← Back to feed
Location
🇺🇸 US / Phoenix
ASN
AS8075 · Microsoft Corporation
Cloud Provider
Microsoft Azure
Total Events
42
Average by volume
Agent Count
1
First / Last Seen
2026-06-18 20:15 — 2026-06-18 20:15
Attack Types
MITRE ATT&CK Techniques
Reconnaissance
Initial Access
Execution
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
Sessions
3 (2 with login)
Avg Depth Score
0.65
Commands Executed
10
Files Downloaded
0
Notable Commands
- hostname
- free -m | awk '/^Mem:/ {print $2}'
- df -BG / | awk 'NR==2 {print $2}' | sed 's/G//'
- cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d= -f2 | tr -d '"'
- echo "root:acon@"|chpasswd 2>/dev/null
Fingerprints
HASSH
SSH Client
Evidence Timeline
Interactive Operator
1fed55555e8f
LOGIN
5
1
90%
Loading events...
HASSH 6372ee695756219…
SSH-2.0-paramiko_5.0.0
$ hostname$ free -m | awk '/^Mem:/ {print $2}'$ df -BG / | awk 'NR==2 {print $2}' | sed 's/G//'$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d…$ echo "root:acon@"|chpasswd 2>/dev/null
Interactive Operator
6bcb88a5cc80
LOGIN
5
1
90%
Loading events...
HASSH 6372ee695756219…
SSH-2.0-paramiko_5.0.0
$ hostname$ free -m | awk '/^Mem:/ {print $2}'$ df -BG / | awk 'NR==2 {print $2}' | sed 's/G//'$ cat /etc/os-release 2>/dev/null | grep PRETTY_NAME | cut -d…$ echo "root:acon@"|chpasswd 2>/dev/null
Scanner
692a45c29270
15%
Loading events...