Rules | Models | MITRE ATT&CK® TTPs | Event Types | Parsers |
---|---|---|---|---|
92 | 36 | 22 | 5 | 5 |
Use-Case | Event Types/Parsers | MITRE ATT&CK® TTP | Content |
---|---|---|---|
Abnormal Authentication & Access | remote-access ↳dell-file-remote-access |
T1021 - Remote Services T1078 - Valid Accounts |
|
Compromised Credentials | file-delete ↳dell-file-operations-2 ↳isilon-file-delete file-permission-change ↳isilon-file-permission-change file-read ↳dell-file-operations-1 ↳isilon-file-read ↳dell-file-operations-4 file-write ↳isilon-file-write ↳dell-file-operations-3 ↳json-dell-file-operations remote-access ↳dell-file-remote-access |
T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1083 - File and Directory Discovery T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets |
|
Data Exfiltration | file-write ↳isilon-file-write ↳dell-file-operations-3 ↳json-dell-file-operations |
TA0002 - TA0002 |
|
Data Leak | file-write ↳isilon-file-write ↳dell-file-operations-3 ↳json-dell-file-operations |
T1114.001 - T1114.001 |
|
Destruction of Data | file-delete ↳dell-file-operations-2 ↳isilon-file-delete |
T1070.004 - Indicator Removal on Host: File Deletion T1485 - Data Destruction |
|
Lateral Movement | remote-access ↳dell-file-remote-access |
T1018 - Remote System Discovery T1021 - Remote Services T1078 - Valid Accounts T1550 - Use Alternate Authentication Material T1550.002 - Use Alternate Authentication Material: Pass the Hash T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting |
|
Malware | file-write ↳isilon-file-write ↳dell-file-operations-3 ↳json-dell-file-operations remote-access ↳dell-file-remote-access |
T1003.002 - T1003.002 T1505.003 - Server Software Component: Web Shell T1547.001 - T1547.001 T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002 |
|
Privilege Escalation | remote-access ↳dell-file-remote-access |
T1078 - Valid Accounts T1555.005 - T1555.005 |
|
Ransomware | file-write ↳isilon-file-write ↳dell-file-operations-3 ↳json-dell-file-operations |
T1486 - Data Encrypted for Impact |
|
Next Page -->> |