uc_abnormal_authentication_&_access.md

Use Case: Abnormal Authentication & Access

Vendor: APC

Product	MITRE ATT&CK® TTP	Content
APC	T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services	9 Rules 9 Models

Vendor: AVI Networks

Product	MITRE ATT&CK® TTP	Content
AVI Networks Software Load Balancer	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Absolute

Product	MITRE ATT&CK® TTP	Content
Absolute DDS	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Accellion

Product	MITRE ATT&CK® TTP	Content
Kiteworks	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	16 Rules 4 Models

Vendor: Admin By Request

Product	MITRE ATT&CK® TTP	Content
Admin By Request	T1078 - Valid Accounts	1 Rules 1 Models

Vendor: Airlock

Product	MITRE ATT&CK® TTP	Content
Airlock Allowlisting	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Airlock Security Access Hub	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Akamai

Product	MITRE ATT&CK® TTP	Content
Cloud Akamai	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: AlgoSec

Product	MITRE ATT&CK® TTP	Content
AlgoSec Firewall Analyzer	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Amazon

Product	MITRE ATT&CK® TTP	Content
AWS CloudTrail	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
AWS CloudWatch	T1133 - External Remote Services	3 Rules 3 Models
AWS GuardDuty	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
AWS WAF	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 10 Models

Vendor: Apache

Product	MITRE ATT&CK® TTP	Content
Apache	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Apache Guacamole	T1133 - External Remote Services	3 Rules 3 Models
Apache Subversion	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Apache Tomcat	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Atlassian

Product	MITRE ATT&CK® TTP	Content
Atlassian BitBucket	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Auth0

Product	MITRE ATT&CK® TTP	Content
Auth0	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	40 Rules 16 Models

Vendor: Avaya

Product	MITRE ATT&CK® TTP	Content
Avaya Ethernet Routing Switch	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Axway

Product	MITRE ATT&CK® TTP	Content
Axway Gateway	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	29 Rules 14 Models

Vendor: Badge

Product	MITRE ATT&CK® TTP	Content
Badge	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Banyan Security

Product	MITRE ATT&CK® TTP	Content
Banyan Security	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Barracuda

Product	MITRE ATT&CK® TTP	Content
Barracuda Cloudgen Firewall	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	38 Rules 17 Models
Barracuda Email Security Gateway	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Barracuda WAF	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: BeyondTrust

Product	MITRE ATT&CK® TTP	Content
BeyondInsight	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
BeyondTrust	T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	31 Rules 13 Models
BeyondTrust Privileged Identity	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
BeyondTrust Secure Remote Access	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Bitdefender

Product	MITRE ATT&CK® TTP	Content
GravityZone	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Bitglass

Product	MITRE ATT&CK® TTP	Content
Bitglass CASB	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Box

Product	MITRE ATT&CK® TTP	Content
Box Cloud Content Management	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Broadcom

Product	MITRE ATT&CK® TTP	Content
z/OS	T1133 - External Remote Services	3 Rules 3 Models

Vendor: CA Technologies

Product	MITRE ATT&CK® TTP	Content
CA Privileged Access Manager Server Control	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	35 Rules 14 Models

Vendor: CDS

Product	MITRE ATT&CK® TTP	Content
CDS	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	34 Rules 16 Models

Vendor: CHCOM

Product	MITRE ATT&CK® TTP	Content
CHCOM	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Check Point

Product	MITRE ATT&CK® TTP	Content
Check Point Anti-Malware	T1133 - External Remote Services	3 Rules 3 Models
Check Point Identity Awareness	T1078 - Valid Accounts T1133 - External Remote Services	13 Rules 5 Models
Check Point NGFW	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	61 Rules 26 Models
Check Point Security Gateway	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	35 Rules 10 Models
Check Point Threat Emulation	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Cisco

Product	MITRE ATT&CK® TTP	Content
AnyConnect	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	26 Rules 7 Models
Cisco	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Cisco ACI	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
Cisco ACS	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
Cisco Adaptive Security Appliance	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	61 Rules 26 Models
Cisco Cloud Web Security	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Cisco Firepower	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	40 Rules 15 Models
Cisco IOS	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	38 Rules 20 Models
Cisco ISE	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	47 Rules 20 Models
Cisco Meraki MX appliance	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	19 Rules 11 Models
Cisco PIX	T1133 - External Remote Services	3 Rules 3 Models
Cisco Secure Endpoint	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	21 Rules 7 Models
Cisco Secure Web Appliance	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Cisco SourceFire	T1133 - External Remote Services	3 Rules 3 Models
Cisco Umbrella	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Cisco Unified Communications Manager	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Duo Access	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	22 Rules 10 Models
IronPort Email	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Citrix

