Tactics

Rules by MITRE Tactic

Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact

Use Cases

Rules by Use Case

Application Performance Issue
Botnet Detected
Brute Force Logon
Cloud Performance Issue
Command and Control
Correlated IPS Alert
Credential Harvesting
Credential Theft
Data Deletion
Data Exfiltration
Defense Evasion
Denial Of Service
Environmental Performance Issue
FortiSIEM Cluster Health
FortiSIEM Operational Issue
Generic 3rd party Alerts
Hacking Tool Usage
Honeypot match
Host Discovery
Initial Access
IOC Match
Lateral Movement
Log or History Cleared
Logging Disabled
Malware Detected
Network Discovery
Network Performance Issue
Notable Activity
Notable File Change
OT Exploit
Outbreak Alert
Phishing Detected
Policy Violation
Privilege Escalation
Ransomware Detected
Remote Access Software
Server Performance Issue
Services Stopped
Storage Performance Issue
Suspicious Collection Activity
Suspicious Execution
Suspicious Logon
Suspicious Logon Attempt
Suspicious Persistence Activity
Suspicious Service
Systems Config Change
Traffic Anomaly
Tunneling Activity
UEBA Anomaly
Uncommon Activity
Unused Accounts Monitoring
User Account Change
Vulnerability found
Weakening Security

Data Sources

Rules by Data Source

AlertLogic logs via ALERTLOGIC_API_v3 or ALERTLOGIC_IRIS_API
Any Device Agentless FIM via SSH
Any Device Config Monitoring via SSH
Any Device via FortiSIEM Discovery
Any Device via Ping Monitoring
Any Device via SNMP
Any Device via STM Monitoring
Any Device via Syslog or SNMP
Any Log Ingested by FortiSIEM
Any Network Device via SSH Process Monitoring
Any UPS Device via SNMP
Apache via Syslog
APC NetBotz monitoring via SNMP
APC via SNMP Trap
Armis Asset Intelligence Platform via Syslog
Aruba CX Switches via Syslog
Aruba WLC via SNMP Trap
Aruba WLC via Syslog
AWS CloudTrail via AWS_CLOUDTRAIL
AWS Discovery via AWS_SDK
AWS ELB via Syslog
AWS Security Hub via AWS_HUB_SDK
Barracuda WAF via Syslog
Barracuda Web Application Firewall via Syslog
BIND DNS via Syslog
BlueCoat via Syslog
Carbon Black Security Platform via Syslog
Checkpoint Firewall via Syslog or LEA
Checkpoint IPS-1 via LEA/Syslog
Checkpoint via Syslog or Netflow
Cisco ACI via Cisco_APIC_API
Cisco AMP via CISCO_AMP_STREAM_API
Cisco Application Visibility and Control (AVC) logs via Netflow V9
Cisco ASA via SSH
Cisco ASA via Syslog
Cisco ASA VPN Monitoring via SNMP
Cisco Call Manager via CDR Records
Cisco Call Manager via Syslog
Cisco FireAMP via FIREAMP_CLOUD_API or ESTREAMER_SDK
Cisco IOS IPSLA Monitoring via SNMP
Cisco IOS via SSH
Cisco IOS via Syslog
Cisco IOS Via Syslog
Cisco IOS via Syslog or Netflow
Cisco IronPort via Syslog
Cisco Meraki via SNMP trap
Cisco Umbrella via AWS_S3
Cisco Umbrella via HTTPS_ADVANCED (Umbrella API)
Cisco WLAN via Syslog
Cisco WLC via SNMP Trap
Cisco WLC via SNMP Trap
Crowdstrike via FALCON_STREAMING_API or FALCON_DATA_REPLICATOR
CyberArk Enterprise Password Vault via Syslog
CyberX via Syslog
Cylance Protect via Syslog
Dell EquaLogic via SNMP
Digital Defense via FRONTLINE_API
Dragos Platform via Syslog and Nozomi SCADA Guardian/CMC via NOZOMI_API
EMC Clarion via NaviSecCli
F5 via Syslog
FireEye HX via Syslog
FireEye MPS via Syslog
Firewalls via SNMP
FortiAnalyzer via Syslog
FortiClient via FortiEMS_API
FortiClient via Syslog
FortiDeceptor via Syslog
FortiEDR via Syslog
FortiEMS via Syslog
FortiGate via Syslog
FortiGate via Syslog or Netflow
FortiMail via Syslog
FortiManager via Syslog
FortiNDR Cloud API
FortiNDR On-premise via Syslog
FortiNDR via Syslog
FortiProxy via Syslog
FortiRecon via HTTPS Advanced API Integration
FortiSandbox via Syslog
FortiSIEM
FortiSIEM Machine Learning based Detecion
FortiSIEM Profiling
FortiSIEM Self Monitoring
FortiSIEM via Syslog
FortiSwitch via Syslog
FortiWeb Cloud via Syslog
FortiWeb via Syslog
Foundry Ironware Config Change Monitoring via Syslog
Google GCP via GOOGLE_Pub_Sub
Google Workspace via GOOGLE_APPS_ADMIN_SDK
Hillstone Firewall via Syslog
Hillstone Firewall Via Syslog
HP Procurve via Syslog
IBM AIX via Syslog
IBM DB2 via JDBC
InfoBlox NiOS via Syslog
Isilon OneFS Monitoring via SNMP
JBOSS via Syslog
Juniper JunOS via Syslog
Juniper SRX via Syslog
Juniper SRX Via Syslog
Juniper SSG via Syslog
Juniper SSLVPN via Syslog
Liebert FPC Monitoring via SNMP
Liebert HVAC Mionitoring via SNMP
Linux File Monitoring via FortiSIEM Agent
Linux FIM via FortiSIEM Agent
Linux Performance Monitoring via SNMP or FortiSIEM Agent
Linux Process Monitoring via FortiSIEM Agent
Linux via FortiSIEM Agent
Linux via SNMP
Linux via Syslog
Login Data
Microsoft 365 Defender via Graph API
Microsoft 365 Defender via HTTPS_ADVANCED (Graph API)
Microsoft Azure Event Hub via AZURE_PYTHON_SDK
Microsoft Azure via Azure CLI
Microsoft Defender
Microsoft Defender for Endpoint via HTTPS_ADVANCED
Microsoft DNS via FortiSIEM Agent
Microsoft Entra Identity Protection via HTTPS_ADVANCED (Graph API)
Microsoft Exchange monitoring via OMI or FortiSIEM Agent
Microsoft HyperV via OMI
Microsoft IIS Performance Monitoring via OMI or FortiSIEM Agent
Microsoft IIS via FortiSIEM Agent
Microsoft IIS via Syslog
Microsoft Office 365 via Management Activity API
Microsoft Office365 via Management Activity API
Microsoft SQL Server via JDBC
Microsoft Windows Application Log via OMI or FortiSIEM Agent
Microsoft Windows AppX Deployment logs via FortiSIEM Agent
Microsoft Windows BitsClient logs via FortiSIEM Agent
Microsoft Windows Certificate Monitoring via FortiSIEM Agent
Microsoft Windows Code Integrity/Operational logs via FortiSIEM Agent
Microsoft Windows Diagnosis Scripted logs via FortiSIEM Agent
Microsoft Windows DNS (with debug log enabled) via FortiSIEM Agent
Microsoft Windows DNS via FortiSIEM Agent
Microsoft Windows FIM via FortiSIEM Agent
Microsoft Windows Firewall with Advanced Security logs via FortiSIEM Agent
Microsoft Windows MSExchange Management Logs via FortiSIEM Agent
Microsoft Windows OpenSSH/Operational and OpenSSH/Admin Logs via FortiSIEM Agent
Microsoft Windows osquery via FortiSIEM Agent
Microsoft Windows Performance Monitoring via OMI or FortiSIEM Agent
Microsoft Windows Powershell Operational Logs via FortiSIEM Agent
Microsoft Windows Print Service log via FortiSIEM Agent
Microsoft Windows Security Log via OMI or FortiSIEM Agent
Microsoft Windows Shell Core logs via FortiSIEM Agent
Microsoft Windows Sysmon via FortiSIEM Agent
Microsoft Windows System Log via OMI or FortiSIEM Agent
Microsoft Windows Task Scheduler Operational Logs via FortiSIEM Agent
Microsoft Windows Terminal Services LocalSessionManager/Operational logs via FortiSIEM Agent
Microsoft Windows via Active Directory Discovery
Microsoft Windows via FortiSIEM Agent
Microsoft Windows via FortiSIEM Agent with UEBA turned on
Microsoft Windows via OMI
Microsoft Windows via OMI or FortiSIEM Agent
Mimecast via MIMECAST_API
Motorola AirDefense via Syslog
Motorola WiNG WLAN AP via Syslog
NetApp via DataONTAP
NetApp via SNMP Trap
NetScaler via Syslog
Network devices via Syslog
Network Traffic
Nginx via Syslog
Office 365 via Management Activity API
Oracle Database Server via JDBC
Oracle DB Server via JDBC
Oracle OCI via OCI_Streaming_SDK
Otorio RAM2 via Syslog
Palo Alto Cortex XDR via Syslog
Palo Alto PAN-OS via Syslog
Palo Alto Traps Endpoint Security Manager via Syslog
Palo Alto via Syslog or Netflow
Postfix Mail Server via Syslog
Pulse Secure via Syslog
Qualys via QualysAPI
Radvision via SNMP Trap
Rapid7 via NexPose API or InsightVM_API
Riverbed via Syslog
Routers via SNMP
SentinelOne via Syslog
SonicOS via Syslog
SonicWall Firewall via Syslog
Sophos Firewall via Syslog
Sophos Web Filter via Syslog
Squid log via Syslog
Storage Device via SNMP
Symantec CIDS
Symantec Endpoint Protection Service via Syslog
Tenable or Nessus via NessusAPI
Threatdown Nebula via Syslog
Trend Micro Vision One API
TrendMicro Interscan Web Security via Syslog
UserGate UTM Firewall via Syslog
VCenter or ESX via VMSDK
VCenter Performance Monitoring via VMSDK
VMware NSX via Syslog
WatchGuard via Syslog
Windows Security Log via OMI or FortiSIEM Agent
Windows via OMI or FortiSIEM Agent

Rules by MITRE Tactic

Reconnaissance

Name	Tactic	Technique	Severity
Linux: NMAP Process Activity	Reconnaissance	T1592.002,T1595.001	7
Linux: Nping Process Activity	Reconnaissance	T1595.001	7
Mimecast: User clicked malicious link in email	Reconnaissance	T1598.003	9
Phishing attack found but not remediated	Reconnaissance	T1598.002,T1598.003	9
Windows: PUA - Crassus Execution	Reconnaissance	T1590.001	7

Resource Development

Name	Tactic	Technique	Severity
Microsoft Entra: Identity Protection Risky User Identified	Resource Development	T1586.002	9
Office365: Abnormal Logon Detected	Resource Development	T1586.002	9
Office365: Identity Protection Risky Detection Identified	Resource Development	T1586.002	9
Office365: Strong Authentication Disabled for a User	Resource Development	T1586.002	9
Office365: Suspicious File Type Uploaded	Resource Development	T1608.001	9
Oracle OCI: User SMTP Credentials Created	Resource Development	T1585.002	7
Outbreak: Active Directory Privilege Escalation Exploit Detected on Host	Resource Development	T1584.001	9
Outbreak: Active Directory Privilege Escalation Exploit Detected on Network	Resource Development	T1584.001	9
Outbreak: Apache Commons Text RCE Vulnerability Detected on Network	Resource Development	T1586.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Host	Resource Development	T1586.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Network	Resource Development	T1586.002	9
Outbreak: Microsoft Office Follina Vuln Detected on Host	Resource Development	T1584.005	9
Outbreak: Microsoft Office Follina Vuln Detected on Network	Resource Development	T1584.005	9
Outbreak: Prestige Ransomware Detected on Host	Resource Development	T1586.002	9
Outbreak: Prestige Ransomware Detected on Network	Resource Development	T1586.002	9
Outbreak: Sysrv-K Botnet Activity Detected on Host	Resource Development	T1584.005	9
Outbreak: Sysrv-K Botnet Activity Detected on Network	Resource Development	T1584.005	9
Windows: PUA - CsExec Execution	Resource Development	T1587.001	7
Windows: Potential Execution of Sysinternals Tools	Resource Development	T1588.002	3
Windows: Potential Privilege Escalation To LOCAL SYSTEM	Resource Development	T1587.001	7
Windows: Potential PsExec Remote Execution	Resource Development	T1587.001	7
Windows: PsExec/PAExec Escalation to LOCAL SYSTEM	Resource Development	T1587.001	7
Windows: Renamed SysInternals DebugView Execution	Resource Development	T1588.002	7
Windows: VHD Image Download Via Browser	Resource Development	T1587.001	5

Initial Access

Name	Tactic	Technique	Severity
AWS EC2 Network Access Control List Created	Initial Access	T1078.004	3
AWS IAM Assume Role Policy Update	Initial Access	T1078.004	6
AWS IAM Group Created	Initial Access	T1078.004	3
AWS IAM Password Recovery Requested	Initial Access	T1078.004	9
AWS Management Console Root Login	Initial Access	T1078.004	9
AWS Root Login Without MFA	Initial Access	T1078.004	10
AWS SecHub: Tactics: Initial Access Detected	Initial Access	none	7
Azure Automation Account Created	Initial Access	T1078.004	7
Azure Blob Container Access Level Modification	Initial Access	T1190	7
Azure Event Hub Authorization Rule Created or Updated	Initial Access	T1078.004	7
Azure External Guest User Invitation	Initial Access	T1078.004	3
Default password usage	Initial Access	none	7
Excessive Rogue or Unsecure APs Detected	Initial Access	none	9
Outbreak: Kaseya REvil Ransomware File Activity Detected on Host	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Ransomware File Activity Detected on Network	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Suspicious File Hash Found on Host	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Suspicious File Hash Found on Network	Initial Access	T1195.002	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Host	Initial Access	T1190	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Network	Initial Access	T1190	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Host	Initial Access	T1190	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Network	Initial Access	T1190	9
Rogue or Unsecure AP Detected	Initial Access	none	7
Sudden Increase in Failed Logons To A Host	Initial Access	T1078.003	7
Sudden Increase in Successful Logons To A Host	Initial Access	T1078.003	7
Suspicious Database Logon	Initial Access	T1078.003	7
ThreatDown Nebula: Malware Blocked	Initial Access	T1189	8
ThreatDown Nebula: Malware Found	Initial Access	T1189	10
ThreatDown Nebula: Suspicious Activity Blocked	Initial Access	T1189	8
ThreatDown Nebula: Suspicious Activity Found	Initial Access	T1189	9
ThreatDown Nebula: Website Blocked	Initial Access	T1189	7
Uncommon AWS Console Login	Initial Access	T1078.004	7
Uncommon Azure Portal Login	Initial Access	T1078.004	7
Uncommon GSuite Login	Initial Access	T1078.004	7
Uncommon Linux SSH Login	Initial Access	T1078.002	7
Uncommon Office365 Mail Login	Initial Access	T1078.004	7
Uncommon VPN Login	Initial Access	T1078.002	7
Uncommon Windows Server Login	Initial Access	T1078.002	7
User Added as Owner for Azure Application	Initial Access	T1078.004	9
User Added as Owner for Azure Service Principal	Initial Access	T1078.004	9
Windows: Addition of Domain Trusts	Initial Access	T1199	5
Windows: Arbitrary Shell Command Execution Via Settingcontent-Ms	Initial Access	T1566.001	5
Windows: Execution in Outlook Temp Folder	Initial Access	T1566.001	7
Windows: External Disk Drive or USB Storage Device	Initial Access	T1091,T1200	3
Windows: External Remote RDP Logon from Public IP	Initial Access	T1133	5
Windows: External Remote SMB Logon from Public IP	Initial Access	T1133	7
Windows: Failed Logon From Public IP	Initial Access	T1190	5
Windows: HTML Help HH.EXE Suspicious Child Process	Initial Access	T1566.001	7
Windows: ISO File Created Within Temp Folders	Initial Access	T1566.001	7
Windows: ISO Image Mount	Initial Access	T1566.001	5
Windows: Octopus Scanner Malware Detected	Initial Access	T1195.001	7
Windows: Office Macro File Creation	Initial Access	T1566.001	3
Windows: Office Macro File Creation From Suspicious Process	Initial Access	T1566.001	7
Windows: Office Macro File Download	Initial Access	T1566.001	5
Windows: Remote Access Tool - ScreenConnect Suspicious Execution	Initial Access	T1133	7
Windows: Suspicious Double Extension File Execution	Initial Access	T1566.001	9
Windows: Suspicious HH.EXE Execution	Initial Access	T1566.001	7
Windows: Suspicious HWP Sub Processes	Initial Access	T1566.001	7
Windows: Suspicious Microsoft OneNote Child Process	Initial Access	T1566.001	7
Windows: Suspicious Processes Spawned by WinRM	Initial Access	T1190	7
Windows: Unusual Child Process of dns.exe	Initial Access	T1133	7
Windows: Windows Registry Trust Record Modification	Initial Access	T1566.001	5

Execution

Name	Tactic	Technique	Severity
AWS Execution via System Manager	Execution	T1059.006	3
AWS SecHub: Tactics: Execution Detected	Execution	none	8
AlertLogic Incident	Execution	none	7
Azure Command Execution on Virtual Machine	Execution	T1059.006	5
Backdoor Found by Network IPS	Execution	T1204.001	9
Blocked File Execution	Execution	none	8
Code Injection Attack detected by NIPS	Execution	none	9
Crowdstrike: Blocked Exploit	Execution	none	6
Crowdstrike: Drive By Download	Execution	none	8
Crowdstrike: File Blocked With Matching Hash	Execution	none	6
Crowdstrike: Overwatch Detection	Execution	none	9
Cylance Blocked Exploit	Execution	none	7
Cylance Found Active Script	Execution	none	7
Cylance Quarantined Host	Execution	none	7
Cylance Waived Threat	Execution	none	3
CylanceProtect Threat Changed	Execution	none	7
Excessive WLAN Exploits: Same Source	Execution	none	9
Executable file posting from external source	Execution	none	9
Execution via local SxS Shared Module	Execution	T1129	5
FortiEDR: Inconclusive or PUP Process Blocked	Execution	T1204.002	7
FortiEDR: Inconclusive or PUP Process Detected	Execution	T1204.002	8
FortiEDR: Likely Safe Process Blocked	Execution	T1204.002	2
FortiEDR: Likely Safe Process Detected	Execution	T1204.002	4
FortiEDR: Malicious Process Blocked	Execution	T1204.002	9
FortiEDR: Malicious Process Detected	Execution	T1204.002	10
FortiEDR: Safe Process Blocked	Execution	T1204.002	1
FortiEDR: Safe Process Detected	Execution	T1204.002	3
FortiEDR: Suspicious Process Blocked	Execution	T1204.002	7
FortiEDR: Suspicious Process Detected	Execution	T1204.002	8
FortiSandbox detects Network Attack	Execution	none	7
FortiSandbox detects Phishing URL	Execution	T1204.001	9
High Risk Rating Cisco IPS Exploit	Execution	none	9
High Severity Inbound Denied Security Exploit	Execution	none	5
High Severity Inbound Permitted IPS Exploit	Execution	none	9
High Severity Outbound Denied IPS Exploit	Execution	none	9
High Severity Outbound Permitted IPS Exploit	Execution	none	9
High Severity Symantec Host IPS Exploit	Execution	none	9
High Severity WLAN Attack	Execution	none	9
Linux: Interactive Terminal Spawned via Perl	Execution	T1059.004	5
Linux: Interactive Terminal Spawned via Python	Execution	T1059.006	5
Linux: Netcat Process Activity	Execution	T1059.004	7
Linux: socat Process Activity	Execution	T1059.004	7
MS 365 Defender: Exploit Detected	Execution	none	9
MS 365 Defender: Suspicious PowerShell command line Execution Alert	Execution	T1059.001	7
Malicious PowerShell Tool: PSAttack Detected	Execution	T1059.001	9
Multiple Distinct IPS Events From Same Src	Execution	none	9
PowerShell Commandlet of Well Known Exploitation Framework Detected	Execution	T1059.001	9
PowerShell Script Detected Calling a Credential Prompt	Execution	T1059.001	9
Shellshock Expression in Log Files	Execution	none	9
Spyware Found And Cleaned	Execution	T1204.001	5
Spyware Found by Network IPS	Execution	T1204.001	9
Spyware found but not remediated	Execution	T1204.001	9
Suspicious Linux SSHD Errors	Execution	none	7
Suspicious Linux VSFTPD Errors	Execution	none	7
Suspicious Linux log entries	Execution	none	7
System Exploit Detected by Network IPS	Execution	none	7
System Exploit Detected by Network IPS: Likely Success	Execution	none	9
Trend Vision One: Critical or High Alert Triggered	Execution	none	9
Unapproved File Execution	Execution	none	8
Windows Task Scheduler: Task Registered	Execution	T1053.002	6
Windows process communicating outbound to unusual ports	Execution	T1129	6
Windows: Active Directory Kerberos DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Active Directory Parsing DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Application Removed Via Wmic.EXE	Execution	T1047	5
Windows: CLR DLL Loaded Via Office Applications	Execution	T1204.002	5
Windows: CMSTP Execution Process Access	Execution	T1559.001	7
Windows: Change PowerShell Policies to an Insecure Level	Execution	T1059.001	5
Windows: Cmd.EXE Missing Space Characters Execution Anomaly	Execution	T1059.001	7
Windows: Cobalt Strike Service Installations: Security Log	Execution	T1569.002	7
Windows: CobaltStrike Service Installations: System Log	Execution	T1569.002	9
Windows: Computer System Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Conhost.exe CommandLine Path Traversal	Execution	T1059.003	7
Windows: ConvertTo-SecureString Cmdlet Usage Via CommandLine	Execution	T1059.001	5
Windows: Created Files by Office Applications	Execution	T1204.002	7
Windows: Credential Dumping Tools Service Execution - Security	Execution	T1569.002	7
Windows: Credential Dumping Tools Service Execution - System	Execution	T1569.002	7
Windows: Detection of PowerShell Execution via Sqlps.exe	Execution	T1059.001	5
Windows: DotNET Assembly DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Equation Editor Network Connection	Execution	T1203	7
Windows: Exchange PowerShell Snap-Ins Usage	Execution	T1059.001	7
Windows: Execute Code with Pester.bat	Execution	T1059.001	5
Windows: GAC DLL Loaded Via Office Applications	Execution	T1204.002	7
Windows: HackTool - CrackMapExec Execution Patterns	Execution	T1059.003	7
Windows: HackTool - CrackMapExec PowerShell Obfuscation	Execution	T1059.001	7
Windows: HackTool - Default PowerSploit/Empire Scheduled Task Creation	Execution	T1059.001	7
Windows: HackTool - Empire PowerShell Launch Parameters	Execution	T1059.001	7
Windows: HackTool - Koadic Execution	Execution	T1059.007	7
Windows: HackTool - Potential Impacket Lateral Movement Activity	Execution	T1047	7
Windows: HandleKatz Duplicating LSASS Handle	Execution	T1106	7
Windows: Hardware Model Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Hidden Powershell in Link File Pattern	Execution	T1059.001	5
Windows: Import PowerShell Modules From Suspicious Directories - ProcCreation	Execution	T1059.001	5
Windows: Important Scheduled Task Deleted/Disabled	Execution	T1053.005	7
Windows: Interactive AT Job	Execution	T1053.002	7
Windows: Invoke-Obfuscation CLIP Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: Security Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: Sysmon	Execution	T1059.001	5
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: System Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation RUNDLL LAUNCHER: System Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation STDIN Launcher: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation STDIN Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation STDIN Launcher: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR LAUNCHER OBFUSCATION: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR Launcher: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Rundll32: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Rundll32: System Log	Execution	T1059.001	7
Windows: Java Running with Remote Debugging	Execution	T1203	5
Windows: Jlaive Usage For Assembly Execution In-Memory	Execution	T1059.003	5
Windows: LittleCorporal Generated Maldoc Injection	Execution	T1204.002	7
Windows: Login with WMI	Execution	T1047	3
Windows: Malicious Base64 Encoded PowerShell Keywords in Command Lines	Execution	T1059.001	7
Windows: Microsoft Excel Add-In Loaded From Uncommon Location	Execution	T1204.002	5
Windows: Microsoft VBA For Outlook Addin Loaded Via Outlook	Execution	T1204.002	7
Windows: Mimikatz through Windows Remote Management	Execution	T1059.001	7
Windows: New Process Created Via Wmic.EXE	Execution	T1047	5
Windows: Node Process Executions	Execution	T1059.007	5
Windows: Non Interactive PowerShell Process Spawned	Execution	T1059.001	3
Windows: Operator Bloopers Cobalt Strike Commands	Execution	T1059.003	7
Windows: Operator Bloopers Cobalt Strike Modules	Execution	T1059.003	7
Windows: PAExec Service Installation	Execution	T1569.002	5
Windows: PDQ Deploy Remote Adminstartion Tool Execution	Execution	T1072	5
Windows: PUA - NSudo Execution	Execution	T1569.002	7
Windows: PUA - NirCmd Execution	Execution	T1569.002	5
Windows: PUA - NirCmd Execution As LOCAL SYSTEM	Execution	T1569.002	7
Windows: PUA - RunXCmd Execution	Execution	T1569.002	7
Windows: Persistence and Execution at Scale via GPO Scheduled Task	Execution	T1053.005	7
Windows: Potential CommandLine Path Traversal Via Cmd.EXE	Execution	T1059.003	7
Windows: Potential Data Exfiltration Activity Via CommandLine Tools	Execution	T1059.001	7
Windows: Potential Encoded PowerShell Patterns In CommandLine	Execution	T1059.001	3
Windows: Potential Persistence Via Microsoft Compatibility Appraiser	Execution	T1053.005	5
Windows: Potential Persistence Via Powershell Search Order Hijacking - Task	Execution	T1059.001	7
Windows: Potential PowerShell Command Line Obfuscation	Execution	T1059.001	7
Windows: Potential PowerShell Downgrade Attack	Execution	T1059.001	5
Windows: Potential PowerShell Obfuscation Via Reversed Commands	Execution	T1059.001	7
Windows: Potential Powershell ReverseShell Connection	Execution	T1059.001	7
Windows: Potential Product Class Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Potential Product Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS	Execution	T1059.005	5
Windows: Potential Unquoted Service Path Reconnaissance Via Wmic.EXE	Execution	T1047	7
Windows: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell	Execution	T1059.001	5
Windows: Potential WinAPI Calls Via CommandLine	Execution	T1106	7
Windows: PowerShell Base64 Encoded IEX Cmdlet	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded Invoke Keyword	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded Reflective Assembly Load	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded WMI Classes	Execution	T1059.001	7
Windows: PowerShell Core DLL Loaded By Non PowerShell Process	Execution	T1059.001	5
Windows: PowerShell Script Run in AppData	Execution	T1059.001	5
Windows: PowerShell Scripts Installed as Services	Execution	T1569.002	7
Windows: Process Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: ProcessHacker Privilege Elevation	Execution	T1569.002	7
Windows: PsExec Service File Creation	Execution	T1569.002	3
Windows: Read Contents From Stdin Via Cmd.EXE	Execution	T1059.003	5
Windows: Regsvr32 DNS Activity	Execution	T1559.001	7
Windows: Regsvr32 Network Activity	Execution	T1559.001	7
Windows: Remote Access Tool Services Have Been Installed - Security	Execution	T1569.002	5
Windows: Remote Access Tool Services Have Been Installed - System	Execution	T1569.002	5
Windows: Remote PowerShell Session Host Process WinRM	Execution	T1059.001	5
Windows: Remote PowerShell Session Network	Execution	T1059.001	7
Windows: Remote PowerShell Sessions	Execution	T1059.001	7
Windows: Remote Task Creation via ATSVC Named Pipe	Execution	T1053.002	5
Windows: Restricted Software Access By SRP	Execution	T1072	7
Windows: SQL Client Tools PowerShell Session Detection	Execution	T1059.001	5
Windows: Scheduled Task Creation	Execution	T1053.005	3
Windows: Scheduled Task Executing Powershell Encoded Payload from Registry	Execution	T1059.001	7
Windows: Schtasks Creation Or Modification With SYSTEM Privileges	Execution	T1053.005	7
Windows: Schtasks From Suspicious Folders	Execution	T1053.005	7
Windows: Script Event Consumer Spawning Process	Execution	T1047	7
Windows: Service Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Service Started/Stopped Via Wmic.EXE	Execution	T1047	5
Windows: Sliver C2 Default Service Installation	Execution	T1569.002	7
Windows: Start Windows Service Via Net.EXE	Execution	T1569.002	3
Windows: Suspicious Add Scheduled Command Pattern	Execution	T1053.005	7
Windows: Suspicious Binary In User Directory Spawned From Office Application	Execution	T1204.002	7
Windows: Suspicious Csi.exe Usage	Execution	T1072	5
Windows: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call	Execution	T1059.001	7
Windows: Suspicious Encoded PowerShell Command Line	Execution	T1059.001	7
Windows: Suspicious Execution of Powershell with Base64	Execution	T1059.001	5
Windows: Suspicious File Characteristics Due to Missing Fields	Execution	T1059.006	5
Windows: Suspicious File Execution From Internet Hosted WebDav Share	Execution	T1059.001	7
Windows: Suspicious Modification Of Scheduled Tasks	Execution	T1053.005	7
Windows: Suspicious Mshta.EXE Execution Patterns	Execution	T1106	7
Windows: Suspicious Outlook Child Process	Execution	T1204.002	7
Windows: Suspicious PowerShell Download and Execute Pattern	Execution	T1059.001	7
Windows: Suspicious PowerShell Encoded Command Patterns	Execution	T1059.001	7
Windows: Suspicious PowerShell Invocation From Script Engines	Execution	T1059.001	5
Windows: Suspicious PowerShell Parameter Substring	Execution	T1059.001	7
Windows: Suspicious PowerShell Parent Process	Execution	T1059.001	7
Windows: Suspicious Process Created Via Wmic.EXE	Execution	T1047	7
Windows: Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	Execution	T1059.005	7
Windows: Suspicious Scheduled Task Creation	Execution	T1053.005	7
Windows: Suspicious Scheduled Task Creation Involving Temp Folder	Execution	T1053.005	7
Windows: Suspicious Scheduled Task Creation via Masqueraded XML File	Execution	T1053.005	5
Windows: Suspicious Scheduled Task Name As GUID	Execution	T1053.005	5
Windows: Suspicious Scheduled Task Update	Execution	T1053.005	7
Windows: Suspicious Schtasks Execution AppData Folder	Execution	T1059.001	7
Windows: Suspicious Schtasks From Env Var Folder	Execution	T1053.005	7
Windows: Suspicious Schtasks Schedule Type With High Privileges	Execution	T1053.005	5
Windows: Suspicious Schtasks Schedule Types	Execution	T1053.005	7
Windows: Suspicious WSMAN Provider Image Loads	Execution	T1059.001	5
Windows: T1047 Wmiprvse Wbemcomn DLL Hijack	Execution	T1047	7
Windows: Usage Of Web Request Commands And Cmdlets	Execution	T1059.001	5
Windows: Use Radmin Viewer Utility	Execution	T1072	7
Windows: VBA DLL Loaded Via Office Application	Execution	T1204.002	7
Windows: WMIC Remote Command Execution	Execution	T1047	5
Windows: WinDbg/CDB LOLBIN Usage	Execution	T1106	5
Windows: Windows Hotfix Updates Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Windows Shell/Scripting Processes Spawning Suspicious Programs	Execution	T1059.005	7
Windows: WmiPrvSE Spawned A Process	Execution	T1047	5
Windows: Wmiexec Default Output File	Execution	T1047	9
Windows: Wmiprvse Wbemcomn DLL Hijack: Sysmon	Execution	T1047	9
Windows: Wmiprvse Wbemcomn DLL Hijack: Sysmon V2	Execution	T1047	7

