ds_nextdlp_reveal.md

Vendor: NextDLP

Product: Reveal

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
293	125	43	11	11

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Abnormal Authentication & Access	authentication-failed ↳nextdlp-r-json-endpoint-authentication-fail-unauthorizedaccount member-added ↳nextdlp-r-json-group-member-add-success-useradded nac-logon ↳qush-r-json-radius-traffic-success-wifi print-activity ↳qush-r-json-printer-activity-success-riskybehavior remote-logon ↳qush-r-json-endpoint-login-success-insiderrisk ↳nextdlp-r-json-ssh-traffic-success-sshconnection web-activity-allowed ↳qush-r-json-http-session-success-riskybehavior ↳qush-r-json-http-session-success-flightrisk ↳nextdlp-r-json-http-session-success-websitevisited	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	44 Rules 23 Models
Account Manipulation	member-added ↳nextdlp-r-json-group-member-add-success-useradded	T1098 - Account Manipulation T1136 - Create Account	24 Rules 12 Models
Cryptomining	web-activity-allowed ↳qush-r-json-http-session-success-riskybehavior ↳qush-r-json-http-session-success-flightrisk ↳nextdlp-r-json-http-session-success-websitevisited	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Data Access	file-write ↳qush-r-json-file-write-success-datacompression ↳qush-r-json-file-write-success-filecopy	T1083 - File and Directory Discovery	24 Rules 13 Models
Phishing	web-activity-allowed ↳qush-r-json-http-session-success-riskybehavior ↳qush-r-json-http-session-success-flightrisk ↳nextdlp-r-json-http-session-success-websitevisited	T1189 - Drive-by Compromise T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566.002 - Phishing: Spearphishing Link T1598.003 - T1598.003	3 Rules
Privilege Escalation	remote-logon ↳qush-r-json-endpoint-login-success-insiderrisk ↳nextdlp-r-json-ssh-traffic-success-sshconnection	T1078 - Valid Accounts T1555.005 - T1555.005	2 Rules 1 Models
Workforce Protection	web-activity-allowed ↳qush-r-json-http-session-success-riskybehavior ↳qush-r-json-http-session-success-flightrisk ↳nextdlp-r-json-http-session-success-websitevisited	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Phishing: Spearphishing Link External Remote Services Valid Accounts Drive-by Compromise Exploit Public Fasing Application Replication Through Removable Media Phishing	User Execution	Create Account External Remote Services Valid Accounts Server Software Component: Web Shell Account Manipulation Server Software Component Boot or Logon Autostart Execution	Valid Accounts Exploitation for Privilege Escalation Boot or Logon Autostart Execution	Obfuscated Files or Information: Indicator Removal from Tools Valid Accounts Use Alternate Authentication Material Use Alternate Authentication Material: Pass the Hash Use Alternate Authentication Material: Pass the Ticket Obfuscated Files or Information Valid Accounts: Local Accounts	OS Credential Dumping Steal or Forge Kerberos Tickets Credentials from Password Stores Steal or Forge Kerberos Tickets: Kerberoasting	File and Directory Discovery Remote System Discovery	Remote Services Use Alternate Authentication Material Replication Through Removable Media Internal Spearphishing	Email Collection	Web Service Application Layer Protocol: Web Protocols Dynamic Resolution Dynamic Resolution: Domain Generation Algorithms Proxy: Multi-hop Proxy Application Layer Protocol Proxy	Exfiltration Over Physical Medium: Exfiltration over USB Exfiltration Over C2 Channel Exfiltration Over Physical Medium Automated Exfiltration Exfiltration Over Web Service: Exfiltration to Cloud Storage Exfiltration Over Web Service	Resource Hijacking Data Encrypted for Impact