Product	MITRE ATT&CK® TTP	Content
Citrix Gateway	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	29 Rules 7 Models
Citrix ShareFile	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Citrix Virtual Apps	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	35 Rules 14 Models
Citrix Web App Firewall	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	17 Rules 10 Models

Vendor: Claroty

Product	MITRE ATT&CK® TTP	Content
CTD	T1078 - Valid Accounts T1110 - Brute Force	5 Rules 2 Models

Vendor: Clearsense

Product	MITRE ATT&CK® TTP	Content
Clearsense	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Click Studios

Product	MITRE ATT&CK® TTP	Content
Passwordstate	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models

Vendor: Cloudflare

Product	MITRE ATT&CK® TTP	Content
Cloudflare Insights	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Cloudflare WAF	T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services	9 Rules 9 Models

Vendor: Code42

Product	MITRE ATT&CK® TTP	Content
Code42 Incydr	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: CrowdStrike

Product	MITRE ATT&CK® TTP	Content
Falcon	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	44 Rules 18 Models

Vendor: CyberArk

Product	MITRE ATT&CK® TTP	Content
CyberArk Endpoint Privilege Manager	T1078 - Valid Accounts T1133 - External Remote Services	4 Rules 4 Models
CyberArk Privilege Access Manager	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	46 Rules 22 Models

Vendor: Cylance

Product	MITRE ATT&CK® TTP	Content
Cylance OPTICS	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Cylance PROTECT	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: DXC

Product	MITRE ATT&CK® TTP	Content
DXC Technology	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Darktrace

Product	MITRE ATT&CK® TTP	Content
Darktrace	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: DataWatch Systems

Product	MITRE ATT&CK® TTP	Content
DataWatch	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Delinea

Product	MITRE ATT&CK® TTP	Content
Centrify Authentication Service	T1133 - External Remote Services	3 Rules 3 Models
Centrify Zero Trust Privilege Services	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Dell

Product	MITRE ATT&CK® TTP	Content
EMC Isilon	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
One Identity Manager	T1078 - Valid Accounts	2 Rules 1 Models
Sonicwall	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	55 Rules 23 Models

Vendor: Digital Guardian

Product	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	34 Rules 13 Models

Vendor: Dropbox

Product	MITRE ATT&CK® TTP	Content
Dropbox	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	25 Rules 6 Models

Vendor: Dtex Systems

Product	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts	28 Rules 16 Models

Vendor: ESET

Product	MITRE ATT&CK® TTP	Content
ESET Endpoint Security	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Entrust

Product	MITRE ATT&CK® TTP	Content
Entrust Identity Enterprise	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Envoy

Product	MITRE ATT&CK® TTP	Content
Envoy	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: Epic

Product	MITRE ATT&CK® TTP	Content
Epic SIEM	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Exabeam

Product	MITRE ATT&CK® TTP	Content
Advanced Analytics	T1133 - External Remote Services	3 Rules 3 Models
Audit Log	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Search	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Extreme Networks

Product	MITRE ATT&CK® TTP	Content
ExtremeCloud IQ	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Zebra WLAN Management	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: F-Secure

Product	MITRE ATT&CK® TTP	Content
F-Secure Policy Manager	T1133 - External Remote Services	3 Rules 3 Models

Vendor: F5

Product	MITRE ATT&CK® TTP	Content
BIG-IP F5 LBR	T1133 - External Remote Services	3 Rules 3 Models
F5 Access Policy Manager	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	35 Rules 10 Models
F5 Advanced Firewall Manager	T1133 - External Remote Services	3 Rules 3 Models
F5 Advanced Web Application Firewall	T1078 - Valid Accounts T1133 - External Remote Services	5 Rules 4 Models
F5 Application Security Manager	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 7 Models
F5 BIG-IP	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	55 Rules 20 Models
F5 BIG-IP DNS	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
F5 Silverline	T1133 - External Remote Services	3 Rules 3 Models

Vendor: FTP

Product	MITRE ATT&CK® TTP	Content
FTP	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Fast Enterprises

