BIOC
Informational
✕
Document discovery
Attackers may use the find command to look for documents.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: File and Directory Discovery (T1083)
Indicator:
Process action type = execution AND target process cmd = *.pdf* , *.doc* , *.ppt* , *.xls* AND target process name = find
Preventable: yes