Persistence

Name	Tactic	Technique	Severity
AWS IAM User Added to Group	Persistence	T1098.001	9
AWS RDS Cluster Created	Persistence	T1505.003	3
AWS SecHub: Tactics: Persistence Detected	Persistence	none	9
Adware process found	Persistence	none	7
ArubaOS-CX: User Added	Persistence	T1136.001	9
Azure Automation Runbook Created or Modified	Persistence	none	3
Azure Automation Webhook Created	Persistence	none	3
Azure Conditional Access Policy Modified	Persistence	T1098.001	8
Azure Global Administrator Role Added to PIM User	Persistence	T1098.001	9
Azure Privilege Identity Management Role Modified	Persistence	T1098.001	7
Common Windows process launched by unusual parent	Persistence	T1037.001	8
Common Windows process launched from unusual path	Persistence	T1037.001	8
Compromised Host Detected by Network IPS	Persistence	none	9
Crowdstrike: Establish Persistence	Persistence	none	8
Crowdstrike: Excessive suspicious activity on a host	Persistence	none	8
Crowdstrike: Exploit Pivot	Persistence	none	8
Crowdstrike: Intel Detection	Persistence	none	9
Crowdstrike: Machine Learning Anomaly Detected	Persistence	none	8
Crowdstrike: Malicious Document Detected	Persistence	none	8
Crowdstrike: NextGen Antivirus based Malware	Persistence	none	8
Crowdstrike: Ransomware	Persistence	none	8
Crowdstrike: Server Compromise Likely	Persistence	none	9
Crowdstrike: Suspicious Activity	Persistence	none	8
Crowdstrike: Suspicious Processes Terminated	Persistence	none	6
Cylance High Severity Threat	Persistence	none	9
Cylance Low Severity Threat	Persistence	none	3
Cylance Medium Severity Threat	Persistence	none	7
Database user or group changes	Persistence	T1098.001	7
FireAMP Malicious file execution	Persistence	none	9
FireEye HX IOC found	Persistence	none	9
FortiGate: Admin User Added	Persistence	T1136.001	9
FortiGate: Admin User Added via Console	Persistence	T1136.001	9
FortiSIEM User Created	Persistence	T1136.001	7
GCP: IAM Custom Role Created	Persistence	T1078.004	9
GCP: IAM Member assigned role of type admin or owner	Persistence	T1098.001	9
GCP: Service Account Access Key Created	Persistence	T1098.001	9
GCP: Service Account Created	Persistence	T1136.003	9
Google Workspace: API Access Permitted for OAUTH Client	Persistence	T1098.001	7
Google Workspace: Role Assigned to User	Persistence	T1098.001	9
Google Workspace: Role Created by User	Persistence	T1098.001	9
Google Workspace: Role Modified by User	Persistence	T1098.001	9
Linux Account Unlocked	Persistence	T1098.001	7
Linux User Account Properties Changed	Persistence	T1098.001	7
Linux User Added to Administrative Groups	Persistence	T1098.001	9
Linux User Added to Groups	Persistence	T1098.001	7
Linux User Created	Persistence	T1136.001	8
Linux User Deleted	Persistence	T1098.001	7
Linux User Deleted from Admin Groups	Persistence	T1098.001	9
Linux User Deleted from Groups	Persistence	T1098.001	7
Linux User Name Changed	Persistence	T1098.001	7
Linux User Password Changed	Persistence	T1098.001	7
Linux: Creation of Kernel Module	Persistence	T1547.006	5
Linux: Creation or Modification of Systemd Service	Persistence	T1543.002	5
Linux: Job Schedule Modification	Persistence	T1053.003	5
Linux: Kernel Module Modification	Persistence	T1547.006	7
Linux: Modifications of .bash-profile and .bashrc	Persistence	T1546.004	7
Linux: Potential Shell via Web Server	Persistence	T1505.003	7
Linux: Scheduled Job Execution	Persistence	T1053.003	5
MS 365 Defender: Persistence Detected	Persistence	none	8
MS 365 Defender: Suspicious Activity Detected	Persistence	none	7
MS 365 Defender: Suspicious Task Scheduler activity - Persistence Alert	Persistence	T1053.002	9
MS 365 Defender: Unwanted Software Detected	Persistence	none	7
Malware found by firewall but not remediated	Persistence	none	9
Meraki New Splash User	Persistence	T1098.001	7
Oracle OCI: Customer Secret Key Created	Persistence	T1098.001	9
Oracle OCI: Group Created	Persistence	T1098.001	7
Oracle OCI: User API Key Created and Uploaded	Persistence	T1098.001	7
Oracle OCI: User Added to a Group	Persistence	T1098.001	9
Oracle OCI: User Auth Token Created	Persistence	T1098.001	7
Oracle OCI: User Created	Persistence	T1136.003	9
Oracle OCI: User Disabled MFA	Persistence	T1098.001	9
Oracle OCI: User OAuth Client Credential Created	Persistence	T1098.001	9
Rootkit found	Persistence	T1014,T1554,T1601.001	9
Transient Windows Account Usage - Scheduled	Persistence	T1098.001	9
User added to Administrator Group	Persistence	T1136.001	9
User added to Backup Operator Group	Persistence	T1136.001	6
User added to DNS Admin Group	Persistence	T1136.001	9
User added to Domain Admin Group	Persistence	T1136.001	9
User added to Remote Desktop User Group	Persistence	T1136.001	9
Windows Account Unlocked	Persistence	T1098.001	7
Windows Groups Changed	Persistence	T1098.001	7
Windows Groups Created	Persistence	T1136.001	7
Windows Groups Deleted	Persistence	T1098.001	7
Windows User Account Disabled	Persistence	T1098.001	7
Windows User Account Enabled	Persistence	T1098.001	7
Windows User Account Name Changed	Persistence	T1098.001	7
Windows User Account Properties Changed	Persistence	T1098.001	7
Windows User Added to Groups	Persistence	T1098.001	7
Windows User Created	Persistence	T1136.001	7
Windows User Deleted	Persistence	T1098.001	7
Windows User Password Changed	Persistence	T1098.001	7
Windows User Removed from Groups	Persistence	T1098.001	7
Windows User or Group Modification	Persistence	T1098.001	6
Windows: A Member Was Added to a Security-Enabled Global Group	Persistence	none	3
Windows: A Member Was Removed From a Security-Enabled Global Group	Persistence	none	3
Windows: A Rule Has Been Deleted From The Windows Firewall Exception List	Persistence	none	5
Windows: A Security-Enabled Global Group Was Deleted	Persistence	none	3
Windows: AADInternals PowerShell Cmdlets Execution - ProccessCreation	Persistence	none	7
Windows: ADCS Certificate Template Configuration Vulnerability	Persistence	none	3
Windows: ADCS Certificate Template Configuration Vulnerability with Risky EKU	Persistence	none	7
Windows: AWL Bypass with Winrm.vbs and WsmPty.xsl/WsmTxt.xsl: Sysmon	Persistence	none	5
Windows: AWL Bypass with Winrm.vbs and WsmPty.xsl/WsmTxt.xsl: Sysmon2	Persistence	none	5
Windows: Abused Debug Privilege by Arbitrary Parent Processes	Persistence	none	7
Windows: Abusing IEExec To Download Payloads	Persistence	none	7
Windows: Abusing Print Executable	Persistence	none	5
Windows: Account Tampering - Suspicious Failed Logon Reasons	Persistence	none	5
Windows: Active Directory Structure Export Via Csvde.EXE	Persistence	none	5
Windows: Active Directory Structure Export Via Ldifde.EXE	Persistence	none	5
Windows: Active Directory User Backdoors	Persistence	none	7
Windows: Add Insecure Download Source To Winget	Persistence	none	7
Windows: Add New Download Source To Winget	Persistence	none	5
Windows: Add Potential Suspicious New Download Source To Winget	Persistence	none	7
Windows: Add User to Local Administrators Group	Persistence	none	5
Windows: Add Windows Capability Via PowerShell Cmdlet	Persistence	none	5
Windows: Add or Remove Computer from DC	Persistence	none	3
Windows: AgentExecutor PowerShell Execution	Persistence	none	5
Windows: All Rules Have Been Deleted From The Windows Firewall Configuration	Persistence	none	7
Windows: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE	Persistence	T1543.003	7
Windows: Anydesk Remote Access Software Service Installation	Persistence	none	5
Windows: Application Whitelisting Bypass via Dxcap.exe	Persistence	none	5
Windows: Application Whitelisting Bypass via PresentationHost.exe	Persistence	none	5
Windows: Arbitrary Binary Execution Using GUP Utility	Persistence	none	5
Windows: Arbitrary File Download Via MSPUB.EXE	Persistence	none	5
Windows: Arbitrary MSI Download Via Devinit.EXE	Persistence	none	5
Windows: Atbroker Registry Change	Persistence	none	5
Windows: Base64 MZ Header In CommandLine	Persistence	none	7
Windows: Capture Credentials with Rpcping.exe	Persistence	none	5
Windows: Certificate Exported Via Certutil.EXE	Persistence	none	5
Windows: Change Default File Association To Executable Via Assoc	Persistence	T1546.001	7
Windows: Change Default File Association Via Assoc	Persistence	T1546.001	3
Windows: Chopper Webshell Process Pattern	Persistence	T1505.003	7
Windows: Code Integrity Attempted DLL Load	Persistence	none	7
Windows: Code Integrity Blocked Driver Load	Persistence	none	7
Windows: Computer Password Change Via Ksetup.EXE	Persistence	none	5
Windows: Conhost Spawned By Uncommon Parent Process	Persistence	none	5
Windows: Console CodePage Lookup Via CHCP	Persistence	none	5
Windows: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE	Persistence	none	7
Windows: Created Files by Microsoft Sync Center	Persistence	none	5
Windows: Creation Exe for Service with Unquoted Path	Persistence	T1547.009	7
Windows: Creation of a Diagcab	Persistence	none	5
Windows: Creation of a Local Hidden User Account by Registry	Persistence	T1136.001	7
Windows: DLL Execution Via Register-cimprovider.exe	Persistence	none	5
Windows: DLL Execution via Rasautou.exe	Persistence	none	5
Windows: DLL Load By System Process From Suspicious Locations	Persistence	none	7
Windows: DLL Load via LSASS	Persistence	T1547.008	7
Windows: DLL Loaded via CertOC.EXE	Persistence	none	5
Windows: DNS HybridConnectionManager Service Bus	Persistence	T1554	7
Windows: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE	Persistence	T1543.003	7
Windows: Deployment AppX Package Was Blocked By AppLocker	Persistence	none	5
Windows: Deployment Of The AppX Package Was Blocked By The Policy	Persistence	none	5
Windows: Detected Windows Software Discovery	Persistence	none	5
Windows: Detecting Fake Instances Of Hxtsr.exe	Persistence	none	5
Windows: Device Installation Blocked	Persistence	none	5
Windows: DeviceCredentialDeployment Execution	Persistence	none	5
Windows: Devtoolslauncher.exe Executes Specified Binary	Persistence	none	7
Windows: DiagTrackEoP Default Login Username	Persistence	none	9
Windows: Direct Autorun Keys Modification	Persistence	T1547.001	5
Windows: Dllhost.EXE Execution Anomaly	Persistence	none	7
Windows: DotNet CLR DLL Loaded By Scripting Applications	Persistence	none	7
Windows: Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN	Persistence	none	5
Windows: Download Arbitrary Files Via MSOHTMED.EXE	Persistence	none	5
Windows: Download Arbitrary Files Via PresentationHost.exe	Persistence	none	5
Windows: DriverQuery.EXE Execution	Persistence	none	5
Windows: Drop Binaries Into Spool Drivers Color Folder	Persistence	none	5
Windows: Dump Ntds.dit To Suspicious Location	Persistence	none	5
Windows: DumpStack.log Defender Evasion	Persistence	none	9
Windows: ETW Logging Tamper In .NET Processes	Persistence	none	7
Windows: Email Exifiltration Via Powershell	Persistence	none	7
Windows: Enabled User Right in AD to Control User Objects	Persistence	none	7
Windows: Execute Files with Msdeploy.exe	Persistence	none	5
Windows: Execute MSDT Via Answer File	Persistence	none	7
Windows: Execute Pcwrun.EXE To Leverage Follina	Persistence	none	7
Windows: Execution Of Non-Existing File	Persistence	none	7
Windows: Execution from Suspicious Folder	Persistence	none	7
Windows: Execution of Powershell Script in Public Folder	Persistence	none	7
Windows: Execution of Suspicious File Type Extension	Persistence	none	7
Windows: Execution via WorkFolders.exe	Persistence	none	7
Windows: Execution via stordiag.exe	Persistence	none	7
Windows: Explorer Process Tree Break	Persistence	none	5
Windows: Failed MSExchange Transport Agent Installation	Persistence	T1505.002	7
Windows: File Creation In Suspicious Directory By Msdt.EXE	Persistence	T1547.001	7
Windows: File Decoded From Base64/Hex Via Certutil.EXE	Persistence	none	5
Windows: File Download Using ProtocolHandler.exe	Persistence	none	5
Windows: File Encoded To Base64 Via Certutil.EXE	Persistence	none	5
Windows: Format.com FileSystem LOLBIN	Persistence	none	7
Windows: Fsutil Behavior Set SymlinkEvaluation	Persistence	none	5
Windows: Fsutil Suspicious Invocation	Persistence	none	7
Windows: GatherNetworkInfo.VBS Reconnaissance Script Output	Persistence	none	5
Windows: Gpresult Display Group Policy Information	Persistence	none	5
Windows: Gpscript Execution	Persistence	none	5
Windows: Gzip Archive Decode Via PowerShell	Persistence	none	5
Windows: HackTool - Certify Execution	Persistence	none	7
Windows: HackTool - Certipy Execution	Persistence	none	7
Windows: HackTool - CrackMapExec Execution	Persistence	none	7
Windows: HackTool - DInjector PowerShell Cradle Execution	Persistence	none	9
Windows: HackTool - GMER Rootkit Detector and Remover Execution	Persistence	none	7
Windows: HackTool - Htran/NATBypass Execution	Persistence	none	7
Windows: HackTool - LocalPotato Execution	Persistence	none	7
Windows: HackTool - PCHunter Execution	Persistence	none	7
Windows: HackTool - PurpleSharp Execution	Persistence	none	9
Windows: HackTool - SILENTTRINITY Stager DLL Load	Persistence	none	7
Windows: HackTool - SILENTTRINITY Stager Execution	Persistence	none	7
Windows: HackTool - SecurityXploded Execution	Persistence	none	9
Windows: HackTool - SharPersist Execution	Persistence	none	7
Windows: HackTool - SharpLDAPmonitor Execution	Persistence	none	5
Windows: HackTool - Sliver C2 Implant Activity Pattern	Persistence	none	9
Windows: HackTool - Wmiexec Default Powershell Command	Persistence	none	7
Windows: Hidden Local User Creation	Persistence	T1136.001	7
Windows: HybridConnectionManager Service Installation	Persistence	T1554	7
Windows: HybridConnectionManager Service Installation: Sysmon	Persistence	none	7
Windows: IIS Native-Code Module Command Line Installation	Persistence	T1505.003	5
Windows: ISO or Image Mount Indicator in Recent Files	Persistence	none	5
Windows: Ie4uinit Lolbin Use From Invalid Path	Persistence	none	5
Windows: ImagingDevices Unusual Parent/Child Processes	Persistence	none	7
Windows: Important Windows Service Terminated Unexpectedly	Persistence	none	7
Windows: Important Windows Service Terminated With Error	Persistence	none	7
Windows: Indirect Command Execution By Program Compatibility Wizard	Persistence	none	3
Windows: InfDefaultInstall.exe .inf Execution	Persistence	none	5
Windows: Install New Package Via Winget Local Manifest	Persistence	none	5
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: Security Log	Persistence	none	7
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: System Log	Persistence	none	7
Windows: KDC RC4-HMAC Downgrade CVE-2022-37966	Persistence	none	7
Windows: Kavremover Dropped Binary LOLBIN Usage	Persistence	none	7
Windows: KrbRelayUp Service Installation	Persistence	none	7
Windows: LOLBAS Data Exfiltration by DataSvcUtil.exe	Persistence	none	5
Windows: LSA PPL Protection Disabled Via Reg.EXE	Persistence	none	7
Windows: Legitimate Application Dropped Archive	Persistence	none	7
Windows: Legitimate Application Dropped Executable	Persistence	none	7
Windows: Legitimate Application Dropped Script	Persistence	none	7
Windows: Loading Diagcab Package From Remote Path	Persistence	none	7
Windows: Local User Creation	Persistence	T1136.001	3
Windows: Locked Workstation	Persistence	none	3
Windows: Logged-On User Password Change Via Ksetup.EXE	Persistence	none	5
Windows: Lolbin Defaultpack.exe Use As Proxy	Persistence	none	5
Windows: Lolbin Runexehelper Use As Proxy	Persistence	none	5
Windows: Lolbin Unregmp2.exe Use As Proxy	Persistence	none	5
Windows: MSExchange Transport Agent Installation	Persistence	T1505.002	5
Windows: MSI Installation From Suspicious Locations	Persistence	none	5
Windows: MSSQL Add Account To Sysadmin Role	Persistence	none	7
Windows: MSSQL Disable Audit Settings	Persistence	none	7
Windows: MSSQL SPProcoption Set	Persistence	none	7
Windows: MSSQL XPCmdshell Option Change	Persistence	none	7
Windows: MSSQL XPCmdshell Suspicious Execution	Persistence	none	7
Windows: Malicious PE Execution by Microsoft Visual Studio Debugger	Persistence	none	5
Windows: Malicious Windows Script Components File Execution by TAEF Detection	Persistence	none	3
Windows: Manage Engine Java Suspicious Sub Process	Persistence	none	7
Windows: Microsoft IIS Connection Strings Decryption	Persistence	none	7
Windows: Microsoft IIS Service Account Password Dumped	Persistence	none	7
Windows: Microsoft Sync Center Suspicious Network Connections	Persistence	none	5
Windows: Mimikatz Kirbi File Creation	Persistence	none	9
Windows: Moriya Rootkit: System Log	Persistence	T1543.003	9
Windows: MpiExec Lolbin	Persistence	none	7
Windows: Mshtml DLL RunHTMLApplication Abuse	Persistence	none	7
Windows: Mstsc.EXE Execution From Uncommon Parent	Persistence	none	7
Windows: NPPSpy Hacktool Usage	Persistence	none	7
Windows: Narrator s Feedback-Hub Persistence	Persistence	T1547.001	7
Windows: NetSupport Manager Service Install	Persistence	none	5
Windows: New ActiveScriptEventConsumer Created Via Wmic.EXE	Persistence	T1546.003	7
Windows: New DLL Added to AppCertDlls Registry Key	Persistence	T1546.009	5
Windows: New DLL Added to AppInit-DLLs Registry Key	Persistence	T1546.010	5
Windows: New Firewall Exception Rule Added For A Suspicious Folder	Persistence	none	7
Windows: New Firewall Rule Added In Windows Firewall Exception List	Persistence	none	5
Windows: New Kernel Driver Via SC.EXE	Persistence	T1543.003	5
Windows: New PDQDeploy Service - Client Side	Persistence	T1543.003	5
Windows: New PDQDeploy Service - Server Side	Persistence	T1543.003	5
Windows: New Port Forwarding Rule Added Via Netsh.EXX	Persistence	none	5
Windows: New Service Creation Using PowerShell	Persistence	T1543.003	3
Windows: New Service Creation Using Sc.EXE	Persistence	T1543.003	3
Windows: New Shim Database Created in the Default Directory	Persistence	T1547.009	5
Windows: New User Created Via Net.EXE	Persistence	T1136.001	5
Windows: New User Created Via Net.EXE With Never Expire Option	Persistence	T1136.001	7
Windows: New or Renamed User Account with $ in Attribute SamAccountName	Persistence	none	7
Windows: Ngrok Usage with Remote Desktop Service	Persistence	none	7
Windows: Nslookup PowerShell Download Cradle - ProcessCreation	Persistence	none	5
Windows: Ntdsutil Abuse	Persistence	none	5
Windows: Obfuscated IP Download	Persistence	none	5
Windows: Obfuscated IP Via CLI	Persistence	none	5
Windows: Office Application Startup - Office Test	Persistence	T1137.002	5
Windows: OneNote Attachment File Dropped In Suspicious Location	Persistence	none	5
Windows: OpenWith.exe Executes Specified Binary	Persistence	none	7
Windows: Outgoing Logon with New Credentials	Persistence	none	3
Windows: PCRE.NET Package Image Load	Persistence	none	7
Windows: PCRE.NET Package Temp Files	Persistence	none	7
Windows: PUA - AdvancedRun Execution	Persistence	none	5
Windows: PUA - AdvancedRun Suspicious Execution	Persistence	none	7
Windows: PUA - Fast Reverse Proxy FRP Execution	Persistence	none	7
Windows: PUA - NPS Tunneling Tool Execution	Persistence	none	7
Windows: PUA - Process Hacker Driver Load	Persistence	none	7
Windows: PUA - Process Hacker Execution	Persistence	none	7
Windows: PUA - System Informer Driver Load	Persistence	none	5
Windows: PUA - System Informer Execution	Persistence	none	5
Windows: PUA - Wsudo Suspicious Execution	Persistence	none	7
Windows: PUA- IOX Tunneling Tool Execution	Persistence	none	7
Windows: Parent in Public Folder Suspicious Process	Persistence	none	7
Windows: Password Change on Directory Service Restore Mode DSRM Account	Persistence	T1098.003	7
Windows: Password Protected ZIP File Opened	Persistence	none	5
Windows: Password Protected ZIP File Opened Email Attachment	Persistence	none	7
Windows: Password Protected ZIP File Opened Suspicious Filenames	Persistence	none	7
Windows: Password Provided In Command Line Of Net.EXE	Persistence	none	5
Windows: Path To Screensaver Binary Modified	Persistence	T1546.002	5
Windows: Perl Inline Command Execution	Persistence	none	5
Windows: Persistence Via Sticky Key Backdoor	Persistence	T1546.008	9
Windows: Persistence Via TypedPaths - CommandLine	Persistence	none	5
Windows: Phishing Pattern ISO in Archive	Persistence	none	7
Windows: Php Inline Command Execution	Persistence	none	5
Windows: PortProxy Registry Key	Persistence	none	5
Windows: Possible Shadow Credentials Added	Persistence	none	7
Windows: Possible Shim Database Persistence via sdbinst.exe	Persistence	T1546.011	7
Windows: Potential Active Directory Enumeration Using AD Module - ProcCreation	Persistence	none	5
Windows: Potential Arbitrary Code Execution Via Node.EXE	Persistence	none	7
Windows: Potential Binary Or Script Dropper Via PowerShell	Persistence	none	5
Windows: Potential COM Objects Download Cradles Usage - Process Creation	Persistence	none	5
Windows: Potential Cobalt Strike Process Patterns	Persistence	none	7
Windows: Potential Command Line Path Traversal Evasion Attempt	Persistence	none	5
Windows: Potential Credential Dumping Attempt Using New NetworkProvider - CLI	Persistence	none	7
Windows: Potential DLL File Download Via PowerShell Invoke-WebRequest	Persistence	none	5
Windows: Potential DLL Sideloading Using Coregen.exe	Persistence	none	5
Windows: Potential Discovery Activity Via Dnscmd.EXE	Persistence	T1543.003	5
Windows: Potential Dosfuscation Activity	Persistence	none	5
Windows: Potential Malicious AppX Package Installation Attempts	Persistence	none	5
Windows: Potential Manage-bde.wsf Abuse To Proxy Execution	Persistence	none	7
Windows: Potential NTLM Coercion Via Certutil.EXE	Persistence	none	7
Windows: Potential Password Spraying Attempt Using Dsacls.EXE	Persistence	none	5
Windows: Potential Persistence Attempt Via ErrorHandler.Cmd	Persistence	none	5
Windows: Potential Persistence Via Microsoft Office Add-In	Persistence	T1137.006	7
Windows: Potential Persistence Via Netsh Helper DLL	Persistence	T1546.007	7
Windows: Potential Persistence Via Notepad Plugins	Persistence	none	5
Windows: Potential Persistence Via Outlook Form	Persistence	T1137.003	7
Windows: Potential PowerShell Execution Policy Tampering - ProcCreation	Persistence	none	7
Windows: Potential Privilege Escalation Attempt Via .Exe.Local Technique	Persistence	none	7
Windows: Potential Privilege Escalation Using Symlink Between Osk and Cmd	Persistence	T1546.008	7
Windows: Potential Process Injection Via Msra.EXE	Persistence	none	7
Windows: Potential RDP Session Hijacking Activity	Persistence	none	5
Windows: Potential Recon Activity Using DriverQuery.EXE	Persistence	none	7
Windows: Potential Remote Credential Dumping Activity	Persistence	none	7
Windows: Potential Remote Desktop Tunneling	Persistence	none	5
Windows: Potential Renamed Rundll32 Execution	Persistence	none	7
Windows: Potential RipZip Attack on Startup Folder	Persistence	none	7
Windows: Potential Signing Bypass Via Windows Developer Features	Persistence	none	7
Windows: Potential Suspicious Mofcomp Execution	Persistence	none	7
Windows: Potential Suspicious PowerShell Module File Created	Persistence	none	5
Windows: Potential Suspicious Windows Feature Enabled - ProcCreation	Persistence	none	5
Windows: Potential Windows Defender Tampering Via Wmic.EXE	Persistence	T1546.008	7
Windows: Potential Winnti Dropper Activity	Persistence	none	7
Windows: Potentially Over Permissive Permissions Granted Using Dsacls.EXE	Persistence	none	5
Windows: Potentially Suspicious GoogleUpdate Child Process	Persistence	none	7
Windows: Potentially Suspicious Network Connection To Notion API	Persistence	none	3
Windows: PowerShell Download and Execution Cradles	Persistence	none	7
Windows: PowerShell Module File Created	Persistence	none	3
Windows: PowerShell Module File Created By Non-PowerShell Process	Persistence	none	5
Windows: PowerShell Profile Modification	Persistence	T1546.013	7
Windows: PowerShell Script Dropped Via PowerShell.EXE	Persistence	none	3
Windows: PowerShell Web Download	Persistence	none	5
Windows: PowerShell Writing Startup Shortcuts	Persistence	T1547.001	7
Windows: Powershell Inline Execution From A File	Persistence	none	5
Windows: Powershell Token Obfuscation - Process Creation	Persistence	none	7
Windows: Powerview Add-DomainObjectAcl DCSync AD Extend Right	Persistence	none	7
Windows: PrinterNightmare Mimimkatz Driver Name	Persistence	none	9
Windows: Privilege Escalation via Named Pipe Impersonation	Persistence	none	7
Windows: Process Creation Using Sysnative Folder	Persistence	none	5
Windows: Process Memory Dump Via Dotnet-Dump	Persistence	none	5
Windows: Proxy Execution via Wuauclt	Persistence	none	7
Windows: PsExec Service Child Process Execution as LOCAL SYSTEM	Persistence	none	7
Windows: PsExec Service Execution	Persistence	none	5
Windows: Psexec Execution	Persistence	none	5
Windows: Publisher Attachment File Dropped In Suspicious Location	Persistence	none	5
Windows: Python Inline Command Execution	Persistence	none	5
Windows: Python Spawning Pretty TTY on Windows	Persistence	none	7
Windows: Query Usage To Exfil Data	Persistence	none	5
Windows: RDP File Creation From Suspicious Application	Persistence	none	7
Windows: RDP Port Forwarding Rule Added Via Netsh.EXE	Persistence	none	7
Windows: REGISTER-APP.VBS Proxy Execution	Persistence	none	5
Windows: RTCore Suspicious Service Installation	Persistence	none	7
Windows: Reg Add RUN Key	Persistence	T1547.001	5
Windows: Regedit as Trusted Installer	Persistence	none	7
Windows: Registry Persistence Mechanisms in Recycle Bin	Persistence	none	7
Windows: Remote Access Tool - NetSupport Execution From Unusual Location	Persistence	none	5
Windows: Remote Access Tool - RURAT Execution From Unusual Location	Persistence	none	5
Windows: Remote Code Execute via Winrm.vbs	Persistence	none	5
Windows: Remote Utilities Host Service Install	Persistence	none	5
Windows: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses	Persistence	none	7
Windows: Renamed AutoHotkey.EXE Execution	Persistence	none	5
Windows: Renamed MegaSync Execution	Persistence	none	7
Windows: Renamed NetSupport RAT Execution	Persistence	none	7
Windows: Renamed Office Binary Execution	Persistence	none	7
Windows: Renamed Plink Execution	Persistence	none	7
Windows: Renamed PsExec Service Execution	Persistence	none	7
Windows: Renamed Remote Utilities RAT RURAT Execution	Persistence	none	5
Windows: Replay Attack Detected	Persistence	none	7
Windows: Ruby Inline Command Execution	Persistence	none	5
Windows: Run PowerShell Script from Redirected Input Stream	Persistence	none	7
Windows: Rundll32 Registered COM Objects	Persistence	T1546.015	7
Windows: Rundll32 With Suspicious Parent Process	Persistence	none	5
Windows: SCM Database Privileged Operation	Persistence	none	5
Windows: Script Interpreter Execution From Suspicious Folder	Persistence	none	7
Windows: Sdiagnhost Calling Suspicious Child Process	Persistence	none	7
Windows: Security Support Provider SSP Added to LSA Configuration	Persistence	T1547.005	9
Windows: Service Installation in Suspicious Folder	Persistence	T1543.003	5
Windows: Service Installation with Suspicious Folder Pattern	Persistence	T1543.003	7
Windows: Service Installed By Unusual Client - Security	Persistence	none	7
Windows: Service Installed By Unusual Client - System	Persistence	none	7
Windows: Shells Spawned by Java	Persistence	none	5
Windows: Shells Spawned by Web Servers	Persistence	T1505.003	7
Windows: Standard User In High Privileged Group	Persistence	none	5
Windows: Start of NT Virtual DOS Machine	Persistence	none	5
Windows: Startup Folder File Write	Persistence	T1547.001	5
Windows: Sticky Key Like Backdoor Execution	Persistence	T1546.008	9
Windows: Sticky Key Like Backdoor Usage - Registry	Persistence	T1546.008	9
Windows: Suspect Svchost Activity	Persistence	none	7
Windows: Suspicious ASPX File Drop by Exchange	Persistence	T1505.003	7
Windows: Suspicious Add User to Remote Desktop Users Group	Persistence	T1136.001	7
Windows: Suspicious AgentExecutor PowerShell Execution	Persistence	none	7
Windows: Suspicious AppX Package Installation Attempt	Persistence	none	5
Windows: Suspicious AppX Package Locations	Persistence	none	7
Windows: Suspicious Application Installed	Persistence	none	5
Windows: Suspicious CMD Shell Output Redirect	Persistence	none	5
Windows: Suspicious Cabinet File Expansion	Persistence	none	5
Windows: Suspicious Calculator Usage	Persistence	none	7
Windows: Suspicious Child Process Of SQL Server	Persistence	T1505.003	7
Windows: Suspicious Child Process Of Veeam Dabatase	Persistence	none	9
Windows: Suspicious Chromium Browser Instance Executed With Custom Extensions	Persistence	T1176	7
Windows: Suspicious CodePage Switch Via CHCP	Persistence	none	5
Windows: Suspicious ConfigSecurityPolicy Execution	Persistence	none	5
Windows: Suspicious Creation with Colorcpl	Persistence	none	7
Windows: Suspicious CustomShellHost Execution	Persistence	none	5
Windows: Suspicious DLL Loaded via CertOC.EXE	Persistence	none	7
Windows: Suspicious DNS Query for IP Lookup Service APIs	Persistence	none	5
Windows: Suspicious Debugger Registration Cmdline	Persistence	T1546.008	7
Windows: Suspicious Digital Signature Of AppX Package	Persistence	none	5
Windows: Suspicious DotNET CLR Usage Log Artifact	Persistence	none	7
Windows: Suspicious Double Extension Files	Persistence	none	7
Windows: Suspicious Download Via Certutil.EXE	Persistence	none	5
Windows: Suspicious Download from Office Domain	Persistence	none	7
Windows: Suspicious Driver Install by pnputil.exe	Persistence	none	5
Windows: Suspicious Driver Load from Temp	Persistence	T1543.003	5
Windows: Suspicious Dropbox API Usage	Persistence	none	7
Windows: Suspicious Electron Application Child Processes	Persistence	none	5
Windows: Suspicious Executable File Creation	Persistence	none	7
Windows: Suspicious Execution Of PDQDeployRunner	Persistence	none	5
Windows: Suspicious Execution of InstallUtil To Download	Persistence	none	5
Windows: Suspicious Execution of InstallUtil Without Log	Persistence	none	5
Windows: Suspicious File Created In PerfLogs	Persistence	none	5
Windows: Suspicious File Created Via OneNote Application	Persistence	none	7
Windows: Suspicious File Creation In Uncommon AppData Folder	Persistence	none	7
Windows: Suspicious File Download From File Sharing Domain Via Curl.EXE	Persistence	none	7
Windows: Suspicious File Downloaded From Direct IP Via Certutil.EXE	Persistence	none	7
Windows: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE	Persistence	none	7
Windows: Suspicious File Drop by Exchange	Persistence	T1505.003	5
Windows: Suspicious FromBase64String Usage On Gzip Archive - Process Creation	Persistence	none	5
Windows: Suspicious Get-Variable.exe Creation	Persistence	none	7
Windows: Suspicious Git Clone	Persistence	none	5
Windows: Suspicious Greedy Compression Using Rar.EXE	Persistence	none	7
Windows: Suspicious GrpConv Execution	Persistence	none	7
Windows: Suspicious Hacktool Execution - PE Metadata	Persistence	none	7
Windows: Suspicious IIS Module Registration	Persistence	none	7
Windows: Suspicious IIS URL GlobalRules Rewrite Via AppCmd	Persistence	none	5
Windows: Suspicious Interactive PowerShell as SYSTEM	Persistence	none	7
Windows: Suspicious Kernel Dump Using Dtrace	Persistence	none	7
Windows: Suspicious LNK Double Extension File	Persistence	none	5
Windows: Suspicious MSDT Parent Process	Persistence	none	7
Windows: Suspicious MSExchangeMailboxReplication ASPX Write	Persistence	T1505.003	7
Windows: Suspicious Msbuild Execution By Uncommon Parent Process	Persistence	none	5
Windows: Suspicious Network Command	Persistence	none	3
Windows: Suspicious Network Connection Binary No CommandLine	Persistence	none	7
Windows: Suspicious Network Connection to IP Lookup Service APIs	Persistence	none	5
Windows: Suspicious New Service Creation	Persistence	T1543.003	7
Windows: Suspicious Non-Browser Network Communication With Google API	Persistence	none	5
Windows: Suspicious Ntdll Pipe Redirection	Persistence	none	7
Windows: Suspicious Obfuscated PowerShell Code	Persistence	none	7
Windows: Suspicious Parent Double Extension File Execution	Persistence	none	7
Windows: Suspicious PowerShell IEX Execution Patterns	Persistence	none	7
Windows: Suspicious PowerShell Invocations - Specific - ProcessCreation	Persistence	none	5
Windows: Suspicious PowerShell Mailbox Export to Share	Persistence	none	9
Windows: Suspicious Powercfg Execution To Change Lock Screen Timeout	Persistence	none	5
Windows: Suspicious Process Parents	Persistence	none	7
Windows: Suspicious Process Start Locations	Persistence	none	5
Windows: Suspicious Program Names	Persistence	none	7
Windows: Suspicious RASdial Activity	Persistence	none	5
Windows: Suspicious Reg Add Open Command	Persistence	none	5
Windows: Suspicious Remote AppX Package Locations	Persistence	none	7
Windows: Suspicious Remote Logon with Explicit Credentials	Persistence	none	5
Windows: Suspicious Run Key from Download	Persistence	T1547.001	7
Windows: Suspicious RunAs-Like Flag Combination	Persistence	none	5
Windows: Suspicious Rundll32 Invoking Inline VBScript	Persistence	none	7
Windows: Suspicious SYSTEM User Process Creation	Persistence	none	7
Windows: Suspicious Scheduled Task Write to System32 Tasks	Persistence	none	7
Windows: Suspicious ScreenSave Change by Reg.exe	Persistence	T1546.002	5
Windows: Suspicious Screensaver Binary File Creation	Persistence	T1546.002	5
Windows: Suspicious Script Execution From Temp Folder	Persistence	none	7
Windows: Suspicious Serv-U Process Pattern	Persistence	none	7
Windows: Suspicious Service Binary Directory	Persistence	none	7
Windows: Suspicious Service DACL Modification Via Set-Service Cmdlet	Persistence	T1543.003	7
Windows: Suspicious Service Installation	Persistence	T1543.003	7
Windows: Suspicious Service Installation Script	Persistence	T1543.003	7
Windows: Suspicious Service Path Modification	Persistence	T1543.003	7
Windows: Suspicious Shells Spawn by Java Utility Keytool	Persistence	none	7
Windows: Suspicious Shells Spawned by Java	Persistence	none	7
Windows: Suspicious Splwow64 Without Params	Persistence	none	7
Windows: Suspicious Startup Folder Persistence	Persistence	T1547.001	7
Windows: Suspicious SysAidServer Child	Persistence	none	5
Windows: Suspicious Usage Of ShellExec-RunDLL	Persistence	none	7
Windows: Suspicious Usage of CVE-2021-34484 or CVE 2022-21919	Persistence	none	3
Windows: Suspicious Use of CSharp Interactive Console	Persistence	none	7
Windows: Suspicious Userinit Child Process	Persistence	none	5
Windows: Suspicious Vsls-Agent Command With AgentExtensionPath Load	Persistence	none	5
Windows: Suspicious WERMGR Process Patterns	Persistence	none	7
Windows: Suspicious Windows ANONYMOUS LOGON Local Account Created	Persistence	T1136.002	7
Windows: Suspicious Windows App Activity	Persistence	none	7
Windows: Suspicious Windows Update Agent Empty Cmdline	Persistence	none	7
Windows: Suspicious WindowsTerminal Child Processes	Persistence	none	5
Windows: Suspicious Workstation Locking via Rundll32	Persistence	none	5
Windows: Suspicious X509Enrollment - Process Creation	Persistence	none	5
Windows: Suspicious desktop.ini Action	Persistence	T1547.009	5
Windows: SyncAppvPublishingServer Execute Arbitrary PowerShell Code	Persistence	none	5
Windows: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code	Persistence	none	5
Windows: Sysinternals PsSuspend Execution	Persistence	T1543.003	5
Windows: Sysinternals Tools AppX Versions Execution	Persistence	none	5
Windows: Sysmon Blocked Executable	Persistence	none	7
Windows: Sysmon Configuration Change	Persistence	none	5
Windows: Sysmon Crash	Persistence	none	7
Windows: Sysprep on AppData Folder	Persistence	none	5
Windows: System File Execution Location Anomaly	Persistence	none	7
Windows: Tap Driver Installation	Persistence	none	5
Windows: Tap Installer Execution	Persistence	none	5
Windows: Taskmgr as LOCAL-SYSTEM	Persistence	none	7
Windows: Taskmgr as Parent	Persistence	none	3
Windows: The Windows Defender Firewall Service Failed To Load Group Policy	Persistence	none	3
Windows: UAC Bypass Using Event Viewer RecentViews	Persistence	none	7
Windows: UAC Bypass Using EventVwr	Persistence	none	7
Windows: UAC Bypass via Windows Firewall Snap-In Hijack	Persistence	none	5
Windows: Uncommon AppX Package Locations	Persistence	none	5
Windows: Uncommon One Time Only Scheduled Task At 00:00	Persistence	none	7
Windows: Unsigned AppX Installation Attempt Using Add-AppxPackage	Persistence	none	5
Windows: Unusual Parent Process For Cmd.EXE	Persistence	none	5
Windows: Use Of The SFTP.EXE Binary As A LOLBIN	Persistence	none	5
Windows: Use of Forfiles For Execution	Persistence	none	5
Windows: Use of OpenConsole	Persistence	none	5
Windows: Use of Pcalua For Execution	Persistence	none	5
Windows: Use of Remote.exe	Persistence	none	5
Windows: Use of Scriptrunner.exe	Persistence	none	5
Windows: Use of Squirrel.exe	Persistence	none	5
Windows: Use of Sysinternals PsService	Persistence	T1543.003	5
Windows: Use of TTDInject.exe	Persistence	none	5
Windows: Use of VSIISExeLauncher.exe	Persistence	none	5
Windows: Use of VisualUiaVerifyNative.exe	Persistence	none	5
Windows: Use of Wfc.exe	Persistence	none	5
Windows: User Added to Local Administrators	Persistence	none	5
Windows: UtilityFunctions.ps1 Proxy Dll	Persistence	none	5
Windows: VMToolsd Suspicious Child Process	Persistence	none	7
Windows: Verclsid.exe Runs COM Object	Persistence	none	5
Windows: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution	Persistence	none	5
Windows: Visual Studio NodejsTools PressAnyKey Renamed Execution	Persistence	none	5
Windows: VsCode Powershell Profile Modification	Persistence	T1546.013	5
Windows: Vulnerable HackSys Extreme Vulnerable Driver Load	Persistence	T1543.003	7
Windows: Vulnerable Netlogon Secure Channel Connection Allowed	Persistence	none	7
Windows: Vulnerable WinRing0 Driver Load	Persistence	T1543.003	7
Windows: WINEKEY Registry Modification	Persistence	none	7
Windows: WMI Backdoor Exchange Transport Agent	Persistence	T1546.003	9
Windows: WMI Event Subscription	Persistence	T1546.003	7
Windows: WMI Persistence - Command Line Event Consumer	Persistence	T1546.003	7
Windows: WMI Persistence - Script Event Consumer	Persistence	T1546.003	5
Windows: WMI Persistence - Script Event Consumer File Write	Persistence	T1546.003	7
Windows: WMI Persistence - Security	Persistence	T1546.003	5
Windows: WMI Script Host Process Image Loaded	Persistence	T1546.003	7
Windows: WScript or CScript Dropper: Sysmon V1	Persistence	none	7
Windows: Wab Execution From Non Default Location	Persistence	none	7
Windows: Wab/Wabmig Unusual Parent Or Child Processes	Persistence	none	7
Windows: Weak or Abused Passwords In CLI	Persistence	none	5
Windows: Webshell Detection With Command Line Keywords	Persistence	T1505.003	7
Windows: Webshell Hacking Activity Patterns	Persistence	T1505.003	7
Windows: Webshell Recon Detection Via CommandLine Processes	Persistence	T1505.003	7
Windows: WinSxS Executable File Creation By Non-System Process	Persistence	none	5
Windows: Windows Binaries Write Suspicious Extensions	Persistence	none	7
Windows: Windows Defender Firewall Has Been Reset To Its Default Configuration	Persistence	none	3
Windows: Windows Firewall Disabled via PowerShell	Persistence	none	5
Windows: Windows Firewall Settings Have Been Changed	Persistence	none	3
Windows: Windows Network Access Suspicious desktop.ini Action	Persistence	T1547.009	5
Windows: Windows Service Terminated With Error	Persistence	none	3
Windows: Windows Shell/Scripting Application File Write to Suspicious Folder	Persistence	none	7
Windows: Windows Spooler Service Suspicious Binary Load	Persistence	none	1
Windows: Windows Update Error	Persistence	none	3
Windows: Wlrmdr Lolbin Use as Launcher	Persistence	none	5
Windows: Write Protect For Storage Disabled	Persistence	none	5
Windows: Writing Local Admin Share	Persistence	T1546.002	5
Windows: Wscript Shell Run In CommandLine	Persistence	none	7
Windows: Wuauclt Network Connection	Persistence	none	5
Windows: Wusa Extracting Cab Files From Suspicious Paths	Persistence	none	7