Product	MITRE ATT&CK® TTP	Content
Fast Enterprises GenTax	T1133 - External Remote Services	3 Rules 3 Models

Vendor: FileAuditor

Product	MITRE ATT&CK® TTP	Content
FileAuditor	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Forcepoint

Product	MITRE ATT&CK® TTP	Content
Forcepoint CASB	T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services	9 Rules 9 Models
Forcepoint Next-Gen Firewall	T1133 - External Remote Services	3 Rules 3 Models
Websense Security Gateway	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: Forescout

Product	MITRE ATT&CK® TTP	Content
EyeInspect	T1133 - External Remote Services	3 Rules 3 Models
Forescout CounterACT	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 7 Models

Vendor: Fortinet

Product	MITRE ATT&CK® TTP	Content
FortiGate	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	35 Rules 13 Models
Fortinet UTM	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 10 Models
Fortiweb Web Application Firewall	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: GTB

Product	MITRE ATT&CK® TTP	Content
GTB Technologies DLP	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Generic Badge Access

Product	MITRE ATT&CK® TTP	Content
Generic Badge Access	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Genetec

Product	MITRE ATT&CK® TTP	Content
Genetec Badge	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Gigamon

Product	MITRE ATT&CK® TTP	Content
GigaVUE-HC2	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: GitHub

Product	MITRE ATT&CK® TTP	Content
GitHub	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: GoAnywhere

Product	MITRE ATT&CK® TTP	Content
GoAnywhere MFT	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	37 Rules 16 Models

Vendor: Google

Product	MITRE ATT&CK® TTP	Content
Google Cloud Platform	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 10 Models
Google Workspace	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	21 Rules 10 Models

Vendor: HP

Product	MITRE ATT&CK® TTP	Content
Aruba ClearPass Policy Manager	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	21 Rules 7 Models
Aruba Mobility Master	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Aruba Wireless controller	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	17 Rules 7 Models
HP Print Server	T1078 - Valid Accounts	1 Rules
HP SafeCom	T1078 - Valid Accounts	1 Rules
HP Virtual Connect Enterprise Manager	T1133 - External Remote Services	3 Rules 3 Models
HP iLO	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 10 Models
HPE 3PAR StoreServ	T1133 - External Remote Services	3 Rules 3 Models
HPE Comware	T1133 - External Remote Services	3 Rules 3 Models

Vendor: HashiCorp

Product	MITRE ATT&CK® TTP	Content
HashiCorp Vault	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: HelpSystems

Product	MITRE ATT&CK® TTP	Content
Powertech Identity and Access Manager	T1078 - Valid Accounts	2 Rules 1 Models

Vendor: Honeywell

Product	MITRE ATT&CK® TTP	Content
Honeywell Pro-Watch	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Huawei

Product	MITRE ATT&CK® TTP	Content
Huawei Unified Security Gateway	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models

Vendor: IBM

Product	MITRE ATT&CK® TTP	Content
DB2	T1133 - External Remote Services	3 Rules 3 Models
HCL Notes	T1133 - External Remote Services	3 Rules 3 Models
IBM Datapower	T1133 - External Remote Services	3 Rules 3 Models
IBM Mainframe	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
IBM Resource Access Control Facility	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Sterling B2B Integrator	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Identiv

Product	MITRE ATT&CK® TTP	Content
Identiv	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Imperva

Product	MITRE ATT&CK® TTP	Content
Imperva Incapsula	T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services	9 Rules 9 Models
Imperva SecureSphere	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Imprivata

Product	MITRE ATT&CK® TTP	Content
Imprivata	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: InfoWatch

Product	MITRE ATT&CK® TTP	Content
InfoWatch DLP	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 10 Models

Vendor: Infoblox

Product	MITRE ATT&CK® TTP	Content
BloxOne DDI	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models
Infoblox NIOS	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Ipswitch

Product	MITRE ATT&CK® TTP	Content
MoveIt Transfer	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Ivanti

Product	MITRE ATT&CK® TTP	Content
Ivanti Pulse Secure	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	35 Rules 13 Models

Vendor: Jumpcloud

Product	MITRE ATT&CK® TTP	Content
Jumpcloud	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Juniper Networks

Product	MITRE ATT&CK® TTP	Content
Juniper SRX Series	T1078 - Valid Accounts T1133 - External Remote Services	16 Rules 5 Models
Junos OS	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 10 Models

