Reasons
- Permanent enforcement applied due to coordinated distributed activity.
- Threat activity was observed independently on multiple nodes.
- Multiple stages of an attack chain were observed within a short time window.
MITRE ATT&CK Mappings
- Tactics: Reconnaissance
- Techniques: T1595
Evidence
- Nodes observed: 3
- Severity: LOW
- TTL remaining: 12d 3h