Privilege Escalation

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Privilege Escalation Detected	Privilege Escalation	T1548.002	9
Crowdstrike: Authentication Bypass	Privilege Escalation	none	8
Crowdstrike: Privilege Escalation	Privilege Escalation	T1548.004	8
FortiNDR Cloud: High Severity Detection triggered for a Host	Privilege Escalation	T1068	9
FortiNDR Cloud: Low Severity Detection triggered for a Host	Privilege Escalation	T1068	4
FortiNDR Cloud: Moderate Severity Detection triggered for a Host	Privilege Escalation	T1068	7
Linux Buffer overflow	Privilege Escalation	T1547.009	9
Linux: Setgid Bit Set via chmod	Privilege Escalation	T1548.001	7
Linux: Setuid Bit Set via chmod	Privilege Escalation	T1548.001	7
Linux: Sudoers File Modification	Privilege Escalation	T1548.003	9
Linux: Trap Signals Usage	Privilege Escalation	T1546.005	5
Outbreak: Router Malware Attack Detected on Host	Privilege Escalation	T1068	9
Outbreak: Router Malware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: VMware ESXi Server Ransomware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Host	Privilege Escalation	T1068	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Network	Privilege Escalation	T1068	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Host	Privilege Escalation	T1068	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Network	Privilege Escalation	T1068	9
Privilege Escalation Exploits	Privilege Escalation	T1548.004	7
Privileged Command Execution Failure	Privilege Escalation	T1548.002	9
Windows Debugger registry key for common Windows accessibility tools	Privilege Escalation	T1574.002	8
Windows: Addition of SID History to Active Directory Object	Privilege Escalation	T1134.005	5
Windows: Bypass UAC via Fodhelper.exe	Privilege Escalation	T1548.002	7
Windows: HackTool - SysmonEOP Execution	Privilege Escalation	T1068	9
Windows: Process Explorer Driver Creation By Non-Sysinternals Binary	Privilege Escalation	T1068	7
Windows: Process Monitor Driver Creation By Non-Sysinternals Binary	Privilege Escalation	T1068	5