Vendor: Kasada

Product	MITRE ATT&CK® TTP	Content
Kasada	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: Kemp

Product	MITRE ATT&CK® TTP	Content
Kemp LoadMaster	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: LanScope

Product	MITRE ATT&CK® TTP	Content
LanScope Cat	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	37 Rules 19 Models

Vendor: LastPass

Product	MITRE ATT&CK® TTP	Content
LastPass	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Lenel

Product	MITRE ATT&CK® TTP	Content
OnGuard	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: LiquidFiles

Product	MITRE ATT&CK® TTP	Content
LiquidFiles	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: LogRhythm

Product	MITRE ATT&CK® TTP	Content
LogRhythm	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Magento

Product	MITRE ATT&CK® TTP	Content
Magento WAF	T1133 - External Remote Services	3 Rules 3 Models

Vendor: ManageEngine

Product	MITRE ATT&CK® TTP	Content
ADAuditPlus	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
ADSSP	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
PAM360	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models

Vendor: MariaDB

Product	MITRE ATT&CK® TTP	Content
MariaDB	T1133 - External Remote Services	3 Rules 3 Models

Vendor: MasterSAM

Product	MITRE ATT&CK® TTP	Content
MasterSAM PAM	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models

Vendor: McAfee

Product	MITRE ATT&CK® TTP	Content
McAfee DLP Endpoint	T1078 - Valid Accounts	1 Rules
McAfee Endpoint Security	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models
McAfee Network Security Platform	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
McAfee Web Gateway	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
McAfee ePolicy Orchestrator	T1133 - External Remote Services	3 Rules 3 Models
Skyhigh Networks CASB	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: MicroFocus ArcSight

Product	MITRE ATT&CK® TTP	Content
MicroFocus ArcSight	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models

Vendor: Microsoft

Product	MITRE ATT&CK® TTP	Content
Active Directory Federation Services	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	20 Rules 10 Models
Azure	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Azure AD Activity Logs	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Azure AD Sign-In Logs	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Azure ATP	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Azure MFA	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Azure Monitor	T1021 - Remote Services T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1133 - External Remote Services T1136.003 - Create Account: Create: Cloud Account	25 Rules 9 Models
Event Viewer - ADFS	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	41 Rules 20 Models
Event Viewer - Application	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	21 Rules 7 Models
Event Viewer - Applocker	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Event Viewer - AzureADPasswordProtection-DCAgent	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
Event Viewer - BFE Resorce Flows	T1078 - Valid Accounts	1 Rules 1 Models
Event Viewer - CertificateServicesClient	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Event Viewer - DFS-Replication	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
Event Viewer - DHCP-Server	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Event Viewer - DNSServer	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Event Viewer - Directory-Service	T1133 - External Remote Services	3 Rules 3 Models
Event Viewer - Kernel-IO	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Event Viewer - KnownFolders	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Event Viewer - Licensing-Platform	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Event Viewer - LiveId	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Event Viewer - NPS	T1021 - Remote Services T1078 - Valid Accounts	8 Rules 4 Models
Event Viewer - NTLM	T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	21 Rules 10 Models
Event Viewer - PowerShell	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Event Viewer - Security	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	69 Rules 28 Models
Event Viewer - System	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	24 Rules 13 Models
Event Viewer - TaskScheduler	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Event Viewer - TerminalServices-Gateway	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Event Viewer - TerminalServices-LocalSessionManager	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
M365 Audit Logs	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
MSSQL	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Microsoft 365	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Microsoft Advanced Threat Analytics	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Microsoft CAS	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Microsoft DHCP Log	T1078 - Valid Accounts T1133 - External Remote Services	4 Rules 4 Models
Microsoft Defender for Endpoint	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	49 Rules 20 Models
Microsoft Exchange	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	27 Rules 13 Models
Microsoft IIS	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Microsoft Intune	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Microsoft Network Policy Server	T1021 - Remote Services T1078 - Valid Accounts	8 Rules 4 Models
Microsoft RRAS	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
Sysmon	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models
Windows	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Mimecast

Product	MITRE ATT&CK® TTP	Content
Mimecast Secure Email Gateway	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Mimecast Targeted Threat Protection - URL	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: MuleSoft

Product	MITRE ATT&CK® TTP	Content
MuleSoft Anypoint Platform	T1133 - External Remote Services	3 Rules 3 Models

