BIOC Low

Nagios enumeration

A Nagios XI database may be enumerated for the credentials of the hosts monitored.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Credential Access
Status:
Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:

Process action type = execution AND target process cmd =~ mysql.*nagios\.nagios_(hosts|services|commands)

Preventable: yes