Defense Evasion

Name	Tactic	Technique	Severity
Unusual ICMP Traffic	Defense Evasion	none	7
Windows Process Tampering Detected	Defense Evasion	T1055.009	9
AWS CloudTrail Important Changes	Defense Evasion	T1562.001	7
AWS CloudTrail Log Deleted	Defense Evasion	T1562.008	9
AWS CloudTrail Log Setting Updated	Defense Evasion	T1562.008	3
AWS CloudTrail Log Suspended	Defense Evasion	T1562.008	9
AWS CloudWatch Alarm Deleted	Defense Evasion	T1562.008	5
AWS CloudWatch Log Group Deleted	Defense Evasion	T1070.004	9
AWS CloudWatch Log Stream Deleted	Defense Evasion	T1070.004	9
AWS Config Service Tampering	Defense Evasion	T1562.006	7
AWS Configuration Recorder Stopped	Defense Evasion	T1562.008	7
AWS EC2 Encryption Disabled	Defense Evasion	T1600.001	9
AWS EC2 Flow Log Deleted	Defense Evasion	T1562.008	7
AWS EC2 Network Access Control List Deleted	Defense Evasion	T1562.007	9
AWS EC2 Snapshot Attribute Modified	Defense Evasion	T1578.001	5
AWS EC2 User Data Download	Defense Evasion	T1562.001	6
AWS GuardDuty Detector Deleted	Defense Evasion	T1562.008	7
AWS S3 Bucket Configuration Deleted	Defense Evasion	T1562.008	3
AWS SecHub: Tactics: Defense Evasion Detected	Defense Evasion	none	8
AWS WAF Access Control List Deleted	Defense Evasion	T1562.007	9
AWS WAF Rule or Rule Group Deleted	Defense Evasion	T1562.007	8
Agent FIM: Linux Directory Ownership or Permission Changed	Defense Evasion	T1222.002,T1565.001	7
Agent FIM: Linux File Changed From Baseline	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Linux File Content Modified	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Linux File Ownership or Permission Changed	Defense Evasion	T1222.002,T1565.001	9
Agent FIM: Linux File or Directory Deleted	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Changed From Baseline	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Content Modified	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Ownership Changed	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Permission Changed	Defense Evasion	T1222.001,T1565.001	7
Agent FIM: Windows File or Directory Archive Bit Changed	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File or Directory Deleted	Defense Evasion	T1070.004,T1565.001	7
Agentless FIM: Audited file or directory deleted	Defense Evasion	T1070.004,T1565.001	8
Agentless FIM: Audited file or directory ownership or permission changed	Defense Evasion	T1222.002,T1565.001	9
Agentless FIM: Audited target file content modified	Defense Evasion	T1070.004,T1565.001	8
Audited file or directory content modified in SVN	Defense Evasion	T1070.004,T1565.001	8
Azure Automation Runbook Deleted	Defense Evasion	T1562.001	3
Azure Diagnostic Settings Deleted	Defense Evasion	T1562.008	5
Azure Event Hub Deleted	Defense Evasion	T1562.008	9
Azure Firewall Policy Deleted	Defense Evasion	T1562.007	9
Azure Network Watcher Deleted	Defense Evasion	T1562.007	5
Barracuda WAF: Config Change Detected	Defense Evasion	T1562.004	7
Crowdstrike: Evade Detection	Defense Evasion	none	8
Crowdstrike: Social Engineering	Defense Evasion	none	7
CyberArk Vault User History Clear	Defense Evasion	T1070.003	8
GCP: Firewall Rule Created	Defense Evasion	T1562.007	4
GCP: Firewall Rule Deleted	Defense Evasion	T1562.007	8
GCP: Firewall Rule Updated	Defense Evasion	T1562.007	8
GCP: Logging Sink Deleted	Defense Evasion	T1562.008	8
GCP: Logging Sink Updated	Defense Evasion	T1562.008	6
GCP: Pub/Sub Subscription Deleted	Defense Evasion	T1562.008	6
GCP: Pub/Sub Topic Deleted	Defense Evasion	T1562.008	6
GCP: Storage or Logging Bucket Deleted	Defense Evasion	T1562.008	6
Group Policy Object Created	Defense Evasion	T1484.001	7
Group Policy Object Modified	Defense Evasion	T1484.001	7
IPS/AV Evasion attempts	Defense Evasion	T1211	7
Linux: Attempt to Disable CarbonBlack Service	Defense Evasion	T1562.004	9
Linux: Attempt to Disable Crowdstrike Service	Defense Evasion	T1562.004	9
Linux: Attempt to Disable Syslog Service	Defense Evasion	T1562.004	9
Linux: Attempts to Disable IPTables or Firewall	Defense Evasion	T1562.004	9
Linux: Base16/32/64 Encoding/Decoding Activity	Defense Evasion	T1140	7
Linux: Clear System Logs	Defense Evasion	T1070.002	9
Linux: Command Line History Deleted	Defense Evasion	T1070.003	9
Linux: File Deletion via Shred	Defense Evasion	T1070.004	9
Linux: File Permission Modification in Writable Absolute Directory By non-root user	Defense Evasion	T1222.002	7
Linux: File Permission Modification in Writable Relative Directory By non-root user	Defense Evasion	T1222.002	7
Linux: Hidden Files and Directories Created	Defense Evasion	T1564.001	7
Linux: Kernel Module Removed	Defense Evasion	T1562.001	7
Linux: Processes with Trailing Spaces	Defense Evasion	T1036.006	7
Linux: SELinux Disabled	Defense Evasion	T1562.001	9
Linux: Timestomping using Touch Command	Defense Evasion	T1070.006	5
Linux: Unusual Process Execution from Temp	Defense Evasion	T1202	7
MS 365 Defender: Masquerading - Execution Alert	Defense Evasion	T1036.004	9
MS 365 Defender: Process Injection - Defense Evasion Alert	Defense Evasion	T1055.001	9
Modification of ld.so.preload	Defense Evasion	T1055.009	5
Multiple Windows Accounts Disabled by Administrator	Defense Evasion	none	9
Network Installed Software Change	Defense Evasion	T1218.001	6
Oracle OCI: Policy Created	Defense Evasion	T1562.007	7
Oracle OCI: Policy Deleted	Defense Evasion	T1562.007	7
Outbreak: BURNTCIGAR MS Signed Driver Malware detected on Host	Defense Evasion	T1036.001	9
Outbreak: BURNTCIGAR MS Signed Driver Malware detected on Network	Defense Evasion	T1036.001	9
Outbreak: Control Web Panel Login Exploit Detected on Host	Defense Evasion	T1202	9
Outbreak: Control Web Panel Login Exploit Detected on Network	Defense Evasion	T1202	9
Running Config Change	Defense Evasion	T1562.004	6
Running Config Change: with login info	Defense Evasion	T1562.004	6
Server Installed Software Change	Defense Evasion	T1218.001	6
Startup Config Change	Defense Evasion	T1562.004	6
Startup Config Change: with login	Defense Evasion	T1562.004	6
ThreatDown Nebula: PUP Blocked	Defense Evasion	T1562.001	7
ThreatDown Nebula: PUP Found	Defense Evasion	T1562.001	6
Uncommon Linux process Created	Defense Evasion	T1036.004	7
Uncommon Windows Service	Defense Evasion	T1036.004	7
Uncommon Windows process Created	Defense Evasion	T1036.004	7
Uncommon Windows process via Sysmon	Defense Evasion	T1036.004	7
Windows Audit Policy Changed	Defense Evasion	T1562.003	7
Windows Logging Service Shutdown	Defense Evasion	T1562.002	9
Windows Process with deleted binaries	Defense Evasion	T1070.004	8
Windows Security Log Cleared	Defense Evasion	T1070.001	9
Windows Security Log is Full	Defense Evasion	T1070.001	9
Windows: AD Object WriteDAC Access	Defense Evasion	T1222.001	9
Windows: Abuse of Service Permissions to Hide Services Via Set-Service	Defense Evasion	T1574.011	7
Windows: Add SafeBoot Keys Via Reg Utility	Defense Evasion	T1562.001	7
Windows: Admin User Remote Logon	Defense Evasion	T1078.003	3
Windows: Always Install Elevated MSI Spawned Cmd And Powershell	Defense Evasion	T1548.002	5
Windows: Always Install Elevated Windows Installer	Defense Evasion	T1548.002	5
Windows: Application Whitelisting Bypass via Bginfo	Defense Evasion	T1202	5
Windows: Application Whitelisting Bypass via Dnx.exe	Defense Evasion	T1027.004	5
Windows: Aruba Network Service Potential DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Audit Policy Tampering Via Auditpol	Defense Evasion	T1562.002	7
Windows: Audit Policy Tampering Via NT Resource Kit Auditpol	Defense Evasion	T1562.002	7
Windows: BITS Transfer Job Download From Direct IP	Defense Evasion	T1197	7
Windows: BITS Transfer Job Download From File Sharing Domains	Defense Evasion	T1197	7
Windows: BITS Transfer Job Download To Potential Suspicious Folder	Defense Evasion	T1197	7
Windows: BITS Transfer Job Downloading File Potential Suspicious Extension	Defense Evasion	T1197	5
Windows: BITS Transfer Job With Uncommon Or Suspicious Remote TLD	Defense Evasion	T1197	5
Windows: Backup Catalog Deleted	Defense Evasion	T1070.004	5
Windows: Bad Opsec Defaults Sacrificial Processes With Improper Arguments	Defense Evasion	T1218.011	7
Windows: Bypass UAC via CMSTP	Defense Evasion	T1548.002	7
Windows: Bypass UAC via WSReset.exe	Defense Evasion	T1548.002	7
Windows: CMSTP Execution Process Creation	Defense Evasion	T1218.003	7
Windows: CMSTP Execution Registry Event	Defense Evasion	T1218.003	7
Windows: CMSTP UAC Bypass via COM Object Access	Defense Evasion	T1548.002	7
Windows: CleanWipe Usage	Defense Evasion	T1562.001	5
Windows: Cobalt Strike Load by Rundll32	Defense Evasion	T1218.011	7
Windows: CobaltStrike BOF Injection Pattern	Defense Evasion	T1562.001	7
Windows: Code Execution via Pcwutl.dll	Defense Evasion	T1218.011	5
Windows: Conhost Parent Process Executions	Defense Evasion	T1202	5
Windows: Control Panel Items	Defense Evasion	T1218.002	7
Windows: Creation Of Non-Existent System DLL	Defense Evasion	T1574.002	5
Windows: Creation of an WerFault.exe in Unusual Folder	Defense Evasion	T1574.001	7
Windows: DHCP Server Error Failed Loading the CallOut DLL	Defense Evasion	T1574.002	7
Windows: DHCP Server Loaded the CallOut DLL	Defense Evasion	T1574.002	9
Windows: DLL Loaded From Suspicious Location Via Cmspt.EXE	Defense Evasion	T1218.003	7
Windows: DLL Search Order Hijackig Via Additional Space in Path	Defense Evasion	T1574.002	7
Windows: DLL Sideloading Of ShellChromeAPI.DLL	Defense Evasion	T1574.002	7
Windows: DLL Sideloading by Microsoft Defender	Defense Evasion	T1574.002	7
Windows: DLL Sideloading by VMware Xfer Utility	Defense Evasion	T1574.002	7
Windows: Detect Virtualbox Driver Installation OR Starting Of VMs	Defense Evasion	T1564.006	3
Windows: Directory Removal Via Rmdir	Defense Evasion	T1070.004	3
Windows: Disable Security Events Logging Adding Reg Key MiniNt	Defense Evasion	T1562.001	7
Windows: Disable Windows Defender AV Security Monitoring	Defense Evasion	T1562.001	7
Windows: Disable Windows IIS HTTP Logging	Defense Evasion	T1562.002	7
Windows: Disable of ETW Trace	Defense Evasion	T1562.006	7
Windows: Disabled IE Security Features	Defense Evasion	T1562.001	7
Windows: Disabled RestrictedAdminMode For RDS - ProcCreation	Defense Evasion	T1112	7
Windows: Disabled Volume Snapshots	Defense Evasion	T1562.001	7
Windows: Dism Remove Online Package	Defense Evasion	T1562.001	5
Windows: DllUnregisterServer Function Call Via Msiexec.EXE	Defense Evasion	T1218.007	5
Windows: Dynamic C Sharp Compile Artefact	Defense Evasion	T1027.004	3
Windows: EVTX Created In Uncommon Location	Defense Evasion	T1562.002	5
Windows: Empire PowerShell UAC Bypass	Defense Evasion	T1548.002	9
Windows: Eventlog Cleared	Defense Evasion	T1070.001	5
Windows: Execute Arbitrary Commands Using MSDT.EXE: V1	Defense Evasion	T1202	7
Windows: Execute From Alternate Data Streams	Defense Evasion	T1564.004	5
Windows: Explorer NOUACCHECK Flag	Defense Evasion	T1548.002	7
Windows: F-Secure C3 Load by Rundll32	Defense Evasion	T1218.011	9
Windows: Fax Service DLL Search Order Hijack	Defense Evasion	T1574.002	7
Windows: File Deletion Via Del	Defense Evasion	T1070.004	3
Windows: File Download Via Bitsadmin	Defense Evasion	T1197	5
Windows: File Download Via Bitsadmin To A Suspicious Target Folder	Defense Evasion	T1197	7
Windows: File Download Via Bitsadmin To An Uncommon Target Folder	Defense Evasion	T1197	5
Windows: File With Suspicious Extension Downloaded Via Bitsadmin	Defense Evasion	T1197	7
Windows: Files With System Process Name In Unsuspected Locations	Defense Evasion	T1036.005	7
Windows: Filter Driver Unloaded Via Fltmc.EXE	Defense Evasion	T1562.002	7
Windows: Findstr Launching .lnk File	Defense Evasion	T1202	5
Windows: Firewall Disabled via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: Firewall Rule Deleted Via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: FromBase64String Command Line	Defense Evasion	T1140	7
Windows: Greedy File Deletion Using Del	Defense Evasion	T1070.004	5
Windows: HH.EXE Execution	Defense Evasion	T1218.001	5
Windows: HackTool - Covenant PowerShell Launcher	Defense Evasion	T1564.003	7
Windows: HackTool - Impersonate Execution	Defense Evasion	T1134.003	5
Windows: HackTool - PPID Spoofing SelectMyParent Tool Execution	Defense Evasion	T1134.004	7
Windows: HackTool - PowerTool Execution	Defense Evasion	T1562.001	7
Windows: HackTool - RedMimicry Winnti Playbook Execution	Defense Evasion	T1218.011	7
Windows: HackTool - SharpEvtMute DLL Load	Defense Evasion	T1562.002	7
Windows: HackTool - SharpEvtMute Execution	Defense Evasion	T1562.002	7
Windows: HackTool - SharpImpersonation Execution	Defense Evasion	T1134.003	7
Windows: HackTool - SharpUp PrivEsc Tool Execution	Defense Evasion	T1574.005	9
Windows: HackTool - Stracciatella Execution	Defense Evasion	T1562.001	7
Windows: Hacktool Ruler	Defense Evasion	T1550.002	7
Windows: Hiding Files with Attrib.exe	Defense Evasion	T1564.001	5
Windows: High Integrity Sdclt Process	Defense Evasion	T1548.002	5
Windows: Imports Registry Key From a File	Defense Evasion	T1112	5
Windows: Imports Registry Key From an ADS	Defense Evasion	T1112	7
Windows: LOLBIN Execution Of The FTP.EXE Binary	Defense Evasion	T1202	5
Windows: Launch-VsDevShell.PS1 Proxy Execution	Defense Evasion	T1216.001	5
Windows: Load Undocumented Autoelevated COM Interface	Defense Evasion	T1548.002	7
Windows: Lolbin Ssh.exe Use As Proxy	Defense Evasion	T1202	5
Windows: MSDT.exe Loading Diagnostic Library	Defense Evasion	T1202	7
Windows: MSHTA Suspicious Execution 01	Defense Evasion	T1218.005	7
Windows: MSI Installation From Web	Defense Evasion	T1218.007	5
Windows: Malicious DLL File Dropped in the Teams or OneDrive Folder	Defense Evasion	T1574.002	7
Windows: Mavinject Inject DLL Into Running Process	Defense Evasion	T1055.001	7
Windows: Meterpreter or Cobalt Strike Getsystem Service Installation - System	Defense Evasion	T1134.002	9
Windows: Meterpreter or Cobalt Strike Service Installation: Security Log	Defense Evasion	T1134.002	9
Windows: Microsoft Defender Blocked from Loading Unsigned DLL	Defense Evasion	T1574.002	7
Windows: Microsoft Defender Loading DLL from Nondefault Path	Defense Evasion	T1574.002	7
Windows: Microsoft Malware Protection Engine Crash	Defense Evasion	T1562.001	7
Windows: Microsoft Malware Protection Engine Crash - WER	Defense Evasion	T1562.001	7
Windows: Microsoft Office DLL Sideload	Defense Evasion	T1574.002	7
Windows: Modify Group Policy Settings	Defense Evasion	T1484.001	5
Windows: Monitoring For Persistence Via BITS	Defense Evasion	T1197	5
Windows: MsiExec Web Install	Defense Evasion	T1218.007	5
Windows: Msiexec Quiet Installation	Defense Evasion	T1218.007	5
Windows: NTLMv1 Logon Between Client and Server	Defense Evasion	T1550.002	3
Windows: NetNTLM Downgrade Attack	Defense Evasion	T1562.001	7
Windows: NetNTLM Downgrade Attack - Registry	Defense Evasion	T1562.001	7
Windows: Netsh Allow Group Policy on Microsoft Defender Firewall	Defense Evasion	T1562.004	5
Windows: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE	Defense Evasion	T1574.002	7
Windows: New Firewall Rule Added Via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: New Root Certificate Installed Via CertMgr.EXE	Defense Evasion	T1553.004	5
Windows: New Root Certificate Installed Via Certutil.EXE	Defense Evasion	T1553.004	5
Windows: Non-privileged Usage of Reg or Powershell	Defense Evasion	T1112	7
Windows: Outbound Network Connection To Public IP Via Winlogon	Defense Evasion	T1218.011	5
Windows: Outlook EnableUnsafeClientMailRules Setting Enabled	Defense Evasion	T1202	7
Windows: PUA - DefenderCheck Execution	Defense Evasion	T1027.005	7
Windows: PUA - Potential PE Metadata Tamper Using Rcedit	Defense Evasion	T1036.003	5
Windows: Pass the Hash Activity 2	Defense Evasion	T1550.002	5
Windows: Ping Hex IP	Defense Evasion	T1140	7
Windows: Possible DC Shadow Attack	Defense Evasion	T1207	5
Windows: Possible Privilege Escalation via Weak Service Permissions	Defense Evasion	T1574.011	7
Windows: Potential AMSI Bypass Using NULL Bits	Defense Evasion	T1562.001	5
Windows: Potential AMSI Bypass Via .NET Reflection	Defense Evasion	T1562.001	7
Windows: Potential Access Token Abuse	Defense Evasion	T1134.001	5
Windows: Potential Antivirus Software DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Arbitrary DLL Load Using Winword	Defense Evasion	T1202	5
Windows: Potential Arbitrary File Download Using Office Application	Defense Evasion	T1202	5
Windows: Potential Azure Browser SSO Abuse	Defense Evasion	T1574.002	3
Windows: Potential Chrome Frame Helper DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential DLL Injection Or Execution Using Tracker.exe	Defense Evasion	T1055.001	5
Windows: Potential DLL Sideloading Of DBGCORE.DLL	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of DBGHELP.DLL	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of Non-Existent DLLs From System Folders	Defense Evasion	T1574.002	7
Windows: Potential DLL Sideloading Via ClassicExplorer32.dll	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via DeviceEnroller.EXE	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via JsSchHlp	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via VMware Xfer	Defense Evasion	T1574.002	7
Windows: Potential DLL Sideloading Via comctl32.dll	Defense Evasion	T1574.002	7
Windows: Potential Defense Evasion Via Binary Rename	Defense Evasion	T1036.003	5
Windows: Potential Defense Evasion Via Rename Of Highly Relevant Binaries	Defense Evasion	T1036.003	7
Windows: Potential Defense Evasion Via Right-to-Left Override	Defense Evasion	T1036.002	7
Windows: Potential Goopdate.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Homoglyph Attack Using Lookalike Characters	Defense Evasion	T1036.003	5
Windows: Potential Homoglyph Attack Using Lookalike Characters in Filename	Defense Evasion	T1036.003	5
Windows: Potential Initial Access via DLL Search Order Hijacking	Defense Evasion	T1574.001	5
Windows: Potential Iviewers.DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Potential LethalHTA Technique Execution	Defense Evasion	T1218.005	7
Windows: Potential Libvlc.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Meterpreter/CobaltStrike Activity	Defense Evasion	T1134.002	7
Windows: Potential MsiExec Masquerading	Defense Evasion	T1036.005	7
Windows: Potential Persistence Attempt Via Existing Service Tampering	Defense Evasion	T1574.011	5
Windows: Potential PowerShell Execution Via DLL	Defense Evasion	T1218.011	7
Windows: Potential Privilege Escalation via Service Permissions Weakness	Defense Evasion	T1574.011	7
Windows: Potential Privileged System Service Operation - SeLoadDriverPrivilege	Defense Evasion	T1562.001	5
Windows: Potential Qakbot Registry Activity	Defense Evasion	T1112	7
Windows: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE	Defense Evasion	T1542.003	5
Windows: Potential Rcdll.DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Potential RoboForm.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Rundll32 Execution With DLL Stored In ADS	Defense Evasion	T1564.004	7
Windows: Potential SolidPDFCreator.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential SquiblyTwo Technique Execution	Defense Evasion	T1220	5
Windows: Potential Suspicious Activity Using SeCEdit	Defense Evasion	T1574.007	5
Windows: Potential Suspicious Registry File Imported Via Reg.EXE	Defense Evasion	T1112	5
Windows: Potential Svchost Memory Access	Defense Evasion	T1562.002	7
Windows: Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Defense Evasion	T1112	7
Windows: Potential Tampering With Security Products Via WMIC	Defense Evasion	T1562.001	7
Windows: Potential Wazuh Security Platform DLL Sideloading	Defense Evasion	T1574.002	5
Windows: PowerShell Base64 Encoded FromBase64String Cmdlet	Defense Evasion	T1140	7
Windows: PowerShell Encoded Character Syntax	Defense Evasion	T1027.003,T1132.001	7
Windows: Powershell Base64 Encoded MpPreference Cmdlet	Defense Evasion	T1562.001	7
Windows: Powershell Defender Disable Scan Feature	Defense Evasion	T1562.001	7
Windows: Powershell Defender Exclusion	Defense Evasion	T1562.001	5
Windows: Powerup Write Hijack DLL	Defense Evasion	T1574.001	7
Windows: PrintBrm ZIP Creation of Extraction	Defense Evasion	T1564.004	7
Windows: Process Access via TrolleyExpress Exclusion	Defense Evasion	T1218.011	7
Windows: Pubprn.vbs Proxy Execution	Defense Evasion	T1216.001	5
Windows: Python Py2Exe Image Load	Defense Evasion	T1027.002	5
Windows: RDP Connection Allowed Via Netsh.EXE	Defense Evasion	T1562.004	7
Windows: Raccine Uninstall	Defense Evasion	T1562.001	7
Windows: RedMimicry Winnti Playbook Registry Manipulation	Defense Evasion	T1112	7
Windows: Reg Add Suspicious Paths	Defense Evasion	T1562.001	7
Windows: Reg Disable Security Service	Defense Evasion	T1562.001	7
Windows: Regasm/Regsvcs Suspicious Execution	Defense Evasion	T1218.009	7
Windows: Registry Entries For Azorult Malware	Defense Evasion	T1112	9
Windows: Registry Modification Via Regini.EXE	Defense Evasion	T1112	3
Windows: Regsvr32 Flags Anomaly	Defense Evasion	T1218.010	7
Windows: Remote CHM File Download/Execution Via HH.EXE	Defense Evasion	T1218.001	7
Windows: Remotely Hosted HTA File Executed Via Mshta.EXE	Defense Evasion	T1218.005	7
Windows: Renamed FTP.EXE Execution	Defense Evasion	T1202	5
Windows: Renamed Jusched.EXE Execution	Defense Evasion	T1036.003	7
Windows: Renamed Mavinject.EXE Execution	Defense Evasion	T1055.001	7
Windows: Renamed Msdt.EXE Execution	Defense Evasion	T1036.003	7
Windows: Renamed PAExec Execution	Defense Evasion	T1202	7
Windows: Renamed ProcDump Execution	Defense Evasion	T1036.003	7
Windows: Renamed Vmnat.exe Execution	Defense Evasion	T1574.002	7
Windows: Renamed ZOHO Dctask64 Execution	Defense Evasion	T1202	7
Windows: Root Certificate Installed From Susp Locations	Defense Evasion	T1553.004	7
Windows: Run Once Task Configuration in Registry	Defense Evasion	T1112	5
Windows: Run Once Task Execution as Configured in Registry	Defense Evasion	T1112	3
Windows: Run PowerShell Script from ADS	Defense Evasion	T1564.004	7
Windows: RunDLL32 Spawning Explorer	Defense Evasion	T1218.011	7
Windows: Rundll32 InstallScreenSaver Execution	Defense Evasion	T1218.011	5
Windows: Rundll32 Internet Connection	Defense Evasion	T1218.011	5
Windows: Rundll32 UNC Path Execution	Defense Evasion	T1218.011	7
Windows: SCR File Write Event	Defense Evasion	T1218.011	5
Windows: SafeBoot Registry Key Deleted Via Reg.EXE	Defense Evasion	T1562.001	7
Windows: Sdclt Child Processes	Defense Evasion	T1548.002	5
Windows: Secure Deletion with SDelete	Defense Evasion	T1070.004,T1027.005	5
Windows: Service DACL Abuse To Hide Services Via Sc.EXE	Defense Evasion	T1574.011	7
Windows: Service ImagePath Change with Reg.exe	Defense Evasion	T1574.011	5
Windows: Service Registry Key Deleted Via Reg.EXE	Defense Evasion	T1562.001	7
Windows: Service Security Descriptor Tampering Via Sc.EXE	Defense Evasion	T1574.011	5
Windows: Service StartupType Change Via PowerShell Set-Service	Defense Evasion	T1562.001	5
Windows: Service StartupType Change Via Sc.EXE	Defense Evasion	T1562.001	5
Windows: Set Suspicious Files as System Files Using Attrib.EXE	Defense Evasion	T1564.001	7
Windows: Shell Open Registry Keys Manipulation	Defense Evasion	T1548.002	7
Windows: Shell32 DLL Execution in Suspicious Directory	Defense Evasion	T1218.011	7
Windows: ShimCache Flush	Defense Evasion	T1112	7
Windows: Silenttrinity Stager Msbuild Activity	Defense Evasion	T1127.001	7
Windows: Successful Overpass the Hash Attempt	Defense Evasion	T1550.002	7
Windows: Suspicious Cabinet File Execution Via Msdt.EXE	Defense Evasion	T1202	5
Windows: Suspicious Child Process Created as System	Defense Evasion	T1134.002	7
Windows: Suspicious Commandline Escape	Defense Evasion	T1140	3
Windows: Suspicious Control Panel DLL Load	Defense Evasion	T1218.011	7
Windows: Suspicious Copy From or To System32	Defense Evasion	T1036.003	5
Windows: Suspicious Diantz Alternate Data Stream Execution	Defense Evasion	T1564.004	5
Windows: Suspicious Download From Direct IP Via Bitsadmin	Defense Evasion	T1197	7
Windows: Suspicious Download From File-Sharing Website Via Bitsadmin	Defense Evasion	T1197	7
Windows: Suspicious Eventlog Clear or Configuration Change	Defense Evasion	T1562.002	7
Windows: Suspicious Extrac32 Alternate Data Stream Execution	Defense Evasion	T1564.004	5
Windows: Suspicious Files in Default GPO Folder	Defense Evasion	T1036.005	5
Windows: Suspicious GUP Usage	Defense Evasion	T1574.002	7
Windows: Suspicious High IntegrityLevel Conhost Legacy Option	Defense Evasion	T1202	1
Windows: Suspicious JavaScript Execution Via Mshta.EXE	Defense Evasion	T1218.005	7
Windows: Suspicious MSHTA Child Process	Defense Evasion	T1218.005	7
Windows: Suspicious Microsoft Office Child Process	Defense Evasion	T1218.010	7
Windows: Suspicious MsiExec Embedding Parent	Defense Evasion	T1218.007	5
Windows: Suspicious Msiexec Execute Arbitrary DLL	Defense Evasion	T1218.007	5
Windows: Suspicious Msiexec Quiet Install From Remote Location	Defense Evasion	T1218.007	5
Windows: Suspicious Outbound Kerberos Connection	Defense Evasion	T1550.003	7
Windows: Suspicious PROCEXP152.sys File Created In TMP	Defense Evasion	T1562.001	5
Windows: Suspicious Parent of Csc.exe	Defense Evasion	T1218.005	7
Windows: Suspicious Ping/Del Command Combination	Defense Evasion	T1070.004	7
Windows: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE	Defense Evasion	T1562.004	7
Windows: Suspicious Recursif Takeown	Defense Evasion	T1222.001	5
Windows: Suspicious Registry Modification From ADS Via Regini.EXE	Defense Evasion	T1112	7
Windows: Suspicious Regsvr32 Execution From Remote Share	Defense Evasion	T1218.010	7
Windows: Suspicious Regsvr32 Execution With Image Extension	Defense Evasion	T1218.010	7
Windows: Suspicious Remote Child Process From Outlook	Defense Evasion	T1202	7
Windows: Suspicious Rundll32 Activity	Defense Evasion	T1218.011	5
Windows: Suspicious Rundll32 Activity Invoking Sys File	Defense Evasion	T1218.011	7
Windows: Suspicious Rundll32 Execution With Image Extension	Defense Evasion	T1218.011	7
Windows: Suspicious Rundll32 Setupapi.dll Activity	Defense Evasion	T1218.011	5
Windows: Suspicious Rundll32 Without Any CommandLine Params	Defense Evasion	T1202	7
Windows: Suspicious Runscripthelper.exe	Defense Evasion	T1202	5
Windows: Suspicious Svchost Process	Defense Evasion	T1036.005	7
Windows: Suspicious Task Added by Bitsadmin	Defense Evasion	T1197	3
Windows: Suspicious Task Added by Powershell	Defense Evasion	T1197	3
Windows: Suspicious VBoxDrvInst.exe Parameters	Defense Evasion	T1112	5
Windows: Suspicious WMIC Execution Via Office Process	Defense Evasion	T1218.010	7
Windows: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE	Defense Evasion	T1562.001	5
Windows: Suspicious Windows Trace ETW Session Tamper Via Logman.EXE	Defense Evasion	T1562.001	7
Windows: Suspicious WmiPrvSE Child Process	Defense Evasion	T1218.010	7
Windows: Suspicious XOR Encoded PowerShell Command	Defense Evasion	T1140	5
Windows: Suspicious ZipExec Execution	Defense Evasion	T1202	5
Windows: Sysinternals PsSuspend Suspicious Execution	Defense Evasion	T1562.001	7
Windows: Sysmon Channel Reference Deletion	Defense Evasion	T1112	7
Windows: Sysmon Configuration Update	Defense Evasion	T1562.001	5
Windows: Sysmon Driver Unloaded Via Fltmc.EXE	Defense Evasion	T1562.002	7
Windows: SysmonEnte Usage	Defense Evasion	T1562.002	7
Windows: System Eventlog Cleared	Defense Evasion	T1070.001	7
Windows: Tamper Windows Defender Remove-MpPreference	Defense Evasion	T1562.001	7
Windows: Taskkill Symantec Endpoint Protection	Defense Evasion	T1562.001	7
Windows: Tasks Folder Evasion	Defense Evasion	T1574.002	7
Windows: Third Party Software DLL Sideloading	Defense Evasion	T1574.002	5
Windows: TrustedPath UAC Bypass Pattern	Defense Evasion	T1548.002	9
Windows: UAC Bypass Abusing Winsat Path Parsing - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Tool UACMe Akagi	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using .NET Code Profiler on MMC	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using ChangePK and SLUI	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using ComputerDefaults	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Consent and Comctl32 - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Consent and Comctl32 - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Disk Cleanup	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using DismHost	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IDiagnostic Profile	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IDiagnostic Profile - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IEInstal - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IEInstal - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Iscsicpl - ImageLoad	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using MSConfig Token Modification - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using MSConfig Token Modification - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using NTFS Reparse Point - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using NTFS Reparse Point - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using PkgMgr and DISM	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using WOW64 Logger DLL Hijack	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Windows Media Player - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Via Wsreset	Defense Evasion	T1548.002	7
Windows: UAC Bypass WSReset	Defense Evasion	T1548.002	7
Windows: UAC Bypass With Fake DLL	Defense Evasion	T1574.002	7
Windows: UAC Bypass via Event Viewer	Defense Evasion	T1548.002	7
Windows: UAC Bypass via ICMLuaUtil	Defense Evasion	T1548.002	7
Windows: UEFI Persistence Via Wpbbin - FileCreation	Defense Evasion	T1542.001	7
Windows: UEFI Persistence Via Wpbbin - ProcessCreation	Defense Evasion	T1542.001	7
Windows: Unauthorized System Time Modification	Defense Evasion	T1070.006	3
Windows: Uninstall Crowdstrike Falcon	Defense Evasion	T1562.001	5
Windows: Uninstall Sysinternals Sysmon	Defense Evasion	T1562.001	7
Windows: Unmount Share Via Net.EXE	Defense Evasion	T1070.005	3
Windows: Unsigned Binary Loaded From Suspicious Location	Defense Evasion	T1574.002	7
Windows: Use Icacls to Hide File to Everyone	Defense Evasion	T1564.001	5
Windows: Use NTFS Short Name in Command Line	Defense Evasion	T1564.004	5
Windows: Use NTFS Short Name in Image	Defense Evasion	T1564.004	7
Windows: Use Short Name Path in Command Line	Defense Evasion	T1564.004	5
Windows: Use Short Name Path in Image	Defense Evasion	T1564.004	5
Windows: Using SettingSyncHost.exe as LOLBin	Defense Evasion	T1574.008	7
Windows: VMGuestLib DLL Sideload	Defense Evasion	T1574.002	5
Windows: Visual Basic Command Line Compiler Usage	Defense Evasion	T1027.004	7
Windows: VsCode Child Process Anomaly	Defense Evasion	T1202	5
Windows: WMIC Loading Scripting Libraries	Defense Evasion	T1220	7
Windows: WSL Child Process Anomaly	Defense Evasion	T1202	5
Windows: Wdigest CredGuard Registry Modification	Defense Evasion	T1112	7
Windows: WinDivert Driver Load	Defense Evasion	T1599.001	7
Windows: Windows Binary Executed From WSL	Defense Evasion	T1202	5
Windows: Windows Defender Definition Files Removed	Defense Evasion	T1562.001	5
Windows: Windows Defender Download Activity	Defense Evasion	T1218.010	7
Windows: Windows Defender Exclusion Set	Defense Evasion	T1562.001	7
Windows: Windows Defender Threat Detection Disabled - Service	Defense Evasion	T1562.001	3
Windows: Windows Processes Suspicious Parent Directory	Defense Evasion	T1036.005	3
Windows: Writing Of Malicious Files To The Fonts Folder	Defense Evasion	T1211	5
Windows: XSL Script Processing	Defense Evasion	T1220	5

Credential Access

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Logon Time Restriction Violation	Credential Access	T1110.001	8
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
ARP Exploit	Credential Access	T1557.002	7
AWS IAM Brute Force of Assume Role Policy	Credential Access	T1110.001	7
AWS Management Console Brute Force of Root User Identity	Credential Access	T1110.001	10
AWS SecHub: Tactics: Credential Access Detected	Credential Access	none	8
AWS Secret Accessed in Secrets Manager	Credential Access	T1528	7
Account Locked: Domain	Credential Access	T1110.001	6
Account Locked: FortiSIEM	Credential Access	T1110.001	9
Account Locked: Network Device	Credential Access	T1110.001	9
Account Locked: Server	Credential Access	T1110.001	8
Azure Key Vault Modified	Credential Access	T1552.001	9
Azure Storage Account Key Regenerated	Credential Access	T1528	3
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Cisco Call Manager EMCC Login Failure	Credential Access	T1110.001	7
Cisco CallManager Excessive Authentication Failure	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Crowdstrike: Credential Theft Detected	Credential Access	none	8
CyberArk Vault Blocked Operations	Credential Access	none	8
CyberArk Vault CPM Password Disabled	Credential Access	none	8
CyberArk Vault Excessive Failed PSM Connections	Credential Access	none	8
CyberArk Vault Excessive Impersonations	Credential Access	none	8
CyberArk Vault Excessive PSM Keystroke Logging Failure	Credential Access	none	8
CyberArk Vault Excessive PSM Session Monitoring Failure	Credential Access	T1110.001	8
CyberArk Vault Excessive Password Release Failure	Credential Access	T1110.001	8
CyberArk Vault File Operation Failure	Credential Access	none	8
CyberArk Vault Object Content Validation Failure	Credential Access	none	8
CyberArk Vault Unauthorized User Stations	Credential Access	none	8
Disabled Windows Account Logon Attempts	Credential Access	T1110.001	9
Failed Account Activity On Prior Disabled Account	Credential Access	T1110.001	8
Identity Spoofing Exploit	Credential Access	T1557.002	7
Inbound insecure protocol traffic detected	Credential Access	T1552.001	7
Linux: Network Sniffing via Tcpdump	Credential Access	T1040	5
Linux: Searching for Passwords in Files	Credential Access	T1552.001	5
MS 365 Defender: LSASS Memory - Credential Access Alert	Credential Access	T1003.001	9
MS 365 Defender: OS Credential Dumping - Suspicious Activity Alert	Credential Access	T1003.007	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Multiple Login Failures: Net Device: No Source IP	Credential Access	T1110.001	9
Multiple Logon Failures: Database	Credential Access	T1110.001	9
Multiple Logon Failures: Domain	Credential Access	T1110.001	4
Multiple Logon Failures: Misc App	Credential Access	T1110.001	6
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Office365: Brute Force Login Attempts - Same Source	Credential Access	T1110.003	7
Office365: Brute Force Login Attempts - Same User	Credential Access	T1110.001	7
Office365: Brute Force Logon Success	Credential Access	T1110.003	9
Outbound insecure protocol traffic from non guest network detected	Credential Access	T1552.001	7
Possible Consent Grant Attack via Azure-Registered Application	Credential Access	T1528	7
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Database	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Domain	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Replay Exploit	Credential Access	T1557.002	7
Session Hijacking Exploit	Credential Access	T1557.002	7
Successful Account Activity On a Prior Disabled Account	Credential Access	T1110.001	8
Successful Windows Dormant Account Logon	Credential Access	T1110.001	9
Sudden User Location Change	Credential Access	none	9
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
Suspicious logon attempt	Credential Access	T1110.001	9
Windows Dormant Account Detected	Credential Access	T1110.001	4
Windows: Active Directory Database Snapshot Via ADExplorer	Credential Access	T1552.001	5
Windows: Active Directory Replication from Non Machine Account	Credential Access	T1003.006	9
Windows: Automated Collection Command Prompt	Credential Access	T1552.001	5
Windows: Copying Sensitive Files with Credential Data	Credential Access	T1003.003	7
Windows: CreateDump Process Dump	Credential Access	T1003.001	7
Windows: Cred Dump Tools Dropped Files	Credential Access	T1003.005	7
Windows: DPAPI Domain Backup Key Extraction	Credential Access	T1003.004	7
Windows: DPAPI Domain Master Key Backup Attempt	Credential Access	T1003.004	5
Windows: Dropping Of Password Filter DLL	Credential Access	T1556.002	5
Windows: DumpMinitool Execution	Credential Access	T1003.001	5
Windows: Dumping Process via Sqldumper.exe	Credential Access	T1003.001	5
Windows: Dumping of Sensitive Hives Via Reg.EXE	Credential Access	T1003.005	7
Windows: Enumeration for 3rd Party Creds From CLI	Credential Access	T1552.002	5
Windows: Enumeration for Credentials in Registry	Credential Access	T1552.002	5
Windows: Esentutl Gather Credentials	Credential Access	T1003.003	5
Windows: Esentutl Volume Shadow Copy Service Keys	Credential Access	T1003.002	7
Windows: Failed to execute Privileged Service LsaRegisterLogonProcess	Credential Access	T1558.003	7
Windows: Findstr GPP Passwords	Credential Access	T1552.006	7
Windows: Findstr LSASS	Credential Access	T1552.006	7
Windows: Generic Password Dumper Activity on LSASS	Credential Access	T1003.001	7
Windows: HackTool - CrackMapExec Process Patterns	Credential Access	T1003.001	7
Windows: HackTool - CreateMiniDump Execution	Credential Access	T1003.001	7
Windows: HackTool - Dumpert Process Dumper Default File	Credential Access	T1003.001	9
Windows: HackTool - Dumpert Process Dumper Execution	Credential Access	T1003.001	9
Windows: HackTool - HandleKatz LSASS Dumper Execution	Credential Access	T1003.001	7
Windows: HackTool - Inveigh Execution	Credential Access	T1003.001	9
Windows: HackTool - KrbRelay Execution	Credential Access	T1558.003	7
Windows: HackTool - KrbRelayUp Execution	Credential Access	T1558.003	7
Windows: HackTool - Mimikatz Execution	Credential Access	T1003.006	7
Windows: HackTool - Quarks PwDump Execution	Credential Access	T1003.002	7
Windows: HackTool - Rubeus Execution	Credential Access	T1558.003	9
Windows: HackTool - SafetyKatz Execution	Credential Access	T1003.001	9
Windows: HackTool - Windows Credential Editor WCE Execution	Credential Access	T1003.001	9
Windows: Harvesting Of Wifi Credentials Via Netsh.EXE	Credential Access	T1040	5
Windows: Hijack Legit RDP Session to Move Laterally	Credential Access	T1557.002	7
Windows: Hydra Password Guessing Hack Tool	Credential Access	T1110.001	7
Windows: Invocation of Active Directory Diagnostic Tool ntdsutil.exe	Credential Access	T1003.003	5
Windows: Kerberos Manipulation	Credential Access	T1212	7
Windows: LSASS Access from Non System Account	Credential Access	T1003.001	7
Windows: LSASS Access from White-Listed Processes	Credential Access	T1003.001	7
Windows: LSASS Memory Access by Tool Named Dump	Credential Access	T1003.001	7
Windows: LSASS Memory Dump	Credential Access	T1003.001	7
Windows: LSASS Process Dump Artefact In CrashDumps Folder	Credential Access	T1003.001	7
Windows: LSASS Process Memory Dump Files	Credential Access	T1003.001	7
Windows: Lsass Memory Dump via Comsvcs DLL	Credential Access	T1003.001	9
Windows: Mimikatz DC Sync	Credential Access	T1003.006	7
Windows: NTDS.DIT Created	Credential Access	T1003.003	3
Windows: NTDS.DIT Creation By Uncommon Parent Process	Credential Access	T1003.003	7
Windows: NTDS.DIT Creation By Uncommon Process	Credential Access	T1003.003	7
Windows: New Generic Credentials Added Via Cmdkey.EXE	Credential Access	T1003.005	5
Windows: New Network Trace Capture Started Via Netsh.EXE	Credential Access	T1040	5
Windows: PUA - DIT Snapshot Viewer	Credential Access	T1003.003	7
Windows: PUA - WebBrowserPassView Execution	Credential Access	T1555.003	5
Windows: Password Cracking with Hashcat	Credential Access	T1110.002	7
Windows: Password Dumper Activity on LSASS	Credential Access	T1003.001	7
Windows: Permission Misconfiguration Reconnaissance Via Findstr.EXE	Credential Access	T1552.006	5
Windows: PetitPotam Suspicious Kerberos TGT Request	Credential Access	T1187	7
Windows: Possible Impacket SecretDump Remote Activity	Credential Access	T1003.004	7
Windows: Possible PetitPotam Coerce Authentication Attempt	Credential Access	T1187	7
Windows: Potential Browser Data Stealing	Credential Access	T1555.003	5
Windows: Potential CVE-2021-42287 Exploitation Attempt	Credential Access	T1558.003	5
Windows: Potential Credential Dumping Via WER	Credential Access	T1003.001	7
Windows: Potential Credential Dumping Via WER - Application	Credential Access	T1003.001	7
Windows: Potential LSASS Process Dump Via Procdump	Credential Access	T1003.001	7
Windows: Potential Network Sniffing Activity Using Network Tools	Credential Access	T1040	5
Windows: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE	Credential Access	T1003.005	7
Windows: Potential SAM Database Dump	Credential Access	T1003.002	7
Windows: Potential SPN Enumeration Via Setspn.EXE	Credential Access	T1558.003	5
Windows: PowerShell Get-Process LSASS	Credential Access	T1552.004	7
Windows: PowerShell SAM Copy	Credential Access	T1003.002	7
Windows: Private Keys Reconnaissance Via CommandLine Tools	Credential Access	T1552.004	5
Windows: Procdump Evasion	Credential Access	T1003.001	7
Windows: Procdump Execution	Credential Access	T1003.001	5
Windows: Process Dumping Via Comsvcs.DLL	Credential Access	T1003.001	7
Windows: Process Memory Dump via RdrLeakDiag.EXE	Credential Access	T1003.001	7
Windows: QuarksPwDump Dump File	Credential Access	T1003.002	9
Windows: Register new Logon Process by Rubeus	Credential Access	T1558.003	9
Windows: Registry Parse with Pypykatz	Credential Access	T1003.002	7
Windows: Renamed BrowserCore.EXE Execution	Credential Access	T1528	7
Windows: Renamed CreateDump Utility Execution	Credential Access	T1003.001	7
Windows: SAM Registry Hive Handle Request	Credential Access	T1012,T1552.002	9
Windows: SQLite Chromium Profile Data DB Access	Credential Access	T1555.003	7
Windows: SQLite Firefox Profile Data DB Access	Credential Access	T1539	7
Windows: SafetyKatz Default Dump Filename	Credential Access	T1003.001	7
Windows: Shadow Copies Creation Using Operating Systems Utilities	Credential Access	T1003.003	5
Windows: SilentProcessExit Monitor Registration for LSASS	Credential Access	T1003.007	9
Windows: Suspicious Active Directory Database Snapshot Via ADExplorer	Credential Access	T1552.001	7
Windows: Suspicious Command With Teams Objects Paths	Credential Access	T1528	7
Windows: Suspicious Kerberos RC4 Ticket Encryption	Credential Access	T1558.003	5
Windows: Suspicious Key Manager Access	Credential Access	T1555.004	7
Windows: Suspicious LSASS Access Via MalSecLogon	Credential Access	T1003.001	7
Windows: Suspicious LSASS Process Clone	Credential Access	T1003.001	9
Windows: Suspicious NTDS Exfil Filename Patterns	Credential Access	T1003.003	7
Windows: Suspicious NTLM Authentication on the Printer Spooler Service	Credential Access	T1212	7
Windows: Suspicious Office Token Search Via CLI	Credential Access	T1528	5
Windows: Suspicious PFX File Creation	Credential Access	T1552.004	5
Windows: Suspicious Process Patterns NTDS.DIT Exfil	Credential Access	T1003.003	7
Windows: Suspicious Rejected SMB Guest Logon From IP	Credential Access	T1110.001	5
Windows: Suspicious Renamed Comsvcs DLL Loaded By Rundll32	Credential Access	T1003.001	7
Windows: Suspicious SYSVOL Domain Group Policy Access	Credential Access	T1552.006	5
Windows: Suspicious Teams Application Related ObjectAcess Event	Credential Access	T1528	7
Windows: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded	Credential Access	T1003.001	7
Windows: Suspicious Usage Of Active Directory Diagnostic Tool ntdsutil.exe	Credential Access	T1003.003	5
Windows: Time Travel Debugging Utility Usage: Sysmon V1	Credential Access	T1003.001	7
Windows: Time Travel Debugging Utility Usage: Sysmon V2	Credential Access	T1003.001	7
Windows: Transferring Files with Credential Data via Network Shares	Credential Access	T1003.001,T1003.002,T1003.003	5
Windows: Typical HiveNightmare SAM File Export	Credential Access	T1552.001	7
Windows: Unsigned Image Loaded Into LSASS Process	Credential Access	T1003.001	5
Windows: Use of Adplus.exe	Credential Access	T1003.001	5
Windows: Use of PktMon.exe	Credential Access	T1040	5
Windows: VSSAudit Security Event Source Registration	Credential Access	T1003.002	1
Windows: Volume Shadow Copy Mount	Credential Access	T1003.002	3
Windows: VolumeShadowCopy Symlink Creation Via Mklink	Credential Access	T1003.003	7
Windows: WerFault Accessing LSASS	Credential Access	T1003.001	7
Windows: WerFault LSASS Process Memory Dump	Credential Access	T1003.001	7
Windows: Windows Credential Editor Install Via Registry	Credential Access	T1003.001	9
Windows: Windows Credential Manager Access via VaultCmd	Credential Access	T1555.004	5
Windows: Windows Pcap Drivers	Credential Access	T1040	5
Windows: XORDump Use	Credential Access	T1003.001	7
Wireless MITM attack detected by Network IPS	Credential Access	T1557.002	9