Vendor: NCP

Product	MITRE ATT&CK® TTP	Content
NCP	T1021 - Remote Services T1078 - Valid Accounts	13 Rules 2 Models

Vendor: NNT

Product	MITRE ATT&CK® TTP	Content
NNT ChangeTracker	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Nagios

Product	MITRE ATT&CK® TTP	Content
Nagios	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	29 Rules 14 Models

Vendor: Namespace rDirectory

Product	MITRE ATT&CK® TTP	Content
Namespace rDirectory	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: NetApp

Product	MITRE ATT&CK® TTP	Content
NetApp	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: NetIQ

Product	MITRE ATT&CK® TTP	Content
Micro Focus NetIQ Identity Manager	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Netskope

Product	MITRE ATT&CK® TTP	Content
Netskope Security Cloud	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	41 Rules 20 Models

Vendor: Netwrix

Product	MITRE ATT&CK® TTP	Content
Netwrix Auditor	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	21 Rules 6 Models

Vendor: NextDLP

Product	MITRE ATT&CK® TTP	Content
Reveal	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	44 Rules 23 Models

Vendor: Nortel Contivity

Product	MITRE ATT&CK® TTP	Content
Nortel Contivity VPN	T1021 - Remote Services T1078 - Valid Accounts	13 Rules 2 Models

Vendor: OSSEC

Product	MITRE ATT&CK® TTP	Content
OSSEC	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Okta

Product	MITRE ATT&CK® TTP	Content
Okta Adaptive MFA	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	22 Rules 10 Models

Vendor: Onapsis

Product	MITRE ATT&CK® TTP	Content
Onapsis	T1078 - Valid Accounts	1 Rules 1 Models

Vendor: OneLogin

Product	MITRE ATT&CK® TTP	Content
OneLogin	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: OneSpan

Product	MITRE ATT&CK® TTP	Content
Digipass for Apps	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 7 Models

Vendor: OneWelcome

Product	MITRE ATT&CK® TTP	Content
OneWelcome Cloud Identity Platform	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models

Vendor: Open VPN

Product	MITRE ATT&CK® TTP	Content
Open VPN	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	26 Rules 7 Models

Vendor: OpenDJ

Product	MITRE ATT&CK® TTP	Content
OpenDJ	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models

Vendor: Oracle

Product	MITRE ATT&CK® TTP	Content
Oracle Access Management	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Oracle Audit Vault and Database Firewall	T1078 - Valid Accounts	1 Rules 1 Models
Oracle Database	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	29 Rules 14 Models
Oracle Public Cloud	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Osquery

Product	MITRE ATT&CK® TTP	Content
Osquery	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Palo Alto Networks

Product	MITRE ATT&CK® TTP	Content
Cortex XSOAR	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
GlobalProtect	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	35 Rules 13 Models
Palo Alto NGFW	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	59 Rules 24 Models
Prisma Cloud	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1110 - Brute Force	11 Rules 8 Models
Traps Endpoint Security Manager	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Password Manager Pro

Product	MITRE ATT&CK® TTP	Content
Password Manager Pro	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 7 Models

Vendor: Ping Identity

Product	MITRE ATT&CK® TTP	Content
Ping Identity	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
PingOne	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Progress

Product	MITRE ATT&CK® TTP	Content
Progress Database	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	29 Rules 14 Models

Vendor: Proofpoint

Product	MITRE ATT&CK® TTP	Content
ObserveIT	T1078 - Valid Accounts	1 Rules 1 Models
Proofpoint Email Protection	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models
Proofpoint Enterprise Protection	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models

Vendor: Quest Software

Product	MITRE ATT&CK® TTP	Content
Quest Change Auditor for Active Directory	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	16 Rules 4 Models

Vendor: RS2 Technologies

Product	MITRE ATT&CK® TTP	Content
RS2 Technologies	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: RSA

Product	MITRE ATT&CK® TTP	Content
RSA Adaptive Authentication	T1133 - External Remote Services	3 Rules 3 Models
RSA Authentication Manager	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	16 Rules 4 Models
SecurID	T1021 - Remote Services T1078 - Valid Accounts	13 Rules 2 Models

Vendor: RStudio

Product	MITRE ATT&CK® TTP	Content
RStudio Server	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Radware

Product	MITRE ATT&CK® TTP	Content
Alteon	T1133 - External Remote Services	3 Rules 3 Models

