BIOC
Low
✕
Nagios enumeration
A Nagios XI database may be enumerated for the credentials of the hosts monitored.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:
Process action type = execution AND target process cmd =~ mysql.*nagios\.nagios_(hosts|services|commands)
Preventable: yes