Threat report

thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment

https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/

Published on: thedfirreport.com
Sources in this catalogue: 2

ATT&CK techniques those detections carry

T1018Remote System Discovery
T1046Network Service Discovery
T1059Command and Scripting Interpreter
T1222.001Windows Permissions

2 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Newly Seen Commonly Abused Network Scanner	Medium	Elastic detection rules	Sep 15, 2026	Elastic License 2.0
Potentially Suspicious NTFS Symlink Behavior Modification	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 2 of 2

Filter in the catalogue