Vendor: RangerAudit

Product	MITRE ATT&CK® TTP	Content
RangerAudit	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Riverbed Steelhead

Product	MITRE ATT&CK® TTP	Content
Riverbed Steelhead	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Rubrik

Product	MITRE ATT&CK® TTP	Content
Rubrik Cloud Data Management	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Ruckus

Product	MITRE ATT&CK® TTP	Content
Ruckus	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Rundeck

Product	MITRE ATT&CK® TTP	Content
Rundeck	T1133 - External Remote Services	3 Rules 3 Models

Vendor: SAP

Product	MITRE ATT&CK® TTP	Content
SAP	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	36 Rules 14 Models
SuccessFactors	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: SIGSCI

Product	MITRE ATT&CK® TTP	Content
SIGSCI	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: Safenet

Product	MITRE ATT&CK® TTP	Content
Thales	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Sailpoint

Product	MITRE ATT&CK® TTP	Content
IdentityNow	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Salesforce

Product	MITRE ATT&CK® TTP	Content
Salesforce	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Secomea

Product	MITRE ATT&CK® TTP	Content
Secomea	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: SecurEnvoy

Product	MITRE ATT&CK® TTP	Content
SecurEnvoy Multi-Factor Authentication	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models

Vendor: SecureAuth

Product	MITRE ATT&CK® TTP	Content
SecureAuth IDP	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
SecureAuth Login	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models

Vendor: SecureLink

Product	MITRE ATT&CK® TTP	Content
SecureLink	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: SecureNet

Product	MITRE ATT&CK® TTP	Content
SecureNet	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	26 Rules 7 Models

Vendor: SecurityExpert

Product	MITRE ATT&CK® TTP	Content
SecurityExpert	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Semperis

Product	MITRE ATT&CK® TTP	Content
Semperis DSP	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Sensormatik

Product	MITRE ATT&CK® TTP	Content
Sensormatik	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: SentinelOne

Product	MITRE ATT&CK® TTP	Content
Event Viewer - Sentinelone	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Singularity Platform	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	38 Rules 20 Models
Vigilance	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: ServiceNow

Product	MITRE ATT&CK® TTP	Content
ServiceNow	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Shibboleth

Product	MITRE ATT&CK® TTP	Content
Shibboleth	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Silverfort

Product	MITRE ATT&CK® TTP	Content
Silverfort Authentication Platform	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: SiteMinder

Product	MITRE ATT&CK® TTP	Content
Symantec SiteMinder	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: SkySea

Product	MITRE ATT&CK® TTP	Content
SkySea ClientView	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 10 Models

Vendor: Skyformation

Product	MITRE ATT&CK® TTP	Content
Skyformation	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Skyhigh Security

Product	MITRE ATT&CK® TTP	Content
Skyhigh Security Cloud	T1071.001 - Application Layer Protocol: Web Protocols	3 Rules 3 Models

Vendor: Sophos

Product	MITRE ATT&CK® TTP	Content
Sophos Endpoint Protection	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	29 Rules 14 Models
Sophos UTM	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models
Sophos XG Firewall	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Specops

Product	MITRE ATT&CK® TTP	Content
Specops Password	T1078 - Valid Accounts	2 Rules 1 Models

Vendor: Squid

Product	MITRE ATT&CK® TTP	Content
Squid	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: SunOne

Product	MITRE ATT&CK® TTP	Content
SunOne	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Swift

Product	MITRE ATT&CK® TTP	Content
Swift	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Swipes

Product	MITRE ATT&CK® TTP	Content
Swipes	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Swivel

Product	MITRE ATT&CK® TTP	Content
Swivel	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Sybase

Product	MITRE ATT&CK® TTP	Content
Sybase	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Symantec

Product	MITRE ATT&CK® TTP	Content
Symantec Advanced Threat Protection	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Symantec Critical System Protection	T1078 - Valid Accounts T1110 - Brute Force	8 Rules 3 Models
Symantec DLP	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Symantec Endpoint Protection	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 7 Models
Symantec VIP	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
Symantec Web Security Service	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: Tanium

Product	MITRE ATT&CK® TTP	Content
Tanium Cloud Platform	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Tanium Core Platform	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Tanium Threat Response	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	29 Rules 14 Models

Vendor: Tenable.io

Product	MITRE ATT&CK® TTP	Content
Tenable.io	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Thales Group

