horizon dns, vpn transitions, service discovery, failover, hairpin nat, and dual-stack names that publish a public a record with a unique-local aaaa record can legitimately produce public and private answers for the same name. recursive resolvers, dns forwarders, and localhost listeners can also aggregate many endpoints under one client address. security products may sinkhole suspicious domains to loopback or private addresses with short ttls. confirm the domain, resolver placement, and client identity before adding an exception, and scope exceptions by registered domain or client rather than globally.	t1189 network elastic
unknown flash download locations	t1036 t1036.005 t1189 t1204 t1204.002 sigma
user searches in search boxes of the respective website	t1189 t1190 t1221 t1505 t1505.003 sigma
web activity that occurs rarely in small quantities can trigger this alert. possible examples are browsing technical support or vendor urls that are used very sparsely. a user who visits a new and unique web destination may trigger this alert when the activity is sparse. web applications that generate urls unique to a transaction may trigger this when they are used sparsely. web domains can be excluded in cases such as these.	t1041 t1071 t1102 t1105 t1189 t1566 ml elastic