Possible Oracle enumeration via Oscanner

BIOC Low

Possible Oracle enumeration via Oscanner

The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Discovery
Status:: Enabled

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Account Discovery (T1087)

Indicator:

Process action type = execution AND target process name = oscanner* Host host os = linux

Preventable: yes