Product	MITRE ATT&CK® TTP	Content
Gemalto MFA	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models

Vendor: Trend Micro

Product	MITRE ATT&CK® TTP	Content
Deep Discovery Inspector	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
Deep Security	T1133 - External Remote Services	3 Rules 3 Models
OfficeScan	T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services	9 Rules 9 Models
Trend Micro ScanMail	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Tufin

Product	MITRE ATT&CK® TTP	Content
Tufin SecureTrack	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Tyco

Product	MITRE ATT&CK® TTP	Content
CCURE Building Management System	T1078 - Valid Accounts T1133 - External Remote Services	16 Rules 5 Models

Vendor: Unix

Product	MITRE ATT&CK® TTP	Content
Auditbeat	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	18 Rules 7 Models
Unix	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	46 Rules 19 Models
Unix Auditd	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	48 Rules 22 Models
Unix Named	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	21 Rules 7 Models
Unix Privilege Management	T1078 - Valid Accounts	2 Rules 1 Models
Unix dhcpd	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
rsyslog	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: VMS Software

Product	MITRE ATT&CK® TTP	Content
OpenVMS	T1078 - Valid Accounts	1 Rules 1 Models

Vendor: VMware

Product	MITRE ATT&CK® TTP	Content
Carbon Black App Control	T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts	22 Rules 10 Models
Carbon Black CES	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Carbon Black EDR	T1078 - Valid Accounts T1133 - External Remote Services	11 Rules 4 Models
Lastline	T1133 - External Remote Services	3 Rules 3 Models
VMware AirWatch	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
VMware ESXi	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	32 Rules 14 Models
VMware Horizon	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models
VMware Identity Manager	T1133 - External Remote Services	3 Rules 3 Models
VMware View	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models
vCenter	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Varonis

Product	MITRE ATT&CK® TTP	Content
Varonis Data Security Platform	T1071.001 - Application Layer Protocol: Web Protocols	6 Rules 6 Models

Vendor: Vectra

Product	MITRE ATT&CK® TTP	Content
Vectra Cognito Detect	T1078 - Valid Accounts	2 Rules 1 Models
Vectra Cognito Stream	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	31 Rules 14 Models

Vendor: ViaScope

Product	MITRE ATT&CK® TTP	Content
ViaScope IPScan	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Visma

Product	MITRE ATT&CK® TTP	Content
Megaflex	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: Watchguard

Product	MITRE ATT&CK® TTP	Content
Watchguard	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Wazuh

Product	MITRE ATT&CK® TTP	Content
Wazuh	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	19 Rules 6 Models

Vendor: Weblogin

Product	MITRE ATT&CK® TTP	Content
Weblogin	T1133 - External Remote Services	3 Rules 3 Models

Vendor: Wiz

Product	MITRE ATT&CK® TTP	Content
Wiz	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Workday

Product	MITRE ATT&CK® TTP	Content
Workday	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: XPS

Product	MITRE ATT&CK® TTP	Content
XPS	T1078 - Valid Accounts	1 Rules

Vendor: Xceedium

Product	MITRE ATT&CK® TTP	Content
Xceedium	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: Xiting

Product	MITRE ATT&CK® TTP	Content
XAMS	T1078 - Valid Accounts T1133 - External Remote Services	15 Rules 4 Models

Vendor: YSoft

Product	MITRE ATT&CK® TTP	Content
YSoft	T1078 - Valid Accounts	1 Rules

Vendor: Zeek

Product	MITRE ATT&CK® TTP	Content
Zeek	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	47 Rules 23 Models

Vendor: Zendesk

Product	MITRE ATT&CK® TTP	Content
Zendesk	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: Zscaler

Product	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	20 Rules 10 Models
Zscaler Private Access	T1078 - Valid Accounts T1133 - External Remote Services	14 Rules 4 Models

Vendor:

Vendor: hMail

Product	MITRE ATT&CK® TTP	Content
hMailServer	T1133 - External Remote Services	3 Rules 3 Models

Vendor: iManage

Product	MITRE ATT&CK® TTP	Content
iManage	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: oVirt

Product	MITRE ATT&CK® TTP	Content
oVirt	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models

Vendor: xPLAN

Product	MITRE ATT&CK® TTP	Content
xPLAN	T1078 - Valid Accounts	3 Rules 2 Models