Wordlist Scanning

Detection of Wordlist Scanning

Disable or Remove Feature or Program: Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

• Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash).
• Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

• Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required.
• Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

• Use Case: Prevent users from installing unauthorized software via group policies or other management tools.
• Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

• Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices.
• Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

• Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes.
• Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Pre-compromise: Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations. This mitigation can be implemented through the following measures:

Limit Information Exposure:

• Regularly audit and sanitize publicly available data, including job posts, websites, and social media.
• Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information.

Protect Domain and DNS Infrastructure:

• Enable DNSSEC and use WHOIS privacy protection.
• Monitor for domain hijacking or lookalike domains using services like RiskIQ or DomainTools.

External Monitoring:

• Use tools like Shodan, Censys to monitor your external attack surface.
• Deploy external vulnerability scanners to proactively address weaknesses.

Threat Intelligence:

• Leverage platforms like MISP, Recorded Future, or Anomali to track adversarial infrastructure, tools, and activity.

Content and Email Protections:

• Use email security solutions like Proofpoint, Microsoft Defender for Office 365, or Mimecast.
• Enforce SPF/DKIM/DMARC policies to protect against email spoofing.

Training and Awareness:

• Educate employees on identifying phishing attempts, securing their social media, and avoiding information leaks.