Threat hunts for Juniper
2 hunts covering Juniper, each with a hypothesis, the queries that test it and what the hunt cannot see.
2 hunts
-
high Part 2 of 2Research by CISA
EBurst Password Spraying and Mailbox Exfiltration
An adversary is conducting automated password spraying via the EBurst tool against Exchange interfaces and then using successful logins to exfiltrate mailbox data via cloud APIs.
3 query1 analytic1 checkpoint1 action2 taskCVE-2014-6278 · CVE-2015-3306 -
high Part 1 of 2Research by CISA
Perimeter Exploitation and Evasive VPN Persistence
An adversary exploits vulnerable web services to execute masqueraded payloads and establishes persistence through a renamed VPN client with a unique hash communicating with Integrity Tech infrastructure.
5 query2 analytic1 checkpoint1 action2 taskCVE-2014-6278 · CVE-2015-3306