Introducing Tactics: See What Adversaries Do After Compromise
Summary: GreyNoise launched Tactics, which automatically maps attacker sessions captured by its Deception Sensors to the MITRE ATT&CK framework and shows the tactics, techniques, and underlying activity observed after a compromise. The company said its analysis of weeks of post-compromise activity across its own sensor network found mostly commodity cryptomining, with a smaller set of sessions targeting cloud credentials, attempting container escapes, or creating backdoor accounts.
What you should know: GreyNoise's own sensor data shows most post-compromise activity was commodity cryptomining, but a smaller set went after cloud credentials, container escapes, and backdoor accounts - the behaviors that turn a single foothold into broader access.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026