Niril Ajay
@nrlUndergroundCompletionist
0 followers0 downloads8 copies0 likes23 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
Detects high CPU utilization (exceeding 80%) on VMware ESXi hosts during non-business hours (between 22:00 and 06:00). Such activity may indicate unauthorized resource hijacking, such as cryptocurrency mining, or performance degradation due to unexpected processes.
This rule monitors firewall traffic logs to identify connections directed at managed internal endpoints originating from devices not tracked by the endpoint management system. It flags potential rogue or unauthorized devices performing multi-target reconnaissance or communication across the internal network.