Discovery

Name	Tactic	Technique	Severity
Heavy Half Open TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy Half Open TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy ICMP Ping sweep	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy UDP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy UDP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	9
AWS Instance or Snapshot Discovery	Discovery	T1580	3
AWS SecHub: Tactics: Discovery Detected	Discovery	none	7
Azure Infrastructure Discovery	Discovery	T1580	3
Azure Service Discovery	Discovery	T1526	3
Enumeration of System Information	Discovery	T1082	5
Heavy Half Open TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy Half Open TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy UDP Port Scan: Multiple Hosts	Discovery	T1046	9
Heavy UDP Port Scan: Single Host	Discovery	T1046	7
Info Leak Exploits	Discovery	none	5
Invalid TCP Flags: High Intensity	Discovery	none	9
Invalid TCP Flags: Medium Intensity	Discovery	none	7
Linux Account Discovery via Built-In Tools	Discovery	T1087.001	5
Linux: Discovery of Domain Groups	Discovery	T1069.002	5
Linux: Discovery of Network Environment via Built-in Tools	Discovery	T1016.001	5
Linux: Hping Process Activity	Discovery	T1018	7
Linux: Kernel Module Enumeration	Discovery	T1518.001	5
Linux: Process Discovery via Built-In Applications	Discovery	T1057,T1518.001	5
Linux: System Network Connections Discovery	Discovery	T1049	5
Linux: User Discovery via Whoami	Discovery	T1033	5
Linux: Virtual Machine Fingerprinting By non-root User	Discovery	T1082	5
MS 365 Defender: Suspicious Process Discovery - Discovery Alert	Discovery	T1057	7
MS 365 Defender: System Network Configuration Discovery - Discovery Alert	Discovery	T1016.001	6
MS 365 Defender: System Service Discovery - Discovery Alert	Discovery	T1007	6
Multiple IPS Detected Scans From Same Src	Discovery	T1046	7
Password Policy Enumeration	Discovery	T1201	5
SQL Server Excessive Full Scan	Discovery	T1046	7
Stealth Scan using a tool	Discovery	T1046	9
Sudden Increase in Reported Events From A Host	Discovery	none	7
Targeted System/Application Scan	Discovery	T1046	7
WLAN Scan	Discovery	T1046	7
Windows: AD Privileged Users or Groups Reconnaissance	Discovery	T1087.002	7
Windows: AD User Enumeration	Discovery	T1087.002	5
Windows: Azure AD Health Monitoring Agent Registry Keys Access	Discovery	T1012	5
Windows: Azure AD Health Service Agents Registry Keys Access	Discovery	T1012	5
Windows: BloodHound Collection Files	Discovery	T1482	7
Windows: Computer Discovery And Export Via Get-ADComputer Cmdlet	Discovery	T1033	5
Windows: DirLister Execution	Discovery	T1083	3
Windows: Discovery of a System Time	Discovery	T1124	3
Windows: Domain Trust Discovery Via Dsquery	Discovery	T1482	5
Windows: Exports Critical Registry Keys To a File	Discovery	T1012	7
Windows: Exports Registry Key To a File	Discovery	T1012	3
Windows: Files And Subdirectories Listing Using Dir	Discovery	T1217	3
Windows: Fsutil Drive Enumeration	Discovery	T1120	3
Windows: Group Membership Reconnaissance Via Whoami.EXE	Discovery	T1033	5
Windows: HackTool - Bloodhound/Sharphound Execution	Discovery	T1482	7
Windows: HackTool - SharpLdapWhoami Execution	Discovery	T1033	7
Windows: HackTool - TruffleSnout Execution	Discovery	T1482	7
Windows: HackTool - winPEAS Execution	Discovery	T1082	7
Windows: Local Accounts Discovery	Discovery	T1087.001	3
Windows: Local Groups Reconnaissance Via Wmic.EXE	Discovery	T1069.001	3
Windows: Network Reconnaissance Activity	Discovery	T1082	7
Windows: PUA - AdFind Suspicious Execution	Discovery	T1482	7
Windows: PUA - Advanced IP Scanner Execution	Discovery	T1135	5
Windows: PUA - Advanced Port Scanner Execution	Discovery	T1135	5
Windows: PUA - Nmap/Zenmap Execution	Discovery	T1046	7
Windows: PUA - Seatbelt Execution	Discovery	T1526	7
Windows: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	Discovery	T1087.002	7
Windows: Permission Check Via Accesschk.EXE	Discovery	T1069.001	5
Windows: Potential Active Directory Reconnaissance/Enumeration Via LDAP	Discovery	T1482	5
Windows: Potential Configuration And Service Reconnaissance Via Reg.EXE	Discovery	T1012	5
Windows: Potential Recon Activity Via Nltest.EXE	Discovery	T1482	7
Windows: Potential System Information Discovery Via Wmic.EXE	Discovery	T1082	5
Windows: Python Initiated Connection	Discovery	T1046	5
Windows: Reconnaissance Activity	Discovery	T1087.002	7
Windows: Renamed AdFind Execution	Discovery	T1482	7
Windows: Renamed Whoami Execution	Discovery	T1033	9
Windows: SCM Database Handle Failure	Discovery	T1010	5
Windows: Security Privileges Enumeration Via Whoami.EXE	Discovery	T1033	7
Windows: Share And Session Enumeration Using Net.EXE	Discovery	T1018	3
Windows: Suspicious Execution of Adidnsdump	Discovery	T1018	3
Windows: Suspicious Execution of Hostname	Discovery	T1082	3
Windows: Suspicious Execution of Systeminfo	Discovery	T1082	3
Windows: Suspicious Query of MachineGUID	Discovery	T1082	3
Windows: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet	Discovery	T1087.001	5
Windows: Suspicious Scan Loop Network	Discovery	T1018	5
Windows: Suspicious Use of PsLogList	Discovery	T1087.002	5
Windows: Suspicious Where Execution	Discovery	T1217	3
Windows: Suspicious Whoami.EXE Execution	Discovery	T1033	7
Windows: Suspicious Whoami.EXE Execution From Privileged Process	Discovery	T1033	7
Windows: SysKey Registry Keys Access	Discovery	T1012	9
Windows: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE	Discovery	T1518.001	7
Windows: System Network Connections Discovery Via Net.EXE	Discovery	T1049	3
Windows: Use of W32tm as Timer	Discovery	T1124	7
Windows: User Discovery And Export Via Get-ADUser Cmdlet	Discovery	T1033	5
Windows: WhoAmI as Parameter	Discovery	T1033	7
Windows: Whoami Utility Execution	Discovery	T1033	5
Windows: Whoami.EXE Execution Anomaly	Discovery	T1033	7

Lateral Movement

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Lateral Movement Detected	Lateral Movement	none	8
Exposed Service Detected on Host	Lateral Movement	T1210	9
FortiDeceptor: IPS Attack to Decoy	Lateral Movement	none	9
FortiRecon: Certificate Issue Found for an Asset	Lateral Movement	T1210	9
FortiRecon: High Severity Reputation Issue Found for an Asset	Lateral Movement	T1210	9
FortiSandbox detects multiple attacks from same source	Lateral Movement	none	9
FortiWeb: Permitted Inbound Attack Detected	Lateral Movement	T1210	9
Lateral Movement Detected	Lateral Movement	none	9
Linux: Remote Terminal Session Started	Lateral Movement	T1021.004	5
Log4J Exploit Request Detected By Regex	Lateral Movement	T1210	7
Log4J Exploit Request Detected on Host by Fortinet Products	Lateral Movement	T1210	10
Log4J Exploit Request Detected on Network by Fortinet Products	Lateral Movement	T1210	10
Malware outbreak	Lateral Movement	none	9
Outbreak: 3CX Supply Chain Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: 3CX Supply Chain Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ABB Flow Computer Path Traversal Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Access Control Bypass Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Access Control Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Akira Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Akira Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Androxgh0st Malware Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Androxgh0st Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache ActiveMQ Ransomware Attack Detected on Host	Lateral Movement	T1210	10
Outbreak: Apache ActiveMQ Ransomware Attack Detected on Network	Lateral Movement	T1210	10
Outbreak: Apache OFBiz RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Path Traversal Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Apache Path Traversal Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache RocketMQ RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Struts 2 RCE Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Apache Struts 2 RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Host	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Network	Lateral Movement	T1210	9
Outbreak: Black Basta Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Black Basta Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: CDATA Web Management System RCE Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: CDATA Web Management System RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: CISA Top 20 Vulnerability detected on Host	Lateral Movement	T1210	9
Outbreak: Cacti Server Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Cacti Server Command Injection Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Check Point Quantum Security Gateways Information Disclosure Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Cisco IOS XE Web UI Attack Detected on Network	Lateral Movement	T1210,T1036.004	9
Outbreak: Citrix Bleed Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ConnectWise ScreenConnect Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: ConnectWise ScreenConnect Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: CosmicEnergy Malware Detected on Host	Lateral Movement	T1210	9
Outbreak: CosmicEnergy Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: Dlink Multiple Devices Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: FortiGate Authentication bypass on Administrative Interface	Lateral Movement	T1210	10
Outbreak: FortiGate detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiManager Command Execution Vulnerability Detected on Device	Lateral Movement	T1210	9
Outbreak: FortiManager Command Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: FortiOS SSLVPN Heap Buffer Overflow attack - CVE-2022-42475 Detected on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected Zerobot Botnet Activity on Network	Lateral Movement	T1210	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: GeoServer RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Hikvision IP Camera Command Injection Vulnerability CVE-2021-36260 on Network	Lateral Movement	T1210	9
Outbreak: Hive Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Hive Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Connect Secure and Policy Secure Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Jenkins RCE Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Jenkins RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: JetBrains TeamCity Authentication Bypass Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: JetBrains TeamCity Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Joomla CMS Improper Access Check Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Lazarus RAT Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Lazarus RAT Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Mallox Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Mallox Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Host	Lateral Movement	T1021.002	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Network	Lateral Movement	T1021.002	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft SharePoint Server Elevation of Privilege Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft SharePoint Server Elevation of Privilege Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Mitel MiCollab Unauthorized Access Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Mitel MiCollab Unauthorized Access Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Multiple Vendor Camera System Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Nice Linear eMerge Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Oracle WebLogic Server Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PAN OS GlobalProtect Command Injection Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: PAN OS GlobalProtect Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PHP CGI OS Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Palo Alto Expedition Missing Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Palo Alto Networks Management Interface Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress Kemp LoadMaster OS Command Injection Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Host	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: Sandbreak vm2 sandbox module RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ServiceNow Remote Code Execution Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: SolarView Compact Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Sunhillo SureLine Command Injection Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Sunhillo SureLine Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Synacor Zimbra Collaboration Command Execution Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Synacor Zimbra Collaboration Command Execution Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: TBK DVR Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Teclib GLPI Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: VMWare Workspace ONE Vulnerability - CVE-2022-22954 on Network	Lateral Movement	T1210	9
Outbreak: VMware Aria Operations for Networks Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Wordpress WPGateway Plugin Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Zerobot Botnet Activity Detected on Host	Lateral Movement	T1210	9
Outbreak: Zerobot Botnet Activity Detected on Network	Lateral Movement	T1210	9
Outbreak: Zoho ManageEngine RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Router Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Permitted Traffic from Dragos Worldview Malware IP List	Lateral Movement	T1210	9
PowerShell Downgrade Attack Detected	Lateral Movement	T1210	8
Remote Desktop traffic from Internet	Lateral Movement	T1021.001,T1133,T1219	9
Traffic to Dragos Worldview Malware IP List	Lateral Movement	T1210	9
VNC traffic from Internet	Lateral Movement	T1021.005,T1133,T1219	9
Windows: Access to ADMIN$ Share	Lateral Movement	T1021.002	3
Windows: DCERPC SMB Spoolss Named Pipe	Lateral Movement	T1021.002	5
Windows: DCOM Internet Explorer.Application Iertutil DLL Hijack: Security Log	Lateral Movement	T1021.003	7
Windows: Denied Access To Remote Desktop	Lateral Movement	T1021.001	5
Windows: First Time Seen Remote Named Pipe	Lateral Movement	T1021.002	7
Windows: Impacket PsExec Execution	Lateral Movement	T1021.002	7
Windows: MMC Spawning Windows Shell	Lateral Movement	T1021.003	7
Windows: MMC20 Lateral Movement	Lateral Movement	T1021.003	7
Windows: Metasploit Or Impacket Service Installation Via SMB PsExec	Lateral Movement	T1570	7
Windows: Metasploit SMB Authentication	Lateral Movement	T1021.002	7
Windows: New Remote Desktop Connection Initiated Via Mstsc.EXE	Lateral Movement	T1021.001	5
Windows: OpenSSH Server Listening On Socket	Lateral Movement	T1021.004	5
Windows: PSEXEC Remote Execution File Artefact	Lateral Movement	T1570	7
Windows: Potential DCOM InternetExplorer.Application DLL Hijack	Lateral Movement	T1021.003	9
Windows: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load	Lateral Movement	T1021.003	9
Windows: Potential MSTSC Shadowing Activity	Lateral Movement	T1563.002	7
Windows: Potential RDP Exploit CVE-2019-0708	Lateral Movement	T1210	5
Windows: Protected Storage Service Access	Lateral Movement	T1021.002	7
Windows: RDP Login from Localhost	Lateral Movement	T1021.001	7
Windows: Remote Service Activity via SVCCTL Named Pipe	Lateral Movement	T1021.002	5
Windows: Rundll32 Execution Without Parameters	Lateral Movement	T1570	7
Windows: SMB Create Remote File Admin Share	Lateral Movement	T1021.002	7
Windows: Scanner PoC for CVE-2019-0708 RDP RCE Vuln	Lateral Movement	T1210	9
Windows: Suspicious PsExec Execution	Lateral Movement	T1021.002	7
Windows: Suspicious RDP Redirect Using TSCON	Lateral Movement	T1563.002	7
Windows: Suspicious UltraVNC Execution	Lateral Movement	T1021.005	7
Windows: Terminal Service Process Spawn	Lateral Movement	T1210	7
Windows: WCE wceaux dll Access	Lateral Movement	T1550.002	9
Windows: WinRM Access with Evil-WinRM	Lateral Movement	T1021.006	5
Windows: Windows Admin Share Mount Via Net.EXE	Lateral Movement	T1021.002	5
Windows: Windows Internet Hosted WebDav Share Mount Via Net.EXE	Lateral Movement	T1021.002	7
Windows: Windows Share Mount Via Net.EXE	Lateral Movement	T1021.002	3
Windows: smbexec.py Service Installation	Lateral Movement	T1021.002,T1569.002,T1021.002	9

Collection

Name	Tactic	Technique	Severity
Excessive SNMP Port 161 Traffic from a Source to the same Destination	Collection	T1602.001	5
AWS CloudTrail Log Created	Collection	T1530	3
AWS SecHub: Tactics: Collection Detected	Collection	none	8
Agent FIM: Linux File or Directory Created	Collection	T1074.001,T1565.001	7
Agent FIM: Windows File or Directory Created	Collection	T1074.001,T1565.001	7
Agentless FIM: Audited file or directory created	Collection	T1074.001,T1565.001	8
Excessive End User Mail	Collection	T1114.001	8
Excessive Postfix mail send latency	Collection	T1114.001	6
FortiMail: AntiVirus Phishing URL found	Collection	T1114.001	9
FortiMail: Antispam Malicious URL found	Collection	T1114.001	9
FortiMail: Malicious Spam File Attachment Found	Collection	T1114.001	9
FortiRecon: Leaked Credit or Debit Cards Found Online	Collection	T1119	9
GCP: Pub/Sub Subscription Created	Collection	T1119	6
GCP: Pub/Sub Topic Created	Collection	T1119	6
GCP: Storage Bucket IAM Permissions Modified	Collection	T1530	6
GCP: Storage Bucket Updated	Collection	T1530	6
Linux: Creation of an Archive with Common Archivers	Collection	T1074.001	5
Malware found in mail	Collection	T1114.001	9
Office365: Admin or Delegated User Created Mailbox Forwarding Rule for another User	Collection	T1114.003	9
Office365: Delete Message Inbox Rule Created	Collection	T1114.003	9
Office365: Mailbox Login from Outside My Country	Collection	T1114.002	9
Office365: Mailbox SendAs or SendOnBehalf has occurred	Collection	T1114.003	6
Office365: Move To Folder Inbox Rule Created	Collection	T1114.003	6
Office365: Set-Mailbox Forwarding Action Created	Collection	T1114.003	9
Office365: User Mailbox Forwarding Rule Created	Collection	T1114.003	9
Spam/Malicious Mail Attachment found but not remediated	Collection	T1114.001	7
UEBA Policy detects email download	Collection	T1114.001	7
UEBA Policy detects email upload	Collection	T1114.001	7
UEBA Policy detects file archiver application	Collection	T1560.001	7
Windows Removable Media Inserts	Collection	T1025	7
Windows failed file access	Collection	T1005,T1565.001	7
Windows successful file access	Collection	T1005,T1565.001	5
Windows: 7Zip Compressing Dump Files	Collection	T1560.001	7
Windows: Audio Capture via PowerShell	Collection	T1123	5
Windows: Audio Capture via SoundRecorder	Collection	T1123	5
Windows: Browser Started with Remote Debugging	Collection	T1185	5
Windows: Compress Data and Lock With Password for Exfiltration With 7-ZIP	Collection	T1560.001	5
Windows: Compress Data and Lock With Password for Exfiltration With WINZIP	Collection	T1560.001	5
Windows: Copy from Admin Share	Collection	T1039	7
Windows: Data Compressed - rar.exe	Collection	T1560.001	3
Windows: Esentutl Steals Browser Information	Collection	T1005	5
Windows: HackTool - ADCSPwn Execution	Collection	T1557.001	7
Windows: Impacket Tool Execution	Collection	T1557.001	7
Windows: Local Privilege Escalation Indicator TabTip	Collection	T1557.001	7
Windows: PUA - Mouse Lock Execution	Collection	T1056.002	5
Windows: Potential Data Stealing Via Chromium Headless Debugging	Collection	T1185	7
Windows: Potential SMB Relay Attack Tool Execution	Collection	T1557.001	9
Windows: PowerShell Get-Clipboard Cmdlet Via CLI	Collection	T1115	5
Windows: Processes Accessing the Microphone and Webcam	Collection	T1123	5
Windows: Psr.exe Capture Screenshots	Collection	T1113	5
Windows: Rar Usage with Password and Compression Level	Collection	T1560.001	7
Windows: Recon Information for Export with Command Prompt	Collection	T1119	5
Windows: RottenPotato Like Attack Pattern	Collection	T1557.001	7
Windows: Suspicious Access to Sensitive File Extensions	Collection	T1039	5
Windows: Suspicious Camera and Microphone Access	Collection	T1125	7
Windows: Suspicious Manipulation Of Default Accounts Via Net.EXE	Collection	T1560.001	7
Windows: UIPromptForCredentials DLLs	Collection	T1056.002	5
Windows: Use of CLIP	Collection	T1115	3
Windows: Veeam Backup Database Suspicious Query	Collection	T1005	5
Windows: VeeamBackup Database Credentials Dump	Collection	T1005	7
Windows: Winrar Compressing Dump Files	Collection	T1560.001	7
Windows: Winrar Execution in Non-Standard Folder	Collection	T1560.001	7
Windows: Zip A Folder With PowerShell For Staging In Temp	Collection	T1074.001	5

Command and Control

Name	Tactic	Technique	Severity
Suspicious Botnet like End host DNS Behavior	Command and Control	none	6
Traffic to bogon networks	Command and Control	none	8
AWS SecHub: Tactics: Command-and-Control Detected	Command and Control	none	8
Crowdstrike: User Compromise	Command and Control	none	8
FortiGate detects Botnet	Command and Control	none	9
FortiSandbox detects Botnet	Command and Control	none	9
Outbreak: HAFNIUM Exchange OWA Server Authentication Bypass	Command and Control	none	9
Outbreak: HAFNIUM FortiGate Permitted IPS Event	Command and Control	none	9
Outbreak: HAFNIUM Infected File Detected by FortiGate	Command and Control	none	9
Outbreak: HAFNIUM Suspicious File hash match	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Created	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash Match	Command and Control	none	9
Permitted Traffic from Emerging Threat IP List	Command and Control	none	7
Windows: Powershell opening TCP Connection	Command and Control	none	7

Exfiltration

Name	Tactic	Technique	Severity
Excessive End User Mail To Unauthorized Mail Gateways	Exfiltration	T1020.001	8
Large Outbound Transfer To Outside My Country	Exfiltration	T1048.001	8
Blocklist User Agent Match	Exfiltration	T1041	9
Crowdstrike: Known Malware	Exfiltration	T1041	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6
FireEye Malware Callback	Exfiltration	T1041	9
FortiSandbox detects URL Malware	Exfiltration	T1041	9
FortiSandbox detects file malware with high or medium risk	Exfiltration	T1041	9
FortiSandbox detects malicious file malware from file upload	Exfiltration	T1041	9
FortiSandbox detects multiple hosts with infected files	Exfiltration	T1041	9
FortiSandbox detects unknown risk file malware	Exfiltration	T1041	7
Large Outbound Transfer	Exfiltration	T1048.001	8
MS 365 Defender: Malware Detected	Exfiltration	T1041	9
Malware found but not remediated	Exfiltration	T1041	9
Malware hash match	Exfiltration	T1041	9
Outbreak: DARKSIDE Domain Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Host	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Network	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Inbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Outbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Suspicious File Hash Found on Host	Exfiltration	T1041	9
Outbreak: DARKSIDE Suspicious File Hash Found on Network	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected by FortiClient	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Host	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Network	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found by Forticlient	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Host	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Network	Exfiltration	T1041	9
Permitted Traffic from AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Blocklist DE Malware IP List	Exfiltration	T1041	9
Permitted Traffic from C2 Tracker Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CINS Score Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CertPL Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Cisco Talos Malware IP List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FireHol Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiGuard Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Greensnow Malware IP List	Exfiltration	T1041	9
Permitted Traffic from IPSum Malware IP List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware IP List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Proofpoint Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Snort Malware IP List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Traffic to Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Traffic to Blocklist DE Malware IP List	Exfiltration	T1041	9
Traffic to C2 Tracker Malware IP List	Exfiltration	T1041	9
Traffic to CINS Score Malware IP List	Exfiltration	T1041	9
Traffic to CertPL Malware Domain List	Exfiltration	T1041	9
Traffic to Cisco Talos Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware Domain List	Exfiltration	T1041	9
Traffic to DigitalSide Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware URL List	Exfiltration	T1041	9
Traffic to Emerging Threat IP List	Exfiltration	T1048.001	7
Traffic to FireHol Malware IP List	Exfiltration	T1041	9
Traffic to FortiGuard Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware Domain List	Exfiltration	T1041	9
Traffic to FortiRecon Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware URL List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware Domain List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware IP List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware URL List	Exfiltration	T1041	9
Traffic to Greensnow Malware IP List	Exfiltration	T1041	9
Traffic to IPSum Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware Domain List	Exfiltration	T1041	9
Traffic to MISP Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware URL List	Exfiltration	T1041	9
Traffic to Mandiant Malware Domain List	Exfiltration	T1041	9
Traffic to Mandiant Malware IP List	Exfiltration	T1041	9
Traffic to Mandiant Malware URL List	Exfiltration	T1041	9
Traffic to OpenCTI Malware Domain List	Exfiltration	T1041	9
Traffic to OpenCTI Malware IP List	Exfiltration	T1041	9
Traffic to OpenCTI Malware URL List	Exfiltration	T1041	9
Traffic to OpenPhish Malware URL List	Exfiltration	T1041	9
Traffic to Proofpoint Malware IP List	Exfiltration	T1041	9
Traffic to Snort Malware IP List	Exfiltration	T1041	9
Traffic to ThreatFox Malware URL List	Exfiltration	T1041	9
Traffic to TweetFeed Malware Domain List	Exfiltration	T1041	9
Traffic to TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to TweetFeed Malware URL List	Exfiltration	T1041	9
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9
Windows Server USB File Write	Exfiltration	T1052.001	7
Windows: DNS Query for Anonfiles.com Domain - DNS Client	Exfiltration	T1567.002	7
Windows: DNS Query for Anonfiles.com Domain - Sysmon	Exfiltration	T1567.002	7
Windows: DNS Query for MEGA.io Upload Domain	Exfiltration	T1567.002	7
Windows: DNS Query for Ufile.io Upload Domain - DNS Client	Exfiltration	T1567.002	7
Windows: DNS Query for Ufile.io Upload Domain - Sysmon	Exfiltration	T1567.002	7
Windows: PUA - Rclone Execution	Exfiltration	T1567.002	7
Windows: Suspicious Outbound SMTP Connections	Exfiltration	T1048.003	5
Windows: Suspicious WebDav Client Execution	Exfiltration	T1048.003	7
Windows: Suspicious WebDav Client Execution: Sysmon V2	Exfiltration	T1048.003	5

