NF – SCAN Potential SSH Scan
This alert is triggered when detecting an SSH scan of an asset. SSH is a secure protocol to provide access to an asset in a network. This alert may be triggered when an adversary is attempting to scan a network and creat an initial connection.
NF – SCAN NBTStat Query Response to External Destination, Possible Windows Network Enumeration
This alert is triggered when detecting a NetBIOS status communication sent from an internal asset to an axternal destination.
ET SCAN Suspicious inbound to PostgreSQL port 5432
This alert is triggered when detecting inbound communication from an external network to the database (DB) on port 5432 (PostgreSQL). This alert may be triggered when an adversary is attempting to gain initial access to the DB or is attempting to read or write data to the DB.
ET SCAN Suspicious inbound to mySQL port 3306
This alert is triggered when detecting inbound communication from an external network to the database (DB) on port 3306 (mySQL). This alert may be triggered when an adversary is attempting to gain initial access to the DB or is attempting to read or write data to the DB.
ET SCAN Suspicious inbound to MSSQL port 1433
This alert is triggered when detecting inbound communication from an external network to the database (DB) on port 1433 (MSSQL). This alert may be triggered when an adversary is attempting to gain initial access to the DB or is attempting to read or write data to the DB.