Oracle Cloud Infrastructure

Telemetry Evidence

These values show how indexed rules identify Oracle Cloud Infrastructure telemetry.

OCI - Discovery activity source medium: 'Detects possible discovery activity.'T1580
OCI - Event rule deleted source high: 'Detects when event rule was deleted.'T1070
OCI - Inbound SSH connection source medium: 'Detects inbound SSH connection.'T1190
OCI - Insecure metadata endpoint source high: 'Detects insecure metadata endpoint.'T1069
OCI - Instance metadata access source medium: 'Detects instance metadata access.'T1069
OCI - Multiple instances launched source medium: 'Detects when multiple instances were launched.'T1496
OCI - Multiple instances terminated source high: 'Detects when multiple instances were terminated.'T1529
OCI - Multiple rejects on rare ports source medium: 'Detects multiple rejects on rare ports.'T1595
OCI - SSH scanner source high: 'Detects possible SSH scanning activity.'T1595
OCI - Unexpected user agent source medium: 'Detects unexpected user agent strings.'T1190