Impact

Name	Tactic	Technique	Severity
Excessive Denied Connections From An External Country	Impact	T1498.001	7
Excessive Denied Connections From Same Src	Impact	T1498.001	8
Excessive Denied Connections To A Port	Impact	T1498.001	7
Excessive Denied Connections To Same Destination	Impact	T1498.001	8
Half Open TCP DDOS Attack	Impact	T1498.001	7
High Process CPU: Server	Impact	T1499.003	8
HyperV Logical Processor Total Run Time Percent Critical	Impact	T1499.001	5
Sudden Increase In Firewall Connections	Impact	T1498.001	7
TCP DDOS Attack	Impact	T1498.001	8
AWS EC2 Instance Down	Impact	T1529	4
AWS IAM Group Deleted	Impact	T1531	3
AWS IAM MFA Device Deactivated	Impact	T1531	9
AWS RDS Cluster Deleted	Impact	T1485	5
AWS RDS Instance/Cluster Stopped	Impact	T1489	5
AWS SecHub: Host Vulnerability Detected	Impact	T1499.004	8
AWS SecHub: Software and Configuration Violation	Impact	none	6
AWS SecHub: Tactics: Impact: Data Destruction Detected	Impact	none	7
AWS SecHub: Tactics: Impact: Data Exfiltration Detected	Impact	none	8
AWS SecHub: Tactics: Impact: Data Exposure Detected	Impact	none	8
AWS SecHub: Tactics: Impact: Denial of Service Detected	Impact	T1498.001	8
AWS SecHub: Unusal Data Behavior Detected	Impact	none	7
AWS SecHub: Unusal Database Behavior Detected	Impact	none	7
AWS SecHub: Unusal Network Flow Behavior Detected	Impact	none	8
AWS SecHub: Unusal Process Behavior Detected	Impact	none	8
AWS SecHub: Unusal Serverless Behavior Detected	Impact	none	7
AWS SecHub: Unusual Application Behavior Detected	Impact	none	7
ArubaOS-CX: Multiple Users Deleted	Impact	T1531	9
ArubaOS-CX: User Deleted	Impact	T1531	9
Auto Service Stopped	Impact	T1489	4
Azure Resource Group Deleted	Impact	T1485	5
BGP Neighbor Down	Impact	T1529	9
Cisco Call Manager DDR Down	Impact	T1489	9
Cisco CallManager Cluster Member Down	Impact	T1489	10
Cisco CallManager Critical Service Down	Impact	T1489	9
Crowdstrike: Data Deletion	Impact	none	8
Crowdstrike: Data Theft	Impact	none	8
Cylance Found Corrupt File	Impact	none	7
Datastore Space Warning	Impact	T1499.001	7
Degraded IPSLA DNS Test	Impact	T1499.002	7
Degraded IPSLA ICMP Test	Impact	T1499.002	7
Degraded IPSLA UDP Echo Test	Impact	T1499.002	7
Degraded VoIP Call Quality	Impact	T1499.002	7
Degraded VoIP IPSLA Call Quality	Impact	T1499.002	7
Distributed DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack on Network Devices by Network IPS	Impact	T1498.001	9
DoS Attack on WLAN Infrastructure by Network IPS	Impact	T1498.001	9
EIGRP Neighbor Down	Impact	T1529	9
ESX CPU Critical	Impact	T1499.001	9
ESX CPU Warning	Impact	T1499.001	5
ESX Disk I/O Critical	Impact	T1499.001	9
ESX Disk I/O Warning	Impact	T1499.001	5
ESX Memory Critical	Impact	T1499.001	9
ESX Memory Warning	Impact	T1499.001	5
ESX Network I/O Critical	Impact	T1499.001	9
ESX Network I/O Warning	Impact	T1499.001	5
ESX Server Health: Critical	Impact	T1499.001	9
ESX Server Health: Warning	Impact	T1499.001	7
EqualLogic Connection Read/Write Latency Critical	Impact	T1499.001	9
EqualLogic Connection Read/Write Latency Warning	Impact	T1499.001	5
Excessive FTP Client Side Errors	Impact	T1498.001	7
Excessive HTTP Client Side Errors	Impact	T1498.001	7
Excessive Postfix gateway connection failures	Impact	T1499.002	8
Excessive Postfix mail send error	Impact	T1499.002	8
Exchange Server Mailbox Queue high	Impact	T1499.002	7
Exchange Server RPC latency high	Impact	T1499.002	7
Exchange Server RPC request high	Impact	T1499.002	7
Exchange Server SMTP Queue high	Impact	T1499.002	7
FortiGate: Admin User Deleted	Impact	T1531	9
FortiGate: Admin User Deleted via Console	Impact	T1531	9
FortiWeb Connection Limit Reached	Impact	T1499.002	9
GCP: IAM Custom Role Deleted	Impact	T1531	9
GCP: Service Account Access Key Deleted	Impact	T1531	6
GCP: Service Account Deleted	Impact	T1531	9
GCP: Service Account Disabled	Impact	T1531	8
High Process CPU: Network Device	Impact	T1499.002	8
High Process Memory: Network Device	Impact	T1499.002	8
High Process Memory: Server	Impact	T1499.003	8
HyperV Disk I/O Warning	Impact	T1499.001	5
HyperV Disk Latency Critical	Impact	T1499.001	9
HyperV Guest Critical	Impact	T1499.001	9
HyperV Guest Hypervisor Run Time Percent Warning	Impact	T1499.001	7
HyperV Logical Processor Total Run Time Percent Warning	Impact	T1499.001	7
HyperV Page fault Critical	Impact	T1499.001	9
HyperV Page fault Warning	Impact	T1499.001	7
HyperV Remaining Guest Memory Warning	Impact	T1499.001	7
ICMP Flood From Same Source	Impact	T1498.001	7
IIS Virtual Memory Critical	Impact	T1499.003	9
IPSLA HTTP Test Failure	Impact	T1499.002	7
Important process down	Impact	T1489	7
Important process staying Down	Impact	T1489	9
Isilon Protocol Latency Critical	Impact	T1499.001	9
MS 365 Defender: Delivery Detected	Impact	none	8
Meraki Device Down	Impact	T1489	9
Microsoft SQL Server Instance Down	Impact	T1489	9
Multi-Factor Authentication Disabled for an Azure User	Impact	T1531,T1562.001	9
MySQL Database Instance Down	Impact	T1489	9
NFS Disk space Warning	Impact	T1499.001	5
NetApp Back to Back Consistency Point	Impact	T1499.001	9
NetApp CIFS Latency Critical	Impact	T1499.001	9
NetApp CIFS Read/Write Latency Warning	Impact	T1499.001	5
NetApp FCP Read/Write Latency Critical	Impact	T1499.001	9
NetApp FCP Read/Write Latency Warning	Impact	T1499.001	5
NetApp ISCSI Read/Write Latency Critical	Impact	T1499.001	9
NetApp ISCSI Read/Write Latency Warning	Impact	T1499.001	5
NetApp NFS Read/Write Latency Critical	Impact	T1499.001	9
NetApp NFS Read/Write Latency Warning	Impact	T1499.001	5
NetApp Volume Read/Write Latency Critical	Impact	T1499.001	9
NetApp Volume Read/Write Latency Warning	Impact	T1499.001	5
Network CPU Critical	Impact	T1499.002	9
Network CPU Warning	Impact	T1499.002	5
Network Device Degraded: Lossy Ping Response	Impact	T1529	7
Network Device Down: no ping response	Impact	T1529	7
Network Device Failover	Impact	T1529	9
Network Device Health: Critical	Impact	T1499.002	9
Network Device Health: Warning	Impact	T1499.001	5
Network Device Interface Flapping	Impact	T1529	7
Network IPS Intf Util Critical	Impact	T1498.001	9
Network IPS Intf Util Warning	Impact	T1498.001	5
Network Intf Util Critical	Impact	T1498.001	9
Network Intf Util Warning	Impact	T1498.001	5
Network Memory Critical	Impact	T1499.002	9
Network Memory Warning	Impact	T1499.002	5
OSPF Neighbor Down	Impact	T1529	9
Oracle Database Instance Down	Impact	T1489	9
Oracle Database Listener Down	Impact	T1489	9
Oracle OCI: User Deleted	Impact	T1531	9
Outbreak: CISA Alert AA24-249A Russian Cyber Espionage Attack Detected on Host	Impact	T1485	9
Outbreak: CISA Alert AA24-249A Russian Cyber Espionage Attack Detected on Network	Impact	T1485	9
Outbreak: HermeticWiper-Foxblade Malware Detected on Host	Impact	T1485	9
Outbreak: HermeticWiper-Foxblade Malware Detected on Network	Impact	T1485	9
Outbreak: Spring4Shell Malware Detected on Network	Impact	T1485	9
Poor VoIP Call Quality	Impact	T1499.002	9
Poor VoIP IPSLA Call Quality	Impact	T1499.002	9
Radvision Ethernet Loss	Impact	T1489	7
Radvision Gateway Down	Impact	T1489	9
Radvision ISDN Loss	Impact	T1489	7
Ransomware detected on a host	Impact	T1486	9
Ransomware outbreak detected	Impact	T1486	10
SNMP Service Unavailable	Impact	T1489	9
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9
Server CPU Critical	Impact	T1499.001	9
Server CPU Warning	Impact	T1499.001	5
Server Degraded: Lossy Ping Response	Impact	T1529	7
Server Disk Latency Critical	Impact	T1499.001	9
Server Disk Latency Warning	Impact	T1499.001	5
Server Disk Space Critical	Impact	T1499.001	9
Server Disk space Warning	Impact	T1499.001	5
Server Down: No Ping Response	Impact	T1529	7
Server Intf Error Critical	Impact	T1499.001	9
Server Intf Error Warning	Impact	T1499.001	5
Server Intf Util Critical	Impact	T1499.001	9
Server Intf Util Warning	Impact	T1499.001	5
Server Memory Critical	Impact	T1499.001	9
Server Memory Warning	Impact	T1499.001	5
Server Network Interface Flapping	Impact	T1529	7
Server Swap Memory Critical	Impact	T1499.001	9
Service Degraded: Slow Response to STM	Impact	T1489	7
Service Degraded: Slow Response to STM: Has IP	Impact	T1499.003	7
Service Down: No Response to STM	Impact	T1499.003	9
Service Staying Down: No Response to STM	Impact	T1499.003	8
Storage CPU Warning	Impact	T1499.001	5
Storage Device CPU Critical	Impact	T1499.001	9
Storage Device Disk Space Critical	Impact	T1499.001	9
Storage Port Down	Impact	T1489	9
Sudden Increase In Firewall Denied Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Denied Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Permitted Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Permitted Traffic From Host	Impact	T1498.001	7
Sudden Increase In Permitted Traffic To Host	Impact	T1498.001	7
Sudden Increase In System CPU Usage	Impact	T1499.001	7
Sudden Increase in Disk I/O	Impact	T1499.001	7
Sudden Increase in Firewall Permitted Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase in ICMP Requests From A Host	Impact	T1498.001	7
Sudden Increase in Inbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Network Interface Traffic	Impact	T1498.001	7
Sudden Increase in Outbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Ping Response Times	Impact	T1499.002	7
Sudden Increase in SNMP Response Times	Impact	T1499.002	7
Sudden Increase in STM Response Times	Impact	T1499.002	7
Sudden Increase in Server Process Count	Impact	T1499.001	7
Sudden Increase in System Memory Usage	Impact	T1499.001	7
Sudden Increase in WMI or OMI Response Times	Impact	T1499.002	7
Unix Server Health: Critical	Impact	T1499.001	9
Unix Server Health: Warning	Impact	T1499.001	5
Unix System Shutting Down	Impact	T1529	6
User deleted from Administrator Group	Impact	T1531	9
User deleted from Backup Operator Group	Impact	T1531	6
User deleted from DNS Admins Group	Impact	T1531	9
User deleted from Domain Admin Group	Impact	T1531	6
User deleted from Remote Desktop User Group	Impact	T1531	9
VCenter Datastore Space Critical	Impact	T1499.001	9
Virtual Machine CPU Critical	Impact	T1499.001	9
Virtual Machine CPU Warning	Impact	T1499.001	5
Virtual Machine Health: Critical	Impact	T1499.001	9
Virtual Machine Health: Warning	Impact	T1499.001	5
Virtual Machine Memory Swapping Critical	Impact	T1499.001	9
Virtual Machine Memory Swapping Warning	Impact	T1499.001	5
Virtual Machine SCSI Bus Reset	Impact	T1499.001	9
WMI or OMI Service Unavailable	Impact	T1489	9
Website defacement attack	Impact	T1491.001,T1491.002	9
Windows File System Replication Down	Impact	T1489	9
Windows Server Health: Critical	Impact	T1499.001	9
Windows Server Health: Warning	Impact	T1499.001	5
Windows Server Paging File Usage Critical	Impact	T1499.001	9
Windows Server Shutting Down	Impact	T1489	6
Windows: Application Uninstalled	Impact	T1489	3
Windows: Audit CVE Event	Impact	T1499.004	9
Windows: Boot Configuration Tampering Via Bcdedit.EXE	Impact	T1490	7
Windows: Copy From VolumeShadowCopy Via Cmd.EXE	Impact	T1490	7
Windows: Delete All Scheduled Tasks	Impact	T1489	7
Windows: Delete Important Scheduled Task	Impact	T1489	7
Windows: Deleted Data Overwritten Via Cipher.EXE	Impact	T1485	5
Windows: Deletion of Volume Shadow Copies via WMI with PowerShell	Impact	T1490	7
Windows: Disable Important Scheduled Task	Impact	T1489	7
Windows: NTFS Vulnerability Exploitation	Impact	T1499.001	7
Windows: Network Communication With Crypto Mining Pool	Impact	T1496	7
Windows: Potential Crypto Mining Activity	Impact	T1496	7
Windows: Potential File Overwrite Via Sysinternals SDelete	Impact	T1485	7
Windows: Renamed Sysinternals Sdelete Execution	Impact	T1485	7
Windows: Sensitive Registry Access via Volume Shadow Copy	Impact	T1490	7
Windows: Shadow Copies Deletion Using Operating Systems Utilities	Impact	T1490	7
Windows: Stop Windows Service Via Net.EXE	Impact	T1489	3
Windows: Stop Windows Service Via PowerShell Stop-Service	Impact	T1489	3
Windows: Stop Windows Service Via Sc.EXE	Impact	T1489	3
Windows: Suspicious Creation TXT File in User Desktop	Impact	T1486	7
Windows: Suspicious Execution of Shutdown	Impact	T1529	5
Windows: Suspicious Execution of Shutdown to Log Out	Impact	T1529	5
Windows: Suspicious Reg Add BitLocker	Impact	T1486	7
Windows: Suspicious Volume Shadow Copy VSS-PS.dll Load	Impact	T1490	7
Windows: Suspicious Volume Shadow Copy Vssapi.dll Load	Impact	T1490	7
Windows: Suspicious Volume Shadow Copy Vsstrace.dll Load	Impact	T1490	7

Rules by Use Case

Application Performance Issue

Name	Tactic	Technique	Severity
Carbon Black Fatal Errors	Application	none	8
Database Server Disk Latency Critical	Storage I/O	none	8
Excessive Destination Windows DC Replication Failure	Domain Controller	none	9
Excessive Postfix gateway connection failures	Impact	T1499.002	8
Excessive Postfix mail send error	Impact	T1499.002	8
Excessive Postfix mail send latency	Collection	T1114.001	6
Excessive Source Windows DC Replication Failure	Domain Controller	none	9
Excessive Web Request Failures	Application	none	7
Excessively Slow Oracle DB Query	Database	none	7
Excessively Slow SQL Server DB Query	Database	none	7
Exchange Server Mailbox Queue high	Impact	T1499.002	7
Exchange Server RPC latency high	Impact	T1499.002	7
Exchange Server RPC request high	Impact	T1499.002	7
Exchange Server SMTP Queue high	Impact	T1499.002	7
Failed Windows DC Diagnostic Test	Domain Controller	none	9
FortiAnalyzer: No logs received from a device in 4 hours	Network	none	6
FortiMail Failover	Mail Server	none	7
High Oracle Non-System Table Space Usage	Database	none	7
High Oracle System Table Space Usage	Database	none	7
IIS Virtual Memory Critical	Impact	T1499.003	9
Mail Hard Bounce Delivery Failures	Mail Server	none	7
Manual Service Started	Server	none	6
Microsoft SQL Server Instance Down	Impact	T1489	9
MySQL Database Instance Down	Impact	T1489	9
Oracle DB Alert Log Error	Database	none	8
Oracle DB Low Buffer Cache Hit Ratio	Database	none	7
Oracle DB Low Library Cache Hit Ratio	Database	none	7
Oracle DB Low Row Cache Hit Ratio	Database	none	7
Oracle DB Low Row Memory Sorts Ratio	Memory	none	7
Oracle Database Instance Down	Impact	T1489	9
Oracle Database Listener Down	Impact	T1489	9
Oracle Database not backed up for 1 day	Database	none	9
SQL Server Excessive Blocking	Database	none	7
SQL Server Excessive Deadlock	Database	none	7
SQL Server Excessive Full Scan	Discovery	T1046	7
SQL Server Excessive Page Read/Write	Database	none	7
SQL Server Low Buffer Cache Hit Ratio	Database	none	7
SQL Server Low Free Pages in Buffer Pool	Database	none	7
SQL Server Low Log Cache Hit Ratio	Database	none	7
SQL Server scheduled job failed	Database	none	7
Service Degraded: Slow Response to STM	Impact	T1489	7
Service Degraded: Slow Response to STM: Has IP	Impact	T1499.003	7
Slow MySQL DB Query	Database	none	7
Sudden Increase in STM Response Times	Impact	T1499.002	7
Windows File System Replication Down	Impact	T1489	9

Botnet Detected

Name	Tactic	Technique	Severity
Suspicious Botnet like End host DNS Behavior	Command and Control	none	6
FortiGate detects Botnet	Command and Control	none	9
FortiSandbox detects Botnet	Command and Control	none	9
Outbreak: FortiWeb detected Zerobot Botnet Activity on Network	Lateral Movement	T1210	9
Outbreak: Sysrv-K Botnet Activity Detected on Host	Resource Development	T1584.005	9
Outbreak: Sysrv-K Botnet Activity Detected on Network	Resource Development	T1584.005	9
Outbreak: Zerobot Botnet Activity Detected on Host	Lateral Movement	T1210	9
Outbreak: Zerobot Botnet Activity Detected on Network	Lateral Movement	T1210	9

Brute Force Logon

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
AWS IAM Brute Force of Assume Role Policy	Credential Access	T1110.001	7
AWS Management Console Brute Force of Root User Identity	Credential Access	T1110.001	10
Account Locked: Domain	Credential Access	T1110.001	6
Account Locked: FortiSIEM	Credential Access	T1110.001	9
Account Locked: Network Device	Credential Access	T1110.001	9
Account Locked: Server	Credential Access	T1110.001	8
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Multiple Login Failures: Net Device: No Source IP	Credential Access	T1110.001	9
Multiple Logon Failures: Database	Credential Access	T1110.001	9
Multiple Logon Failures: Domain	Credential Access	T1110.001	4
Multiple Logon Failures: Misc App	Credential Access	T1110.001	6
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Office365: Brute Force Login Attempts - Same Source	Credential Access	T1110.003	7
Office365: Brute Force Login Attempts - Same User	Credential Access	T1110.001	7
Office365: Brute Force Logon Success	Credential Access	T1110.003	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Database	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Domain	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8

Cloud Performance Issue

Name	Tactic	Technique	Severity
AWS EC2 Instance Down	Impact	T1529	4

Command and Control

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Command-and-Control Detected	Command and Control	none	8
Crowdstrike: User Compromise	Command and Control	none	8
Linux: Mknod Process Activity	Command And Control	T1071.004	7
MS 365 Defender: Ingress Tool Transfer Alert	Command And Control	T1105	7
UEBA Policy detects Tor client usage	Command And Control	T1090.002	7
Windows Torrent Client	Command And Control	T1090.002	7
Windows: AppInstaller Attempts From URL by DNS	Command And Control	T1105	5
Windows: Atera Agent Installation	Command And Control	T1219	7
Windows: Command Line Execution with Suspicious URL and AppData Strings	Command And Control	T1105	5
Windows: Connection Initiated Via Certutil.EXE	Command And Control	T1105	7
Windows: Curl Download And Execute Combination	Command And Control	T1105	7
Windows: Download Files Using Notepad GUP Utility	Command And Control	T1105	7
Windows: Download a File with IMEWDBLD.exe	Command And Control	T1105	7
Windows: File Download with Headless Browser	Command And Control	T1105	7
Windows: Finger.exe Suspicious Invocation	Command And Control	T1105	7
Windows: Import LDAP Data Interchange Format File Via Ldifde.EXE	Command And Control	T1105	5
Windows: Inveigh Execution Artefacts	Command And Control	T1219	9
Windows: Mesh Agent Service Installation	Command And Control	T1219	5
Windows: Microsoft Binary Suspicious Communication Endpoint	Command And Control	T1105	7
Windows: Mstsc.EXE Execution With Local RDP File	Command And Control	T1219	3
Windows: New Outlook Macro Created	Command And Control	T1008	5
Windows: PUA - 3Proxy Execution	Command And Control	T1572	7
Windows: PUA - Netcat Suspicious Execution	Command And Control	T1095	7
Windows: PUA - Ngrok Execution	Command And Control	T1572	7
Windows: PUA - Nimgrab Execution	Command And Control	T1105	7
Windows: Pandemic Registry Key	Command And Control	T1105	9
Windows: Port Forwarding Attempt Via SSH	Command And Control	T1572	7
Windows: Potential Download/Upload Activity Using Type Command	Command And Control	T1105	5
Windows: PowerShell DownloadFile	Command And Control	T1059.001,T1104,T1105	7
Windows: Powershell opening TCP Connection	Command and Control	none	7
Windows: Query Tor Onion Address	Command And Control	T1090.003	7
Windows: RDP to HTTP or HTTPS Target Ports	Command And Control	T1572	7
Windows: Remote File Download via Desktopimgdownldr Utility	Command And Control	T1105	5
Windows: Replace.exe Usage	Command And Control	T1105	5
Windows: ScreenConnect Temporary Installation Artefact	Command And Control	T1219	5
Windows: Script Initiated Connection to Non-Local Network	Command And Control	T1105	7
Windows: Suspicious Binary Writes Via AnyDesk	Command And Control	T1219	7
Windows: Suspicious Certreq Command to Download	Command And Control	T1105	7
Windows: Suspicious Curl.EXE Download	Command And Control	T1105	7
Windows: Suspicious Desktopimgdownldr Command	Command And Control	T1105	7
Windows: Suspicious Desktopimgdownldr Target File	Command And Control	T1105	7
Windows: Suspicious Diantz Download and Compress Into a CAB File	Command And Control	T1105	5
Windows: Suspicious Extrac32 Execution	Command And Control	T1105	5
Windows: Suspicious File Download via CertOC.exe	Command And Control	T1105	7
Windows: Suspicious Invoke-WebRequest Execution	Command And Control	T1105	7
Windows: Suspicious Invoke-WebRequest Execution With DirectIP	Command And Control	T1105	5
Windows: Suspicious LDAP-Attributes Used	Command And Control	T1001.003	7
Windows: Suspicious Mstsc.EXE Execution With Local RDP File	Command And Control	T1219	7
Windows: Suspicious Outlook Macro Created	Command And Control	T1008	7
Windows: Suspicious Plink Port Forwarding	Command And Control	T1572	7
Windows: Suspicious TSCON Start as SYSTEM	Command And Control	T1219	7
Windows: TacticalRMM Service Installation	Command And Control	T1219	5
Windows: Tor Client or Tor Browser Use	Command And Control	T1090.003	7

Correlated IPS Alert

Name	Tactic	Technique	Severity
Code Injection Attack detected by NIPS	Execution	none	9
FortiSandbox detects Network Attack	Execution	none	7
FortiWeb: Permitted Inbound Attack Detected	Lateral Movement	T1210	9
High Risk Rating Cisco IPS Exploit	Execution	none	9
High Severity Inbound Denied Security Exploit	Execution	none	5
High Severity Inbound Permitted IPS Exploit	Execution	none	9
High Severity Outbound Denied IPS Exploit	Execution	none	9
High Severity Outbound Permitted IPS Exploit	Execution	none	9
High Severity Symantec Host IPS Exploit	Execution	none	9
Multiple Distinct IPS Events From Same Src	Execution	none	9
System Exploit Detected by Network IPS	Execution	none	7
System Exploit Detected by Network IPS: Likely Success	Execution	none	9

Credential Harvesting

Name	Tactic	Technique	Severity
ARP Exploit	Credential Access	T1557.002	7
AWS IAM Password Recovery Requested	Initial Access	T1078.004	9
AWS SecHub: Tactics: Credential Access Detected	Credential Access	none	8
AWS Secret Accessed in Secrets Manager	Credential Access	T1528	7
Crowdstrike: Credential Theft Detected	Credential Access	none	8
CyberArk Vault Blocked Operations	Credential Access	none	8
CyberArk Vault Excessive Failed PSM Connections	Credential Access	none	8
CyberArk Vault Excessive Impersonations	Credential Access	none	8
CyberArk Vault Excessive PSM Keystroke Logging Failure	Credential Access	none	8
CyberArk Vault Excessive PSM Session Monitoring Failure	Credential Access	T1110.001	8
CyberArk Vault Excessive Password Release Failure	Credential Access	T1110.001	8
CyberArk Vault File Operation Failure	Credential Access	none	8
CyberArk Vault Object Content Validation Failure	Credential Access	none	8
CyberArk Vault Unauthorized User Stations	Credential Access	none	8
Identity Spoofing Exploit	Credential Access	T1557.002	7
Linux: Network Sniffing via Tcpdump	Credential Access	T1040	5
Linux: Searching for Passwords in Files	Credential Access	T1552.001	5
MS 365 Defender: LSASS Memory - Credential Access Alert	Credential Access	T1003.001	9
MS 365 Defender: OS Credential Dumping - Suspicious Activity Alert	Credential Access	T1003.007	9
Possible Consent Grant Attack via Azure-Registered Application	Credential Access	T1528	7
Replay Exploit	Credential Access	T1557.002	7
Session Hijacking Exploit	Credential Access	T1557.002	7
Windows: Active Directory Database Snapshot Via ADExplorer	Credential Access	T1552.001	5
Windows: Active Directory Replication from Non Machine Account	Credential Access	T1003.006	9
Windows: Automated Collection Command Prompt	Credential Access	T1552.001	5
Windows: Copying Sensitive Files with Credential Data	Credential Access	T1003.003	7
Windows: CreateDump Process Dump	Credential Access	T1003.001	7
Windows: Cred Dump Tools Dropped Files	Credential Access	T1003.005	7
Windows: Credential Dumping Tools Service Execution - Security	Execution	T1569.002	7
Windows: Credential Dumping Tools Service Execution - System	Execution	T1569.002	7
Windows: DPAPI Domain Backup Key Extraction	Credential Access	T1003.004	7
Windows: DPAPI Domain Master Key Backup Attempt	Credential Access	T1003.004	5
Windows: Dropping Of Password Filter DLL	Credential Access	T1556.002	5
Windows: DumpMinitool Execution	Credential Access	T1003.001	5
Windows: Dumping Process via Sqldumper.exe	Credential Access	T1003.001	5
Windows: Dumping of Sensitive Hives Via Reg.EXE	Credential Access	T1003.005	7
Windows: Enumeration for 3rd Party Creds From CLI	Credential Access	T1552.002	5
Windows: Enumeration for Credentials in Registry	Credential Access	T1552.002	5
Windows: Esentutl Gather Credentials	Credential Access	T1003.003	5
Windows: Esentutl Steals Browser Information	Collection	T1005	5
Windows: Esentutl Volume Shadow Copy Service Keys	Credential Access	T1003.002	7
Windows: Failed to execute Privileged Service LsaRegisterLogonProcess	Credential Access	T1558.003	7
Windows: Findstr GPP Passwords	Credential Access	T1552.006	7
Windows: Findstr LSASS	Credential Access	T1552.006	7
Windows: Generic Password Dumper Activity on LSASS	Credential Access	T1003.001	7
Windows: HackTool - CrackMapExec Process Patterns	Credential Access	T1003.001	7
Windows: HackTool - CreateMiniDump Execution	Credential Access	T1003.001	7
Windows: HackTool - Dumpert Process Dumper Default File	Credential Access	T1003.001	9
Windows: HackTool - Dumpert Process Dumper Execution	Credential Access	T1003.001	9
Windows: HackTool - HandleKatz LSASS Dumper Execution	Credential Access	T1003.001	7
Windows: HackTool - Inveigh Execution	Credential Access	T1003.001	9
Windows: HackTool - KrbRelay Execution	Credential Access	T1558.003	7
Windows: HackTool - KrbRelayUp Execution	Credential Access	T1558.003	7
Windows: HackTool - Mimikatz Execution	Credential Access	T1003.006	7
Windows: HackTool - Quarks PwDump Execution	Credential Access	T1003.002	7
Windows: HackTool - Rubeus Execution	Credential Access	T1558.003	9
Windows: HackTool - SafetyKatz Execution	Credential Access	T1003.001	9
Windows: HackTool - Windows Credential Editor WCE Execution	Credential Access	T1003.001	9
Windows: Harvesting Of Wifi Credentials Via Netsh.EXE	Credential Access	T1040	5
Windows: Hijack Legit RDP Session to Move Laterally	Credential Access	T1557.002	7
Windows: Hydra Password Guessing Hack Tool	Credential Access	T1110.001	7
Windows: Invocation of Active Directory Diagnostic Tool ntdsutil.exe	Credential Access	T1003.003	5
Windows: Kerberos Manipulation	Credential Access	T1212	7
Windows: LSASS Access from Non System Account	Credential Access	T1003.001	7
Windows: LSASS Access from White-Listed Processes	Credential Access	T1003.001	7
Windows: LSASS Memory Access by Tool Named Dump	Credential Access	T1003.001	7
Windows: LSASS Memory Dump	Credential Access	T1003.001	7
Windows: LSASS Process Dump Artefact In CrashDumps Folder	Credential Access	T1003.001	7
Windows: LSASS Process Memory Dump Files	Credential Access	T1003.001	7
Windows: Lsass Memory Dump via Comsvcs DLL	Credential Access	T1003.001	9
Windows: Microsoft IIS Service Account Password Dumped	Persistence	none	7
Windows: Mimikatz DC Sync	Credential Access	T1003.006	7
Windows: Mimikatz through Windows Remote Management	Execution	T1059.001	7
Windows: NTDS.DIT Created	Credential Access	T1003.003	3
Windows: NTDS.DIT Creation By Uncommon Parent Process	Credential Access	T1003.003	7
Windows: NTDS.DIT Creation By Uncommon Process	Credential Access	T1003.003	7
Windows: New Generic Credentials Added Via Cmdkey.EXE	Credential Access	T1003.005	5
Windows: New Network Trace Capture Started Via Netsh.EXE	Credential Access	T1040	5
Windows: PUA - DIT Snapshot Viewer	Credential Access	T1003.003	7
Windows: PUA - WebBrowserPassView Execution	Credential Access	T1555.003	5
Windows: Password Cracking with Hashcat	Credential Access	T1110.002	7
Windows: Password Dumper Activity on LSASS	Credential Access	T1003.001	7
Windows: Permission Misconfiguration Reconnaissance Via Findstr.EXE	Credential Access	T1552.006	5
Windows: PetitPotam Suspicious Kerberos TGT Request	Credential Access	T1187	7
Windows: Possible Impacket SecretDump Remote Activity	Credential Access	T1003.004	7
Windows: Possible PetitPotam Coerce Authentication Attempt	Credential Access	T1187	7
Windows: Potential Browser Data Stealing	Credential Access	T1555.003	5
Windows: Potential CVE-2021-42287 Exploitation Attempt	Credential Access	T1558.003	5
Windows: Potential Credential Dumping Via WER	Credential Access	T1003.001	7
Windows: Potential Credential Dumping Via WER - Application	Credential Access	T1003.001	7
Windows: Potential LSASS Process Dump Via Procdump	Credential Access	T1003.001	7
Windows: Potential Network Sniffing Activity Using Network Tools	Credential Access	T1040	5
Windows: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE	Credential Access	T1003.005	7
Windows: Potential SAM Database Dump	Credential Access	T1003.002	7
Windows: Potential SPN Enumeration Via Setspn.EXE	Credential Access	T1558.003	5
Windows: PowerShell Get-Process LSASS	Credential Access	T1552.004	7
Windows: PowerShell SAM Copy	Credential Access	T1003.002	7
Windows: Private Keys Reconnaissance Via CommandLine Tools	Credential Access	T1552.004	5
Windows: Procdump Evasion	Credential Access	T1003.001	7
Windows: Procdump Execution	Credential Access	T1003.001	5
Windows: Process Dumping Via Comsvcs.DLL	Credential Access	T1003.001	7
Windows: Process Memory Dump via RdrLeakDiag.EXE	Credential Access	T1003.001	7
Windows: QuarksPwDump Dump File	Credential Access	T1003.002	9
Windows: Register new Logon Process by Rubeus	Credential Access	T1558.003	9
Windows: Registry Parse with Pypykatz	Credential Access	T1003.002	7
Windows: Renamed BrowserCore.EXE Execution	Credential Access	T1528	7
Windows: Renamed CreateDump Utility Execution	Credential Access	T1003.001	7
Windows: SAM Registry Hive Handle Request	Credential Access	T1012,T1552.002	9
Windows: SQLite Chromium Profile Data DB Access	Credential Access	T1555.003	7
Windows: SQLite Firefox Profile Data DB Access	Credential Access	T1539	7
Windows: SafetyKatz Default Dump Filename	Credential Access	T1003.001	7
Windows: Sensitive Registry Access via Volume Shadow Copy	Impact	T1490	7
Windows: Shadow Copies Creation Using Operating Systems Utilities	Credential Access	T1003.003	5
Windows: SilentProcessExit Monitor Registration for LSASS	Credential Access	T1003.007	9
Windows: Suspicious Active Directory Database Snapshot Via ADExplorer	Credential Access	T1552.001	7
Windows: Suspicious Command With Teams Objects Paths	Credential Access	T1528	7
Windows: Suspicious Kerberos RC4 Ticket Encryption	Credential Access	T1558.003	5
Windows: Suspicious Key Manager Access	Credential Access	T1555.004	7
Windows: Suspicious LSASS Access Via MalSecLogon	Credential Access	T1003.001	7
Windows: Suspicious LSASS Process Clone	Credential Access	T1003.001	9
Windows: Suspicious NTDS Exfil Filename Patterns	Credential Access	T1003.003	7
Windows: Suspicious NTLM Authentication on the Printer Spooler Service	Credential Access	T1212	7
Windows: Suspicious Office Token Search Via CLI	Credential Access	T1528	5
Windows: Suspicious PFX File Creation	Credential Access	T1552.004	5
Windows: Suspicious Process Patterns NTDS.DIT Exfil	Credential Access	T1003.003	7
Windows: Suspicious Rejected SMB Guest Logon From IP	Credential Access	T1110.001	5
Windows: Suspicious Renamed Comsvcs DLL Loaded By Rundll32	Credential Access	T1003.001	7
Windows: Suspicious SYSVOL Domain Group Policy Access	Credential Access	T1552.006	5
Windows: Suspicious Teams Application Related ObjectAcess Event	Credential Access	T1528	7
Windows: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded	Credential Access	T1003.001	7
Windows: Suspicious Usage Of Active Directory Diagnostic Tool ntdsutil.exe	Credential Access	T1003.003	5
Windows: Time Travel Debugging Utility Usage: Sysmon V1	Credential Access	T1003.001	7
Windows: Time Travel Debugging Utility Usage: Sysmon V2	Credential Access	T1003.001	7
Windows: Transferring Files with Credential Data via Network Shares	Credential Access	T1003.001,T1003.002,T1003.003	5
Windows: Typical HiveNightmare SAM File Export	Credential Access	T1552.001	7
Windows: UIPromptForCredentials DLLs	Collection	T1056.002	5
Windows: Unsigned Image Loaded Into LSASS Process	Credential Access	T1003.001	5
Windows: Use of Adplus.exe	Credential Access	T1003.001	5
Windows: Use of PktMon.exe	Credential Access	T1040	5
Windows: VSSAudit Security Event Source Registration	Credential Access	T1003.002	1
Windows: VeeamBackup Database Credentials Dump	Collection	T1005	7
Windows: Volume Shadow Copy Mount	Credential Access	T1003.002	3
Windows: VolumeShadowCopy Symlink Creation Via Mklink	Credential Access	T1003.003	7
Windows: WerFault Accessing LSASS	Credential Access	T1003.001	7
Windows: WerFault LSASS Process Memory Dump	Credential Access	T1003.001	7
Windows: Windows Credential Editor Install Via Registry	Credential Access	T1003.001	9
Windows: Windows Credential Manager Access via VaultCmd	Credential Access	T1555.004	5
Windows: Windows Pcap Drivers	Credential Access	T1040	5
Windows: XORDump Use	Credential Access	T1003.001	7
Wireless MITM attack detected by Network IPS	Credential Access	T1557.002	9

Credential Theft

Name	Tactic	Technique	Severity
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7

Data Deletion

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Impact: Data Destruction Detected	Impact	none	7
Crowdstrike: Data Deletion	Impact	none	8
Website defacement attack	Impact	T1491.001,T1491.002	9
Windows: Deleted Data Overwritten Via Cipher.EXE	Impact	T1485	5
Windows: Deletion of Volume Shadow Copies via WMI with PowerShell	Impact	T1490	7
Windows: Potential File Overwrite Via Sysinternals SDelete	Impact	T1485	7
Windows: Shadow Copies Deletion Using Operating Systems Utilities	Impact	T1490	7

