Monitoring Pulse Connect Secure With Splunk (CISA Emergency Directive 21-03)
Tags
attack-pattern: Data Clear Windows Event Logs - T1070.001 Client Configurations - T1592.004 Compromise Host Software Binary - T1554 Exploits - T1587.004 Exploits - T1588.005 File Deletion - T1070.004 Hijack Execution Flow - T1574 Impair Defenses - T1562 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Match Legitimate Name Or Location - T1036.005 Network Device Authentication - T1556.004 Remote Desktop Protocol - T1021.001 Server - T1583.004 Server - T1584.004 Service Execution - T1569.002 Software - T1592.002 Software Discovery - T1518 Windows Command Shell - T1059.003 Web Protocols - T1071.001 Token Impersonation/Theft - T1134.001 Web Shell - T1505.003 Tool - T1588.002 Vulnerabilities - T1588.006 Weaken Encryption - T1600 Account Manipulation - T1098 Command-Line Interface - T1059 Create Account - T1136 Credential Dumping - T1003 Deobfuscate/Decode Files Or Information - T1140 Exfiltration Over Alternative Protocol - T1048 Exploit Public-Facing Application - T1190 External Remote Services - T1133 Indicator Removal On Host - T1070 Remote File Copy - T1105 Two-Factor Authentication Interception - T1111 Obfuscated Files Or Information - T1027 Process Discovery - T1057 Scheduled Task - T1053 System Information Discovery - T1082 System Network Configuration Discovery - T1016 System Network Connections Discovery - T1049
Show in Graph
Common Information
Type Value
UUID df5faa2b-f117-42b5-a9fc-fc0d8204234a
Fingerprint ad12c014c2f5c54f
Analysis status DONE
Considered CTI value 2
Text language
Published April 21, 2021, 11:23 a.m.
Added to db Sept. 26, 2022, 9:34 a.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline Monitoring Pulse Connect Secure With Splunk (CISA Emergency Directive 21-03)
Title Monitoring Pulse Connect Secure With Splunk (CISA Emergency Directive 21-03)
Detected Hints/Tags/Attributes 85/1/36
Source URLs
Redirection Url
Details Source https://www.splunk.com/en_us/blog/security/monitoring-pulse-connect-secure-with-splunk-cisa-emergency-directive-21-03.html
URL Provider
Details Provider Source level domain
Details splunk.com www.splunk.com
Attributes
Details Type #Events CTI Value
Details CVE 21 
cve-2021-22893
Details Domain 1 
checkpcsversions.sh
Details File 3 
workaround-2104.xml
Details MITRE ATT&CK Techniques 289 
T1003
Details MITRE ATT&CK Techniques 245 
T1016
Details MITRE ATT&CK Techniques 160 
T1021.001
Details MITRE ATT&CK Techniques 627 
T1027
Details MITRE ATT&CK Techniques 183 
T1036.005
Details MITRE ATT&CK Techniques 92 
T1048
Details MITRE ATT&CK Techniques 119 
T1049
Details MITRE ATT&CK Techniques 480 
T1053
Details MITRE ATT&CK Techniques 433 
T1057
Details MITRE ATT&CK Techniques 695 
T1059
Details MITRE ATT&CK Techniques 333 
T1059.003
Details MITRE ATT&CK Techniques 247 
T1070
Details MITRE ATT&CK Techniques 92 
T1070.001
Details MITRE ATT&CK Techniques 297 
T1070.004
Details MITRE ATT&CK Techniques 442 
T1071.001
Details MITRE ATT&CK Techniques 1006 
T1082
Details MITRE ATT&CK Techniques 112 
T1098
Details MITRE ATT&CK Techniques 492 
T1105
Details MITRE ATT&CK Techniques 25 
T1111
Details MITRE ATT&CK Techniques 191 
T1133
Details MITRE ATT&CK Techniques 44 
T1134.001
Details MITRE ATT&CK Techniques 86 
T1136
Details MITRE ATT&CK Techniques 504 
T1140
Details MITRE ATT&CK Techniques 542 
T1190
Details MITRE ATT&CK Techniques 104 
T1505.003
Details MITRE ATT&CK Techniques 185 
T1518
Details MITRE ATT&CK Techniques 16 
T1554
Details MITRE ATT&CK Techniques 4 
T1556.004
Details MITRE ATT&CK Techniques 5 
T1592.004
Details MITRE ATT&CK Techniques 235 
T1562
Details MITRE ATT&CK Techniques 174 
T1569.002
Details MITRE ATT&CK Techniques 164 
T1574
Details MITRE ATT&CK Techniques 5 
T1600