Data Exfiltration

Name	Tactic	Technique	Severity
Large Outbound Transfer To Outside My Country	Exfiltration	T1048.001	8
AWS SecHub: Tactics: Impact: Data Exfiltration Detected	Impact	none	8
AWS SecHub: Tactics: Impact: Data Exposure Detected	Impact	none	8
Crowdstrike: Data Theft	Impact	none	8
Large Outbound Transfer	Exfiltration	T1048.001	8
UEBA Policy detects cloud upload	UEBA	T1537	7
Windows Server USB File Write	Exfiltration	T1052.001	7
Windows: Compress Data and Lock With Password for Exfiltration With WINZIP	Collection	T1560.001	5
Windows: DNS Query for Anonfiles.com Domain - DNS Client	Exfiltration	T1567.002	7
Windows: DNS Query for Anonfiles.com Domain - Sysmon	Exfiltration	T1567.002	7
Windows: DNS Query for MEGA.io Upload Domain	Exfiltration	T1567.002	7
Windows: DNS Query for Ufile.io Upload Domain - DNS Client	Exfiltration	T1567.002	7
Windows: DNS Query for Ufile.io Upload Domain - Sysmon	Exfiltration	T1567.002	7
Windows: PUA - Rclone Execution	Exfiltration	T1567.002	7
Windows: Potential Data Exfiltration Activity Via CommandLine Tools	Execution	T1059.001	7
Windows: Suspicious Outbound SMTP Connections	Exfiltration	T1048.003	5
Windows: Suspicious Schtasks Execution AppData Folder	Execution	T1059.001	7
Windows: Suspicious WebDav Client Execution	Exfiltration	T1048.003	7
Windows: Suspicious WebDav Client Execution: Sysmon V2	Exfiltration	T1048.003	5

Defense Evasion

Name	Tactic	Technique	Severity
Windows Process Tampering Detected	Defense Evasion	T1055.009	9
AWS EC2 User Data Download	Defense Evasion	T1562.001	6
AWS SecHub: Tactics: Defense Evasion Detected	Defense Evasion	none	8
Crowdstrike: Evade Detection	Defense Evasion	none	8
Crowdstrike: Social Engineering	Defense Evasion	none	7
IPS/AV Evasion attempts	Defense Evasion	T1211	7
Linux: Base16/32/64 Encoding/Decoding Activity	Defense Evasion	T1140	7
Linux: Deobfuscate/Decode Files or Information via hexdump	Command And Control	T1132.001	7
Linux: File Deletion via Shred	Defense Evasion	T1070.004	9
Linux: File Permission Modification in Writable Absolute Directory By non-root user	Defense Evasion	T1222.002	7
Linux: File Permission Modification in Writable Relative Directory By non-root user	Defense Evasion	T1222.002	7
Linux: Hidden Files and Directories Created	Defense Evasion	T1564.001	7
Linux: Kernel Module Removed	Defense Evasion	T1562.001	7
Linux: Processes with Trailing Spaces	Defense Evasion	T1036.006	7
Linux: Timestomping using Touch Command	Defense Evasion	T1070.006	5
Linux: Unusual Process Execution from Temp	Defense Evasion	T1202	7
MS 365 Defender: Masquerading - Execution Alert	Defense Evasion	T1036.004	9
MS 365 Defender: Process Injection - Defense Evasion Alert	Defense Evasion	T1055.001	9
Modification of ld.so.preload	Defense Evasion	T1055.009	5
Multiple Windows Accounts Disabled by Administrator	Defense Evasion	none	9
Windows Process with deleted binaries	Defense Evasion	T1070.004	8
Windows: AD Object WriteDAC Access	Defense Evasion	T1222.001	9
Windows: Abuse of Service Permissions to Hide Services Via Set-Service	Defense Evasion	T1574.011	7
Windows: Add SafeBoot Keys Via Reg Utility	Defense Evasion	T1562.001	7
Windows: Always Install Elevated MSI Spawned Cmd And Powershell	Defense Evasion	T1548.002	5
Windows: Always Install Elevated Windows Installer	Defense Evasion	T1548.002	5
Windows: Application Whitelisting Bypass via Bginfo	Defense Evasion	T1202	5
Windows: Application Whitelisting Bypass via Dnx.exe	Defense Evasion	T1027.004	5
Windows: Aruba Network Service Potential DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Audit Policy Tampering Via Auditpol	Defense Evasion	T1562.002	7
Windows: Audit Policy Tampering Via NT Resource Kit Auditpol	Defense Evasion	T1562.002	7
Windows: BITS Transfer Job Download From Direct IP	Defense Evasion	T1197	7
Windows: BITS Transfer Job Download From File Sharing Domains	Defense Evasion	T1197	7
Windows: BITS Transfer Job Download To Potential Suspicious Folder	Defense Evasion	T1197	7
Windows: BITS Transfer Job Downloading File Potential Suspicious Extension	Defense Evasion	T1197	5
Windows: Bad Opsec Defaults Sacrificial Processes With Improper Arguments	Defense Evasion	T1218.011	7
Windows: Bypass UAC via CMSTP	Defense Evasion	T1548.002	7
Windows: Bypass UAC via WSReset.exe	Defense Evasion	T1548.002	7
Windows: CMSTP Execution Process Creation	Defense Evasion	T1218.003	7
Windows: CMSTP Execution Registry Event	Defense Evasion	T1218.003	7
Windows: CMSTP UAC Bypass via COM Object Access	Defense Evasion	T1548.002	7
Windows: CleanWipe Usage	Defense Evasion	T1562.001	5
Windows: Code Execution via Pcwutl.dll	Defense Evasion	T1218.011	5
Windows: Conhost Parent Process Executions	Defense Evasion	T1202	5
Windows: Control Panel Items	Defense Evasion	T1218.002	7
Windows: Creation Of Non-Existent System DLL	Defense Evasion	T1574.002	5
Windows: Creation of an WerFault.exe in Unusual Folder	Defense Evasion	T1574.001	7
Windows: DHCP Server Error Failed Loading the CallOut DLL	Defense Evasion	T1574.002	7
Windows: DHCP Server Loaded the CallOut DLL	Defense Evasion	T1574.002	9
Windows: DLL Loaded From Suspicious Location Via Cmspt.EXE	Defense Evasion	T1218.003	7
Windows: DLL Search Order Hijackig Via Additional Space in Path	Defense Evasion	T1574.002	7
Windows: DLL Sideloading Of ShellChromeAPI.DLL	Defense Evasion	T1574.002	7
Windows: DLL Sideloading by Microsoft Defender	Defense Evasion	T1574.002	7
Windows: DLL Sideloading by VMware Xfer Utility	Defense Evasion	T1574.002	7
Windows: Detect Virtualbox Driver Installation OR Starting Of VMs	Defense Evasion	T1564.006	3
Windows: Directory Removal Via Rmdir	Defense Evasion	T1070.004	3
Windows: Disabled Volume Snapshots	Defense Evasion	T1562.001	7
Windows: Dism Remove Online Package	Defense Evasion	T1562.001	5
Windows: DllUnregisterServer Function Call Via Msiexec.EXE	Defense Evasion	T1218.007	5
Windows: Dynamic C Sharp Compile Artefact	Defense Evasion	T1027.004	3
Windows: Empire PowerShell UAC Bypass	Defense Evasion	T1548.002	9
Windows: Execute Arbitrary Commands Using MSDT.EXE: V1	Defense Evasion	T1202	7
Windows: Execute From Alternate Data Streams	Defense Evasion	T1564.004	5
Windows: Explorer NOUACCHECK Flag	Defense Evasion	T1548.002	7
Windows: F-Secure C3 Load by Rundll32	Defense Evasion	T1218.011	9
Windows: Fax Service DLL Search Order Hijack	Defense Evasion	T1574.002	7
Windows: File Deletion Via Del	Defense Evasion	T1070.004	3
Windows: File Download Via Bitsadmin	Defense Evasion	T1197	5
Windows: File Download Via Bitsadmin To A Suspicious Target Folder	Defense Evasion	T1197	7
Windows: File With Suspicious Extension Downloaded Via Bitsadmin	Defense Evasion	T1197	7
Windows: Files With System Process Name In Unsuspected Locations	Defense Evasion	T1036.005	7
Windows: Filter Driver Unloaded Via Fltmc.EXE	Defense Evasion	T1562.002	7
Windows: Findstr Launching .lnk File	Defense Evasion	T1202	5
Windows: FromBase64String Command Line	Defense Evasion	T1140	7
Windows: Greedy File Deletion Using Del	Defense Evasion	T1070.004	5
Windows: HH.EXE Execution	Defense Evasion	T1218.001	5
Windows: Hiding Files with Attrib.exe	Defense Evasion	T1564.001	5
Windows: High Integrity Sdclt Process	Defense Evasion	T1548.002	5
Windows: Imports Registry Key From a File	Defense Evasion	T1112	5
Windows: Imports Registry Key From an ADS	Defense Evasion	T1112	7
Windows: Invoke-Obfuscation CLIP Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: Security Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: Sysmon	Execution	T1059.001	5
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: System Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: Security Log	Persistence	none	7
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: System Log	Persistence	none	7
Windows: Invoke-Obfuscation RUNDLL LAUNCHER: System Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation STDIN Launcher: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation STDIN Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation STDIN Launcher: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR LAUNCHER OBFUSCATION: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR Launcher: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Rundll32: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Rundll32: System Log	Execution	T1059.001	7
Windows: LOLBIN Execution Of The FTP.EXE Binary	Defense Evasion	T1202	5
Windows: Launch-VsDevShell.PS1 Proxy Execution	Defense Evasion	T1216.001	5
Windows: Load Undocumented Autoelevated COM Interface	Defense Evasion	T1548.002	7
Windows: Lolbin Ssh.exe Use As Proxy	Defense Evasion	T1202	5
Windows: MSDT.exe Loading Diagnostic Library	Defense Evasion	T1202	7
Windows: MSHTA Suspicious Execution 01	Defense Evasion	T1218.005	7
Windows: MSI Installation From Web	Defense Evasion	T1218.007	5
Windows: Malicious DLL File Dropped in the Teams or OneDrive Folder	Defense Evasion	T1574.002	7
Windows: Mavinject Inject DLL Into Running Process	Defense Evasion	T1055.001	7
Windows: Microsoft Defender Loading DLL from Nondefault Path	Defense Evasion	T1574.002	7
Windows: Microsoft Office DLL Sideload	Defense Evasion	T1574.002	7
Windows: Modify Group Policy Settings	Defense Evasion	T1484.001	5
Windows: Monitoring For Persistence Via BITS	Defense Evasion	T1197	5
Windows: MsiExec Web Install	Defense Evasion	T1218.007	5
Windows: Msiexec Quiet Installation	Defense Evasion	T1218.007	5
Windows: NTLMv1 Logon Between Client and Server	Defense Evasion	T1550.002	3
Windows: NetNTLM Downgrade Attack	Defense Evasion	T1562.001	7
Windows: NetNTLM Downgrade Attack - Registry	Defense Evasion	T1562.001	7
Windows: Netsh Allow Group Policy on Microsoft Defender Firewall	Defense Evasion	T1562.004	5
Windows: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE	Defense Evasion	T1574.002	7
Windows: New Root Certificate Installed Via CertMgr.EXE	Defense Evasion	T1553.004	5
Windows: New Root Certificate Installed Via Certutil.EXE	Defense Evasion	T1553.004	5
Windows: Non-privileged Usage of Reg or Powershell	Defense Evasion	T1112	7
Windows: Obfuscated IP Download	Persistence	none	5
Windows: Obfuscated IP Via CLI	Persistence	none	5
Windows: Outbound Network Connection To Public IP Via Winlogon	Defense Evasion	T1218.011	5
Windows: Outlook EnableUnsafeClientMailRules Setting Enabled	Defense Evasion	T1202	7
Windows: PUA - DefenderCheck Execution	Defense Evasion	T1027.005	7
Windows: PUA - Potential PE Metadata Tamper Using Rcedit	Defense Evasion	T1036.003	5
Windows: Ping Hex IP	Defense Evasion	T1140	7
Windows: Possible DC Shadow Attack	Defense Evasion	T1207	5
Windows: Possible Privilege Escalation via Weak Service Permissions	Defense Evasion	T1574.011	7
Windows: Potential AMSI Bypass Using NULL Bits	Defense Evasion	T1562.001	5
Windows: Potential AMSI Bypass Via .NET Reflection	Defense Evasion	T1562.001	7
Windows: Potential Access Token Abuse	Defense Evasion	T1134.001	5
Windows: Potential Antivirus Software DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Arbitrary DLL Load Using Winword	Defense Evasion	T1202	5
Windows: Potential Arbitrary File Download Using Office Application	Defense Evasion	T1202	5
Windows: Potential Azure Browser SSO Abuse	Defense Evasion	T1574.002	3
Windows: Potential Chrome Frame Helper DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential DLL Injection Or Execution Using Tracker.exe	Defense Evasion	T1055.001	5
Windows: Potential DLL Sideloading Of DBGCORE.DLL	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of DBGHELP.DLL	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of Non-Existent DLLs From System Folders	Defense Evasion	T1574.002	7
Windows: Potential DLL Sideloading Via ClassicExplorer32.dll	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via DeviceEnroller.EXE	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via JsSchHlp	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via VMware Xfer	Defense Evasion	T1574.002	7
Windows: Potential DLL Sideloading Via comctl32.dll	Defense Evasion	T1574.002	7
Windows: Potential Defense Evasion Via Binary Rename	Defense Evasion	T1036.003	5
Windows: Potential Defense Evasion Via Rename Of Highly Relevant Binaries	Defense Evasion	T1036.003	7
Windows: Potential Defense Evasion Via Right-to-Left Override	Defense Evasion	T1036.002	7
Windows: Potential Dosfuscation Activity	Persistence	none	5
Windows: Potential Goopdate.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Homoglyph Attack Using Lookalike Characters	Defense Evasion	T1036.003	5
Windows: Potential Homoglyph Attack Using Lookalike Characters in Filename	Defense Evasion	T1036.003	5
Windows: Potential Initial Access via DLL Search Order Hijacking	Defense Evasion	T1574.001	5
Windows: Potential Iviewers.DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Potential LethalHTA Technique Execution	Defense Evasion	T1218.005	7
Windows: Potential Libvlc.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential MsiExec Masquerading	Defense Evasion	T1036.005	7
Windows: Potential Persistence Attempt Via Existing Service Tampering	Defense Evasion	T1574.011	5
Windows: Potential PowerShell Command Line Obfuscation	Execution	T1059.001	7
Windows: Potential PowerShell Execution Via DLL	Defense Evasion	T1218.011	7
Windows: Potential PowerShell Obfuscation Via Reversed Commands	Execution	T1059.001	7
Windows: Potential Privilege Escalation via Service Permissions Weakness	Defense Evasion	T1574.011	7
Windows: Potential Privileged System Service Operation - SeLoadDriverPrivilege	Defense Evasion	T1562.001	5
Windows: Potential Qakbot Registry Activity	Defense Evasion	T1112	7
Windows: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE	Defense Evasion	T1542.003	5
Windows: Potential Rcdll.DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Potential RoboForm.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Rundll32 Execution With DLL Stored In ADS	Defense Evasion	T1564.004	7
Windows: Potential SolidPDFCreator.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential SquiblyTwo Technique Execution	Defense Evasion	T1220	5
Windows: Potential Suspicious Activity Using SeCEdit	Defense Evasion	T1574.007	5
Windows: Potential Suspicious Registry File Imported Via Reg.EXE	Defense Evasion	T1112	5
Windows: Potential Svchost Memory Access	Defense Evasion	T1562.002	7
Windows: Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Defense Evasion	T1112	7
Windows: Potential Tampering With Security Products Via WMIC	Defense Evasion	T1562.001	7
Windows: Potential Wazuh Security Platform DLL Sideloading	Defense Evasion	T1574.002	5
Windows: PowerShell Base64 Encoded FromBase64String Cmdlet	Defense Evasion	T1140	7
Windows: PowerShell Encoded Character Syntax	Defense Evasion	T1027.003,T1132.001	7
Windows: Powershell Base64 Encoded MpPreference Cmdlet	Defense Evasion	T1562.001	7
Windows: Powershell Defender Exclusion	Defense Evasion	T1562.001	5
Windows: Powershell Token Obfuscation - Process Creation	Persistence	none	7
Windows: Powerup Write Hijack DLL	Defense Evasion	T1574.001	7
Windows: PrintBrm ZIP Creation of Extraction	Defense Evasion	T1564.004	7
Windows: Process Access via TrolleyExpress Exclusion	Defense Evasion	T1218.011	7
Windows: Pubprn.vbs Proxy Execution	Defense Evasion	T1216.001	5
Windows: Python Py2Exe Image Load	Defense Evasion	T1027.002	5
Windows: RDP Connection Allowed Via Netsh.EXE	Defense Evasion	T1562.004	7
Windows: RedMimicry Winnti Playbook Registry Manipulation	Defense Evasion	T1112	7
Windows: Reg Add Suspicious Paths	Defense Evasion	T1562.001	7
Windows: Regasm/Regsvcs Suspicious Execution	Defense Evasion	T1218.009	7
Windows: Registry Modification Via Regini.EXE	Defense Evasion	T1112	3
Windows: Regsvr32 Flags Anomaly	Defense Evasion	T1218.010	7
Windows: Remote CHM File Download/Execution Via HH.EXE	Defense Evasion	T1218.001	7
Windows: Remotely Hosted HTA File Executed Via Mshta.EXE	Defense Evasion	T1218.005	7
Windows: Renamed FTP.EXE Execution	Defense Evasion	T1202	5
Windows: Renamed Jusched.EXE Execution	Defense Evasion	T1036.003	7
Windows: Renamed Mavinject.EXE Execution	Defense Evasion	T1055.001	7
Windows: Renamed Msdt.EXE Execution	Defense Evasion	T1036.003	7
Windows: Renamed ProcDump Execution	Defense Evasion	T1036.003	7
Windows: Renamed Vmnat.exe Execution	Defense Evasion	T1574.002	7
Windows: Renamed ZOHO Dctask64 Execution	Defense Evasion	T1202	7
Windows: Root Certificate Installed From Susp Locations	Defense Evasion	T1553.004	7
Windows: Run Once Task Configuration in Registry	Defense Evasion	T1112	5
Windows: Run Once Task Execution as Configured in Registry	Defense Evasion	T1112	3
Windows: Run PowerShell Script from ADS	Defense Evasion	T1564.004	7
Windows: RunDLL32 Spawning Explorer	Defense Evasion	T1218.011	7
Windows: Rundll32 InstallScreenSaver Execution	Defense Evasion	T1218.011	5
Windows: Rundll32 Internet Connection	Defense Evasion	T1218.011	5
Windows: Rundll32 UNC Path Execution	Defense Evasion	T1218.011	7
Windows: SCR File Write Event	Defense Evasion	T1218.011	5
Windows: SafeBoot Registry Key Deleted Via Reg.EXE	Defense Evasion	T1562.001	7
Windows: Sdclt Child Processes	Defense Evasion	T1548.002	5
Windows: Secure Deletion with SDelete	Defense Evasion	T1070.004,T1027.005	5
Windows: Service DACL Abuse To Hide Services Via Sc.EXE	Defense Evasion	T1574.011	7
Windows: Service ImagePath Change with Reg.exe	Defense Evasion	T1574.011	5
Windows: Service Registry Key Deleted Via Reg.EXE	Defense Evasion	T1562.001	7
Windows: Service Security Descriptor Tampering Via Sc.EXE	Defense Evasion	T1574.011	5
Windows: Service StartupType Change Via PowerShell Set-Service	Defense Evasion	T1562.001	5
Windows: Service StartupType Change Via Sc.EXE	Defense Evasion	T1562.001	5
Windows: Set Suspicious Files as System Files Using Attrib.EXE	Defense Evasion	T1564.001	7
Windows: Shell Open Registry Keys Manipulation	Defense Evasion	T1548.002	7
Windows: Shell32 DLL Execution in Suspicious Directory	Defense Evasion	T1218.011	7
Windows: ShimCache Flush	Defense Evasion	T1112	7
Windows: Silenttrinity Stager Msbuild Activity	Defense Evasion	T1127.001	7
Windows: Start of NT Virtual DOS Machine	Persistence	none	5
Windows: Suspicious Cabinet File Execution Via Msdt.EXE	Defense Evasion	T1202	5
Windows: Suspicious Child Process Created as System	Defense Evasion	T1134.002	7
Windows: Suspicious Commandline Escape	Defense Evasion	T1140	3
Windows: Suspicious Control Panel DLL Load	Defense Evasion	T1218.011	7
Windows: Suspicious Copy From or To System32	Defense Evasion	T1036.003	5
Windows: Suspicious Diantz Alternate Data Stream Execution	Defense Evasion	T1564.004	5
Windows: Suspicious Download From Direct IP Via Bitsadmin	Defense Evasion	T1197	7
Windows: Suspicious Download From File-Sharing Website Via Bitsadmin	Defense Evasion	T1197	7
Windows: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call	Execution	T1059.001	7
Windows: Suspicious Extrac32 Alternate Data Stream Execution	Defense Evasion	T1564.004	5
Windows: Suspicious Files in Default GPO Folder	Defense Evasion	T1036.005	5
Windows: Suspicious GUP Usage	Defense Evasion	T1574.002	7
Windows: Suspicious High IntegrityLevel Conhost Legacy Option	Defense Evasion	T1202	1
Windows: Suspicious JavaScript Execution Via Mshta.EXE	Defense Evasion	T1218.005	7
Windows: Suspicious MSHTA Child Process	Defense Evasion	T1218.005	7
Windows: Suspicious Microsoft Office Child Process	Defense Evasion	T1218.010	7
Windows: Suspicious MsiExec Embedding Parent	Defense Evasion	T1218.007	5
Windows: Suspicious Msiexec Execute Arbitrary DLL	Defense Evasion	T1218.007	5
Windows: Suspicious Msiexec Quiet Install From Remote Location	Defense Evasion	T1218.007	5
Windows: Suspicious Obfuscated PowerShell Code	Persistence	none	7
Windows: Suspicious Outbound Kerberos Connection	Defense Evasion	T1550.003	7
Windows: Suspicious PROCEXP152.sys File Created In TMP	Defense Evasion	T1562.001	5
Windows: Suspicious Parent of Csc.exe	Defense Evasion	T1218.005	7
Windows: Suspicious Ping/Del Command Combination	Defense Evasion	T1070.004	7
Windows: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE	Defense Evasion	T1562.004	7
Windows: Suspicious Recursif Takeown	Defense Evasion	T1222.001	5
Windows: Suspicious Registry Modification From ADS Via Regini.EXE	Defense Evasion	T1112	7
Windows: Suspicious Regsvr32 Execution From Remote Share	Defense Evasion	T1218.010	7
Windows: Suspicious Regsvr32 Execution With Image Extension	Defense Evasion	T1218.010	7
Windows: Suspicious Remote Child Process From Outlook	Defense Evasion	T1202	7
Windows: Suspicious Rundll32 Activity	Defense Evasion	T1218.011	5
Windows: Suspicious Rundll32 Activity Invoking Sys File	Defense Evasion	T1218.011	7
Windows: Suspicious Rundll32 Execution With Image Extension	Defense Evasion	T1218.011	7
Windows: Suspicious Rundll32 Setupapi.dll Activity	Defense Evasion	T1218.011	5
Windows: Suspicious Rundll32 Without Any CommandLine Params	Defense Evasion	T1202	7
Windows: Suspicious Runscripthelper.exe	Defense Evasion	T1202	5
Windows: Suspicious Svchost Process	Defense Evasion	T1036.005	7
Windows: Suspicious Task Added by Bitsadmin	Defense Evasion	T1197	3
Windows: Suspicious Task Added by Powershell	Defense Evasion	T1197	3
Windows: Suspicious VBoxDrvInst.exe Parameters	Defense Evasion	T1112	5
Windows: Suspicious WMIC Execution Via Office Process	Defense Evasion	T1218.010	7
Windows: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE	Defense Evasion	T1562.001	5
Windows: Suspicious Windows Trace ETW Session Tamper Via Logman.EXE	Defense Evasion	T1562.001	7
Windows: Suspicious WmiPrvSE Child Process	Defense Evasion	T1218.010	7
Windows: Suspicious XOR Encoded PowerShell Command	Defense Evasion	T1140	5
Windows: Suspicious ZipExec Execution	Defense Evasion	T1202	5
Windows: Sysinternals PsSuspend Suspicious Execution	Defense Evasion	T1562.001	7
Windows: Sysmon Configuration Update	Defense Evasion	T1562.001	5
Windows: Sysmon Driver Unloaded Via Fltmc.EXE	Defense Evasion	T1562.002	7
Windows: SysmonEnte Usage	Defense Evasion	T1562.002	7
Windows: Tamper Windows Defender Remove-MpPreference	Defense Evasion	T1562.001	7
Windows: Taskkill Symantec Endpoint Protection	Defense Evasion	T1562.001	7
Windows: Tasks Folder Evasion	Defense Evasion	T1574.002	7
Windows: Third Party Software DLL Sideloading	Defense Evasion	T1574.002	5
Windows: TrustedPath UAC Bypass Pattern	Defense Evasion	T1548.002	9
Windows: UAC Bypass Abusing Winsat Path Parsing - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Tool UACMe Akagi	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using .NET Code Profiler on MMC	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using ChangePK and SLUI	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using ComputerDefaults	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Consent and Comctl32 - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Consent and Comctl32 - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Disk Cleanup	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using DismHost	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IDiagnostic Profile	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IDiagnostic Profile - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IEInstal - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IEInstal - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Iscsicpl - ImageLoad	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using MSConfig Token Modification - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using MSConfig Token Modification - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using NTFS Reparse Point - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using NTFS Reparse Point - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using PkgMgr and DISM	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using WOW64 Logger DLL Hijack	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Windows Media Player - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Via Wsreset	Defense Evasion	T1548.002	7
Windows: UAC Bypass WSReset	Defense Evasion	T1548.002	7
Windows: UAC Bypass With Fake DLL	Defense Evasion	T1574.002	7
Windows: UAC Bypass via Event Viewer	Defense Evasion	T1548.002	7
Windows: UAC Bypass via ICMLuaUtil	Defense Evasion	T1548.002	7
Windows: UEFI Persistence Via Wpbbin - FileCreation	Defense Evasion	T1542.001	7
Windows: UEFI Persistence Via Wpbbin - ProcessCreation	Defense Evasion	T1542.001	7
Windows: Unauthorized System Time Modification	Defense Evasion	T1070.006	3
Windows: Uninstall Crowdstrike Falcon	Defense Evasion	T1562.001	5
Windows: Uninstall Sysinternals Sysmon	Defense Evasion	T1562.001	7
Windows: Unmount Share Via Net.EXE	Defense Evasion	T1070.005	3
Windows: Unsigned Binary Loaded From Suspicious Location	Defense Evasion	T1574.002	7
Windows: Use Icacls to Hide File to Everyone	Defense Evasion	T1564.001	5
Windows: Use NTFS Short Name in Command Line	Defense Evasion	T1564.004	5
Windows: Use NTFS Short Name in Image	Defense Evasion	T1564.004	7
Windows: Use Short Name Path in Command Line	Defense Evasion	T1564.004	5
Windows: Use Short Name Path in Image	Defense Evasion	T1564.004	5
Windows: Using SettingSyncHost.exe as LOLBin	Defense Evasion	T1574.008	7
Windows: VMGuestLib DLL Sideload	Defense Evasion	T1574.002	5
Windows: Visual Basic Command Line Compiler Usage	Defense Evasion	T1027.004	7
Windows: VsCode Child Process Anomaly	Defense Evasion	T1202	5
Windows: WMIC Loading Scripting Libraries	Defense Evasion	T1220	7
Windows: WSL Child Process Anomaly	Defense Evasion	T1202	5
Windows: Wdigest CredGuard Registry Modification	Defense Evasion	T1112	7
Windows: WinDivert Driver Load	Defense Evasion	T1599.001	7
Windows: Windows Binary Executed From WSL	Defense Evasion	T1202	5
Windows: Windows Defender Definition Files Removed	Defense Evasion	T1562.001	5
Windows: Windows Defender Download Activity	Defense Evasion	T1218.010	7
Windows: Windows Defender Exclusion Set	Defense Evasion	T1562.001	7
Windows: Windows Processes Suspicious Parent Directory	Defense Evasion	T1036.005	3
Windows: Writing Of Malicious Files To The Fonts Folder	Defense Evasion	T1211	5
Windows: XSL Script Processing	Defense Evasion	T1220	5

Denial Of Service

Name	Tactic	Technique	Severity
Half Open TCP DDOS Attack	Impact	T1498.001	7
TCP DDOS Attack	Impact	T1498.001	8
AWS SecHub: Tactics: Impact: Denial of Service Detected	Impact	T1498.001	8
Distributed DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack on Network Devices by Network IPS	Impact	T1498.001	9
DoS Attack on WLAN Infrastructure by Network IPS	Impact	T1498.001	9

Environmental Performance Issue

Name	Tactic	Technique	Severity
Critical APC Trap	Environmental	none	9
Critical APC Trap: can be auto cleared	Environmental	none	9
FPC Current THD high	Environmental	none	9
FPC Voltage THD high	Environmental	none	9
FPC ground current high	Environmental	none	9
HVAC humidity high	HVAC	none	9
HVAC humidity low	HVAC	none	9
HVAC temp high	HVAC	none	9
HVAC temp low	HVAC	none	9
NetBotz camera motion detected	Environmental	none	7
NetBotz module door open	Environmental	none	7
UPS Battery Metrics Critical	UPS	none	9
UPS Battery Status Critical	UPS	none	9
Warning APC Trap	Environmental	none	7
Warning APC Trap: can be auto cleared	Environmental	none	7

FortiSIEM Cluster Health

Name	Tactic	Technique	Severity
FortiSIEM DB Leader Changed	FortiSIEM	none	7
FortiSIEM Replication Leader Changed	FortiSIEM	none	7

FortiSIEM Operational Issue

Name	Tactic	Technique	Severity
ClickHouse Log Integrity System Errors Detected	FortiSIEM	none	9
ClickHouse Log Integrity Violation Detected	FortiSIEM	none	7
Discovered Device Incorrectly Merged: Overlapping IP	FortiSIEM	none	5
Elasticsearch Disaster Recovery: Restore Failed	FortiSIEM	none	9
Elasticsearch Disaster Recovery: Snapshot Failed	FortiSIEM	none	9
EventDB: Event Retention Policy Error	FortiSIEM	none	9
EventDB: Event Retention Policy Violation	FortiSIEM	none	9
EventDB: Excessive Data Retention Policy Execution Time	FortiSIEM	none	8
External Event Dropped By License	FortiSIEM	none	7
FortiSIEM Agent Operational Error	FortiSIEM	none	7
FortiSIEM Archive Purging Completed	FortiSIEM	none	4
FortiSIEM Archive Purging Failed	FortiSIEM	none	9
FortiSIEM Archive Purging Started	FortiSIEM	none	10
FortiSIEM CMDB Disk space low - prune failed to keep free disk space above high threshold	FortiSIEM	none	9
FortiSIEM CMDB Disk space low - prune successful	FortiSIEM	none	4
FortiSIEM ClickHouse Storage Space Critical	FortiSIEM	none	9
FortiSIEM ClickHouse Storage Space Low	FortiSIEM	none	6
FortiSIEM EPS License Exceeded	FortiSIEM	none	9
FortiSIEM Event Archiving Completed	FortiSIEM	none	4
FortiSIEM Event Archiving Failed	FortiSIEM	none	9
FortiSIEM EventDB event store failed	FortiSIEM	none	10
FortiSIEM Online Event Successfully Purged	FortiSIEM	none	4
FortiSIEM Performance Monitoring Relay Not Working: All Devices delayed	FortiSIEM	none	9
FortiSIEM Report Server Removed After License Expiry	FortiSIEM	none	10
FortiSIEM: Low Available Archive Space	FortiSIEM	none	5
FortiSIEM: Low Available EventDB Storage	FortiSIEM	none	4
FortiSIEM: Too Many Unknown Events	FortiSIEM	none	9
Inbound Incident Integration Error	FortiSIEM	none	7
Incident Notification Error	FortiSIEM	none	9
Large Supervisor JMS Request Queue	FortiSIEM	none	9
Large Supervisor JMS System Queue	FortiSIEM	none	9
Large Worker Input Event Queue	FortiSIEM	none	9
Large Worker Input SVN Queue	FortiSIEM	none	9
Missing specific performance metric from a device	FortiSIEM	none	5
No Events Reported From External Apps In Last Hour	FortiSIEM	none	10
No Events Reported From External Devices In Last Hour	FortiSIEM	none	10
No logs from a device	FortiSIEM	none	6
No logs from any device via Collector/Worker	FortiSIEM	none	9
No performance metrics from a device	FortiSIEM	none	5
Outbound Incident Integration Error	FortiSIEM	none	9
Performance Monitoring Error	FortiSIEM	none	5
Performance monitoring jobs deleted by discovery	FortiSIEM	none	5
Performance monitoring jobs not picked up for execution	FortiSIEM	none	5
Scheduled Report Send Error	FortiSIEM	none	9
System Collector Event Delayed	FortiSIEM	none	6

Generic 3rd party Alerts

Name	Tactic	Technique	Severity
AlertLogic Incident	Execution	none	7
Armis Alert Detected	Behavioral Anomaly	none	9
Cortex XDR Alert Detected	Behavioral Anomaly	none	9
Cortex XDR Alert Prevented	Behavioral Anomaly	none	7
Cylance Waived Threat	Execution	none	3
FortiNDR Cloud: High Severity Detection triggered for a Host	Privilege Escalation	T1068	9
FortiNDR Cloud: Low Severity Detection triggered for a Host	Privilege Escalation	T1068	4
FortiNDR Cloud: Moderate Severity Detection triggered for a Host	Privilege Escalation	T1068	7
MS 365 Defender: Delivery Detected	Impact	none	8
MS 365 Defender: Exploit Detected	Execution	none	9
MS 365 Defender: Generic Alert	PH_RULE_SECURITY_Suspicious_Activity	none	7
MS 365 Defender: Incident Triggered	Suspicious Activity	none	7
Microsoft ATA Center: Security Alert Triggered	Behavioral Anomaly	none	6
UserGate UTM IDPS Alert Detected	Behavioral Anomaly	none	8

Hacking Tool Usage

Name	Tactic	Technique	Severity
UEBA Policy detects hacking tool and footprints	UEBA	none	7
UEBA Policy detects hacking tool usage	UEBA	none	7
Windows: HackTool - ADCSPwn Execution	Collection	T1557.001	7
Windows: HackTool - Certify Execution	Persistence	none	7
Windows: HackTool - Certipy Execution	Persistence	none	7
Windows: HackTool - Covenant PowerShell Launcher	Defense Evasion	T1564.003	7
Windows: HackTool - CrackMapExec Execution	Persistence	none	7
Windows: HackTool - CrackMapExec Execution Patterns	Execution	T1059.003	7
Windows: HackTool - CrackMapExec PowerShell Obfuscation	Execution	T1059.001	7
Windows: HackTool - DInjector PowerShell Cradle Execution	Persistence	none	9
Windows: HackTool - Default PowerSploit/Empire Scheduled Task Creation	Execution	T1059.001	7
Windows: HackTool - Empire PowerShell Launch Parameters	Execution	T1059.001	7
Windows: HackTool - GMER Rootkit Detector and Remover Execution	Persistence	none	7
Windows: HackTool - Htran/NATBypass Execution	Persistence	none	7
Windows: HackTool - Impersonate Execution	Defense Evasion	T1134.003	5
Windows: HackTool - Koadic Execution	Execution	T1059.007	7
Windows: HackTool - LocalPotato Execution	Persistence	none	7
Windows: HackTool - PCHunter Execution	Persistence	none	7
Windows: HackTool - PPID Spoofing SelectMyParent Tool Execution	Defense Evasion	T1134.004	7
Windows: HackTool - PowerTool Execution	Defense Evasion	T1562.001	7
Windows: HackTool - PurpleSharp Execution	Persistence	none	9
Windows: HackTool - RedMimicry Winnti Playbook Execution	Defense Evasion	T1218.011	7
Windows: HackTool - SILENTTRINITY Stager DLL Load	Persistence	none	7
Windows: HackTool - SILENTTRINITY Stager Execution	Persistence	none	7
Windows: HackTool - SecurityXploded Execution	Persistence	none	9
Windows: HackTool - SharPersist Execution	Persistence	none	7
Windows: HackTool - SharpChisel Execution	Command And Control	T1090.001	7
Windows: HackTool - SharpEvtMute DLL Load	Defense Evasion	T1562.002	7
Windows: HackTool - SharpEvtMute Execution	Defense Evasion	T1562.002	7
Windows: HackTool - SharpImpersonation Execution	Defense Evasion	T1134.003	7
Windows: HackTool - SharpLDAPmonitor Execution	Persistence	none	5
Windows: HackTool - SharpUp PrivEsc Tool Execution	Defense Evasion	T1574.005	9
Windows: HackTool - Sliver C2 Implant Activity Pattern	Persistence	none	9
Windows: HackTool - Stracciatella Execution	Defense Evasion	T1562.001	7
Windows: HackTool - SysmonEOP Execution	Privilege Escalation	T1068	9
Windows: HackTool - Wmiexec Default Powershell Command	Persistence	none	7
Windows: Hacktool Ruler	Defense Evasion	T1550.002	7
Windows: Impacket Tool Execution	Collection	T1557.001	7
Windows: NPPSpy Hacktool Usage	Persistence	none	7
Windows: PUA - Crassus Execution	Reconnaissance	T1590.001	7
Windows: PUA - Process Hacker Driver Load	Persistence	none	7
Windows: PUA - Process Hacker Execution	Persistence	none	7
Windows: ProcessHacker Privilege Elevation	Execution	T1569.002	7
Windows: Suspicious Hacktool Execution - PE Metadata	Persistence	none	7
Windows: Vulnerable HackSys Extreme Vulnerable Driver Load	Persistence	T1543.003	7
Windows: Webshell Hacking Activity Patterns	Persistence	T1505.003	7

Honeypot match

Name	Tactic	Technique	Severity
FortiDeceptor: IPS Attack to Decoy	Lateral Movement	none	9
FortiDeceptor: Successful FTP/TFTP Operations to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful IOT SCADA Operations to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful RDP Login to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful SAMBA Operations to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful SSH Login to Decoy	Initial Access ICS	T0886	9

Host Discovery

Name	Tactic	Technique	Severity
AWS Instance or Snapshot Discovery	Discovery	T1580	3
AWS SecHub: Tactics: Discovery Detected	Discovery	none	7
Azure Service Discovery	Discovery	T1526	3
Enumeration of System Information	Discovery	T1082	5
Info Leak Exploits	Discovery	none	5
Linux Account Discovery via Built-In Tools	Discovery	T1087.001	5
Linux: Discovery of Domain Groups	Discovery	T1069.002	5
Linux: Discovery of Network Environment via Built-in Tools	Discovery	T1016.001	5
Linux: Hping Process Activity	Discovery	T1018	7
Linux: Kernel Module Enumeration	Discovery	T1518.001	5
Linux: Process Discovery via Built-In Applications	Discovery	T1057,T1518.001	5
Linux: System Network Connections Discovery	Discovery	T1049	5
Linux: User Discovery via Whoami	Discovery	T1033	5
Linux: Virtual Machine Fingerprinting By non-root User	Discovery	T1082	5
MS 365 Defender: Suspicious Process Discovery - Discovery Alert	Discovery	T1057	7
MS 365 Defender: System Service Discovery - Discovery Alert	Discovery	T1007	6
Password Policy Enumeration	Discovery	T1201	5
Targeted System/Application Scan	Discovery	T1046	7
Windows: AD Privileged Users or Groups Reconnaissance	Discovery	T1087.002	7
Windows: AD User Enumeration	Discovery	T1087.002	5
Windows: Azure AD Health Monitoring Agent Registry Keys Access	Discovery	T1012	5
Windows: Azure AD Health Service Agents Registry Keys Access	Discovery	T1012	5
Windows: BloodHound Collection Files	Discovery	T1482	7
Windows: Computer Discovery And Export Via Get-ADComputer Cmdlet	Discovery	T1033	5
Windows: Computer System Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: DirLister Execution	Discovery	T1083	3
Windows: Discovery of a System Time	Discovery	T1124	3
Windows: Domain Trust Discovery Via Dsquery	Discovery	T1482	5
Windows: Exports Critical Registry Keys To a File	Discovery	T1012	7
Windows: Exports Registry Key To a File	Discovery	T1012	3
Windows: Files And Subdirectories Listing Using Dir	Discovery	T1217	3
Windows: Fsutil Drive Enumeration	Discovery	T1120	3
Windows: Group Membership Reconnaissance Via Whoami.EXE	Discovery	T1033	5
Windows: HackTool - Bloodhound/Sharphound Execution	Discovery	T1482	7
Windows: HackTool - SharpLdapWhoami Execution	Discovery	T1033	7
Windows: HackTool - TruffleSnout Execution	Discovery	T1482	7
Windows: HackTool - winPEAS Execution	Discovery	T1082	7
Windows: Hardware Model Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Local Accounts Discovery	Discovery	T1087.001	3
Windows: Local Groups Reconnaissance Via Wmic.EXE	Discovery	T1069.001	3
Windows: Network Reconnaissance Activity	Discovery	T1082	7
Windows: PUA - AdFind Suspicious Execution	Discovery	T1482	7
Windows: PUA - Advanced IP Scanner Execution	Discovery	T1135	5
Windows: PUA - Advanced Port Scanner Execution	Discovery	T1135	5
Windows: PUA - Nmap/Zenmap Execution	Discovery	T1046	7
Windows: PUA - Seatbelt Execution	Discovery	T1526	7
Windows: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	Discovery	T1087.002	7
Windows: Permission Check Via Accesschk.EXE	Discovery	T1069.001	5
Windows: Potential Active Directory Reconnaissance/Enumeration Via LDAP	Discovery	T1482	5
Windows: Potential Configuration And Service Reconnaissance Via Reg.EXE	Discovery	T1012	5
Windows: Potential Product Class Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Potential Product Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Potential Recon Activity Via Nltest.EXE	Discovery	T1482	7
Windows: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS	Execution	T1059.005	5
Windows: Potential System Information Discovery Via Wmic.EXE	Discovery	T1082	5
Windows: Potential Unquoted Service Path Reconnaissance Via Wmic.EXE	Execution	T1047	7
Windows: Process Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Python Initiated Connection	Discovery	T1046	5
Windows: Reconnaissance Activity	Discovery	T1087.002	7
Windows: Renamed AdFind Execution	Discovery	T1482	7
Windows: Renamed Whoami Execution	Discovery	T1033	9
Windows: SCM Database Handle Failure	Discovery	T1010	5
Windows: Security Privileges Enumeration Via Whoami.EXE	Discovery	T1033	7
Windows: Service Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Share And Session Enumeration Using Net.EXE	Discovery	T1018	3
Windows: Suspicious Execution of Adidnsdump	Discovery	T1018	3
Windows: Suspicious Execution of Hostname	Discovery	T1082	3
Windows: Suspicious Execution of Systeminfo	Discovery	T1082	3
Windows: Suspicious Query of MachineGUID	Discovery	T1082	3
Windows: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet	Discovery	T1087.001	5
Windows: Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	Execution	T1059.005	7
Windows: Suspicious Scan Loop Network	Discovery	T1018	5
Windows: Suspicious Use of PsLogList	Discovery	T1087.002	5
Windows: Suspicious Where Execution	Discovery	T1217	3
Windows: Suspicious Whoami.EXE Execution	Discovery	T1033	7
Windows: Suspicious Whoami.EXE Execution From Privileged Process	Discovery	T1033	7
Windows: SysKey Registry Keys Access	Discovery	T1012	9
Windows: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE	Discovery	T1518.001	7
Windows: System Network Connections Discovery Via Net.EXE	Discovery	T1049	3
Windows: Use of W32tm as Timer	Discovery	T1124	7
Windows: User Discovery And Export Via Get-ADUser Cmdlet	Discovery	T1033	5
Windows: WhoAmI as Parameter	Discovery	T1033	7
Windows: Whoami Utility Execution	Discovery	T1033	5
Windows: Whoami.EXE Execution Anomaly	Discovery	T1033	7
Windows: Windows Hotfix Updates Reconnaissance Via Wmic.EXE	Execution	T1047	5

Initial Access

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Initial Access Detected	Initial Access	none	7
Azure External Guest User Invitation	Initial Access	T1078.004	3
Windows: External Disk Drive or USB Storage Device	Initial Access	T1091,T1200	3
Windows: ISO Image Mount	Initial Access	T1566.001	5

IOC Match

Name	Tactic	Technique	Severity
Blocklist User Agent Match	Exfiltration	T1041	9
Cisco Umbrella: Failed DNS Requests to Malware Domains: Same source and Multiple Destinations	Command And Control	T1071.004	9
Cisco Umbrella: Multiple Failed DNS Requests to a Malware Domain: Same Source and Destination	Command And Control	T1071.004	9
Crowdstrike: Intel Detection	Persistence	none	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
FortiMail: AntiVirus Phishing URL found	Collection	T1114.001	9
FortiMail: Antispam Malicious URL found	Collection	T1114.001	9
Inbound Traffic from Open Proxies	Command And Control	T1090.002	9
Inbound Traffic from Tor Network	Command And Control	T1090.002	9
Malware hash match	Exfiltration	T1041	9
Outbound Traffic to Open Proxies	Command And Control	T1090.002	9
Outbound Traffic to Tor Network	Command And Control	T1090.002	9
Permitted Traffic from AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Blocklist DE Malware IP List	Exfiltration	T1041	9
Permitted Traffic from C2 Tracker Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CINS Score Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CertPL Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Cisco Talos Malware IP List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Permitted Traffic from Emerging Threat IP List	Command and Control	none	7
Permitted Traffic from FireHol Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiGuard Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Greensnow Malware IP List	Exfiltration	T1041	9
Permitted Traffic from IPSum Malware IP List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware IP List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Proofpoint Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Snort Malware IP List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Traffic to Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Traffic to Blocklist DE Malware IP List	Exfiltration	T1041	9
Traffic to C2 Tracker Malware IP List	Exfiltration	T1041	9
Traffic to CINS Score Malware IP List	Exfiltration	T1041	9
Traffic to CertPL Malware Domain List	Exfiltration	T1041	9
Traffic to Cisco Talos Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware Domain List	Exfiltration	T1041	9
Traffic to DigitalSide Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware URL List	Exfiltration	T1041	9
Traffic to Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Traffic to Emerging Threat IP List	Exfiltration	T1048.001	7
Traffic to FireHol Malware IP List	Exfiltration	T1041	9
Traffic to FortiGuard Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware Domain List	Exfiltration	T1041	9
Traffic to FortiRecon Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware URL List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware Domain List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware IP List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware URL List	Exfiltration	T1041	9
Traffic to Greensnow Malware IP List	Exfiltration	T1041	9
Traffic to IPSum Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware Domain List	Exfiltration	T1041	9
Traffic to MISP Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware URL List	Exfiltration	T1041	9
Traffic to Mandiant Malware Domain List	Exfiltration	T1041	9
Traffic to Mandiant Malware IP List	Exfiltration	T1041	9
Traffic to Mandiant Malware URL List	Exfiltration	T1041	9
Traffic to OpenCTI Malware Domain List	Exfiltration	T1041	9
Traffic to OpenCTI Malware IP List	Exfiltration	T1041	9
Traffic to OpenCTI Malware URL List	Exfiltration	T1041	9
Traffic to OpenPhish Malware URL List	Exfiltration	T1041	9
Traffic to Proofpoint Malware IP List	Exfiltration	T1041	9
Traffic to Snort Malware IP List	Exfiltration	T1041	9
Traffic to ThreatFox Malware URL List	Exfiltration	T1041	9
Traffic to TweetFeed Malware Domain List	Exfiltration	T1041	9
Traffic to TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to TweetFeed Malware URL List	Exfiltration	T1041	9
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

Lateral Movement

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Lateral Movement Detected	Lateral Movement	none	8
FortiSandbox detects multiple attacks from same source	Lateral Movement	none	9
Lateral Movement Detected	Lateral Movement	none	9
Linux: Remote Terminal Session Started	Lateral Movement	T1021.004	5
Malware outbreak	Lateral Movement	none	9
Windows: Access to ADMIN$ Share	Lateral Movement	T1021.002	3
Windows: DCERPC SMB Spoolss Named Pipe	Lateral Movement	T1021.002	5
Windows: DCOM Internet Explorer.Application Iertutil DLL Hijack: Security Log	Lateral Movement	T1021.003	7
Windows: First Time Seen Remote Named Pipe	Lateral Movement	T1021.002	7
Windows: HackTool - Potential Impacket Lateral Movement Activity	Execution	T1047	7
Windows: MMC Spawning Windows Shell	Lateral Movement	T1021.003	7
Windows: MMC20 Lateral Movement	Lateral Movement	T1021.003	7
Windows: Metasploit SMB Authentication	Lateral Movement	T1021.002	7
Windows: New Remote Desktop Connection Initiated Via Mstsc.EXE	Lateral Movement	T1021.001	5
Windows: OpenSSH Server Listening On Socket	Lateral Movement	T1021.004	5
Windows: Pass the Hash Activity 2	Defense Evasion	T1550.002	5
Windows: Potential DCOM InternetExplorer.Application DLL Hijack	Lateral Movement	T1021.003	9
Windows: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load	Lateral Movement	T1021.003	9
Windows: Potential MSTSC Shadowing Activity	Lateral Movement	T1563.002	7
Windows: Potential RDP Exploit CVE-2019-0708	Lateral Movement	T1210	5
Windows: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell	Execution	T1059.001	5
Windows: Protected Storage Service Access	Lateral Movement	T1021.002	7
Windows: Remote Service Activity via SVCCTL Named Pipe	Lateral Movement	T1021.002	5
Windows: Rundll32 Execution Without Parameters	Lateral Movement	T1570	7
Windows: SMB Create Remote File Admin Share	Lateral Movement	T1021.002	7
Windows: Scanner PoC for CVE-2019-0708 RDP RCE Vuln	Lateral Movement	T1210	9
Windows: Successful Overpass the Hash Attempt	Defense Evasion	T1550.002	7
Windows: Suspicious RDP Redirect Using TSCON	Lateral Movement	T1563.002	7
Windows: Suspicious UltraVNC Execution	Lateral Movement	T1021.005	7
Windows: Terminal Service Process Spawn	Lateral Movement	T1210	7
Windows: WCE wceaux dll Access	Lateral Movement	T1550.002	9
Windows: WinRM Access with Evil-WinRM	Lateral Movement	T1021.006	5
Windows: Windows Admin Share Mount Via Net.EXE	Lateral Movement	T1021.002	5
Windows: Windows Internet Hosted WebDav Share Mount Via Net.EXE	Lateral Movement	T1021.002	7
Windows: Windows Share Mount Via Net.EXE	Lateral Movement	T1021.002	3
Windows: smbexec.py Service Installation	Lateral Movement	T1021.002,T1569.002,T1021.002	9

Log or History Cleared

Name	Tactic	Technique	Severity
AWS CloudTrail Log Deleted	Defense Evasion	T1562.008	9
AWS CloudWatch Alarm Deleted	Defense Evasion	T1562.008	5
AWS CloudWatch Log Stream Deleted	Defense Evasion	T1070.004	9
AWS EC2 Flow Log Deleted	Defense Evasion	T1562.008	7
CyberArk Vault User History Clear	Defense Evasion	T1070.003	8
GCP: Logging Sink Deleted	Defense Evasion	T1562.008	8
GCP: Storage or Logging Bucket Deleted	Defense Evasion	T1562.008	6
Linux: Clear System Logs	Defense Evasion	T1070.002	9
Windows Security Log Cleared	Defense Evasion	T1070.001	9
Windows: Backup Catalog Deleted	Defense Evasion	T1070.004	5
Windows: Disable of ETW Trace	Defense Evasion	T1562.006	7
Windows: Eventlog Cleared	Defense Evasion	T1070.001	5
Windows: Suspicious Eventlog Clear or Configuration Change	Defense Evasion	T1562.002	7
Windows: System Eventlog Cleared	Defense Evasion	T1070.001	7

Logging Disabled

Name	Tactic	Technique	Severity
AWS CloudTrail Log Suspended	Defense Evasion	T1562.008	9
AWS CloudWatch Log Group Deleted	Defense Evasion	T1070.004	9
AWS Configuration Recorder Stopped	Defense Evasion	T1562.008	7
AWS GuardDuty Detector Deleted	Defense Evasion	T1562.008	7
Azure Event Hub Deleted	Defense Evasion	T1562.008	9
Azure Network Watcher Deleted	Defense Evasion	T1562.007	5
Linux: Attempt to Disable Syslog Service	Defense Evasion	T1562.004	9
Windows Logging Service Shutdown	Defense Evasion	T1562.002	9
Windows Security Log is Full	Defense Evasion	T1070.001	9
Windows: Disable Security Events Logging Adding Reg Key MiniNt	Defense Evasion	T1562.001	7
Windows: Disable Windows IIS HTTP Logging	Defense Evasion	T1562.002	7
Windows: Sysmon Channel Reference Deletion	Defense Evasion	T1112	7

Malware Detected

Name	Tactic	Technique	Severity
Adware process found	Persistence	none	7
Backdoor Found by Network IPS	Execution	T1204.001	9
Cisco Umbrella: Intelligent Proxy Blocked a Malware Request by Policy	Command And Control	T1071.004	9
Crowdstrike: Activity Prevented	Malware	none	6
Crowdstrike: Attacker Methodology	Malware	none	8
Crowdstrike: Blocked Exploit	Execution	none	6
Crowdstrike: File Blocked With Matching Hash	Execution	none	6
Crowdstrike: NextGen Antivirus based Malware	Persistence	none	8
CyberX Detected Malware	Behavioral Anomaly	none	9
Cylance Blocked Exploit	Execution	none	7
Dynamically generated host name: malware likely	Command And Control	T1568.002	7
FireAMP Malicious file execution	Persistence	none	9
FireEye HX IOC found	Persistence	none	9
FireEye Malware Callback	Exfiltration	T1041	9
FortiMail: Malicious Spam File Attachment Found	Collection	T1114.001	9
FortiNDR: Attack Chain Blocked	Malware	none	8
FortiNDR: Attack Chain Permitted	Malware	none	10
FortiSandbox detects URL Malware	Exfiltration	T1041	9
FortiSandbox detects file malware with high or medium risk	Exfiltration	T1041	9
FortiSandbox detects malicious file malware from file upload	Exfiltration	T1041	9
FortiSandbox detects multiple hosts with infected files	Exfiltration	T1041	9
FortiSandbox detects unknown risk file malware	Exfiltration	T1041	7
Host Quarantined by FortiGate	Policy Violation	none	9
MS 365 Defender: Malware Detected	Exfiltration	T1041	9
Malware found but not remediated	Exfiltration	T1041	9
Malware found by firewall but not remediated	Persistence	none	9
Malware found in mail	Collection	T1114.001	9
Mimecast: User clicked malicious link in email	Reconnaissance	T1598.003	9
Phishing attack found but not remediated	Reconnaissance	T1598.002,T1598.003	9
Rootkit found	Persistence	T1014,T1554,T1601.001	9
Spam/Malicious Mail Attachment found but not remediated	Collection	T1114.001	7
Spyware Found And Cleaned	Execution	T1204.001	5
Spyware Found by Network IPS	Execution	T1204.001	9
Spyware found but not remediated	Execution	T1204.001	9
ThreatDown Nebula: Malware Blocked	Initial Access	T1189	8
ThreatDown Nebula: Malware Found	Initial Access	T1189	10
UEBA Policy detects malicious powershell execution	UEBA	none	7
UEBA Policy detects suspicious applications	UEBA	none	7
Windows: Microsoft Malware Protection Engine Crash	Defense Evasion	T1562.001	7
Windows: Microsoft Malware Protection Engine Crash - WER	Defense Evasion	T1562.001	7
Windows: Octopus Scanner Malware Detected	Initial Access	T1195.001	7
Windows: Registry Entries For Azorult Malware	Defense Evasion	T1112	9
Windows: Suspicious Typical Malware Back Connect Ports	Command And Control	T1571	5

Network Discovery

Name	Tactic	Technique	Severity
Excessive Denied Connections From Same Src	Impact	T1498.001	8
Excessive Denied Connections To A Port	Impact	T1498.001	7
Excessive Denied Connections To Same Destination	Impact	T1498.001	8
Excessive SNMP Port 161 Traffic from a Source to the same Destination	Collection	T1602.001	5
Heavy Half Open TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy Half Open TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy ICMP Ping sweep	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy UDP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy UDP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	9
Azure Infrastructure Discovery	Discovery	T1580	3
Heavy Half Open TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy Half Open TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy UDP Port Scan: Multiple Hosts	Discovery	T1046	9
Heavy UDP Port Scan: Single Host	Discovery	T1046	7
Linux: NMAP Process Activity	Reconnaissance	T1592.002,T1595.001	7
Linux: Nping Process Activity	Reconnaissance	T1595.001	7
MS 365 Defender: System Network Configuration Discovery - Discovery Alert	Discovery	T1016.001	6
Multiple IPS Detected Scans From Same Src	Discovery	T1046	7
Stealth Scan using a tool	Discovery	T1046	9
WLAN Scan	Discovery	T1046	7

Network Performance Issue

Name	Tactic	Technique	Severity
BGP Neighbor Down	Impact	T1529	9
Cisco ACI Cluster Unavailable	SDN	none	9
Cisco ACI Critical Fault	SDN	none	9
Cisco ACI Node Health Critical	SDN	none	9
Cisco ACI Node Health Warning	SDN	none	7
Cisco ACI System Health Critical	SDN	none	9
Cisco ACI System Health Warning	SDN	none	7
Cisco ACI Tenant Health Critical	SDN	none	9
Cisco ACI Tenant Health Warning	SDN	none	7
Cisco AVC: Application Flows with QoS Queue Packet Drops	Application	none	5
Cisco AVC: Application Response Time Late	Application	none	7
Cisco AVC: P2P Applications that exceed interface utilization	Interface	none	1
Cisco Call Manager Active Partition Disk Low	Storage Space	none	8
Cisco Call Manager CPU High	CPU	none	8
Cisco Call Manager Certificate Mismatch	Suspicious Activity	none	9
Cisco Call Manager Core Dump File Found	VoIP	none	8
Cisco Call Manager DDR Block Prevention	Suspicious Activity	none	9
Cisco Call Manager DDR Down	Impact	T1489	9
Cisco Call Manager DRF Failed	VoIP	none	9
Cisco Call Manager EMCC Failed In Local Cluster	VoIP	none	9
Cisco Call Manager EMCC Failed In Remote Cluster	VoIP	none	9
Cisco Call Manager EMCC Login Failure	Credential Access	T1110.001	7
Cisco Call Manager Excessive Active BLF subscriptions	VoIP	none	9
Cisco Call Manager Excessive Voice Quality Reports	VoIP	none	9
Cisco Call Manager IME Service TLS Connection Failure	VoIP	none	9
Cisco Call Manager Inactive Partition Disk Low	Storage Space	none	7
Cisco Call Manager License Grace Period Expired	VoIP	none	7
Cisco Call Manager Location Out Of Bandwidth	VoIP	none	10
Cisco Call Manager Not Connected To Enterprise License Manager	VoIP	none	9
Cisco Call Manager Spare Partition Disk Usage Critical	Storage Space	none	8
Cisco Call Manager Spare Partition Disk Usage Warning	Storage Space	none	7
Cisco Call Manager Swap Disk Low	Storage Space	none	8
Cisco Call Manager Syslog Pattern Match	VoIP	none	7
Cisco Call Manager Syslog Severity Match	VoIP	none	7
Cisco Call Manager System In Overage	VoIP	none	9
Cisco Call Manager System Version Mismatch	VoIP	none	9
Cisco Call Manager User Defined Search String Found In Log	VoIP	none	5
Cisco Call Manager Virtual Memory Low	Memory	none	8
Cisco CallManager CDR Agent Send Failed	VoIP	none	9
Cisco CallManager CDR File Delivery Failed	VoIP	none	9
Cisco CallManager CDR High Disk Usage	Storage Space	none	9
Cisco CallManager CDR Max Disk Usage Exceeded	Storage Space	none	9
Cisco CallManager Call Route List Exhausted	VoIP	none	7
Cisco CallManager Cluster Member Down	Impact	T1489	10
Cisco CallManager Critical Service Down	Impact	T1489	9
Cisco CallManager DB Replication Error	VoIP	none	7
Cisco CallManager DB Replication Failure	VoIP	none	9
Cisco CallManager Database Notification Failure	VoIP	none	8
Cisco CallManager Excessive Authentication Failure	Credential Access	T1110.001	7
Cisco CallManager Hardware Failure	VoIP	none	9
Cisco CallManager High Call Latency: Code Yellow	VoIP	none	8
Cisco CallManager IME Distributed Cache Inactive	VoIP	none	7
Cisco CallManager IME Insufficient Fallback Identifiers: No PSTN Fallback	VoIP	none	7
Cisco CallManager IME Over Quota	VoIP	none	9
Cisco CallManager IME Quality Alert	VoIP	none	9
Cisco CallManager IME Service Authentication Error	Authentication	none	7
Cisco CallManager LogPartition High Water Mark Exceeded	VoIP	none	9
Cisco CallManager LogPartition Low Water Mark Exceeded	VoIP	none	7
Cisco CallManager MGCP DChannel is out of service	VoIP	none	9
Cisco CallManager Malicious Call Trace	Suspicious Activity	none	9
Cisco CallManager Media List Exhausted	VoIP	none	9
Cisco CallManager Node Excessive Process and Thread	VoIP	none	7
Cisco CallManager Node High CPU	CPU	none	8
Cisco CallManager Registered Device Count Exceeded	VoIP	none	7
Cisco CallManager Registered Device Count Increased	VoIP	none	7
Cisco CallManager Registered Media Count Increased	VoIP	none	6
Cisco CallManager Registered Phone Decreased	VoIP	none	8
Cisco Local To Remote Call Manager Communication Problem	VoIP	none	9
Cisco Local To Remote Call Manager TCP Connection Failed	VoIP	none	9
Cisco Unified Contact Center Express Autopurging completed	VoIP	none	7
Cisco Unified Contact Center Express Database Replication Failed	VoIP	none	8
Cisco Unified Contact Center Express Database Replication Stopped	VoIP	none	9
Cisco Unified Contact Center Express Database Unavailable	VoIP	none	9
Cisco Unified Contact Center Express Database Update Issue	VoIP	none	9
Cisco Unified Contact Center Express JVM heap memory high	Memory	none	8
Cisco Unified Contact Center Express Report Execution Failed	VoIP	none	7
Cisco Unified Contact Center Express Report Server Uncoverable Error	VoIP	none	8
Cisco Unity Connection Disk utilization Critical	Storage Space	none	9
Cisco Unity Connection Disk utilization Warning	Storage Space	none	7
Cisco Unity Connection Failback Failed	VoIP	none	10
Cisco Unity Connection Failover Failed	VoIP	none	10
Cisco Unity Connection Failover Succeeded	VoIP	none	7
Cisco Unity Connection License About To Expire	VoIP	none	7
Cisco Unity Connection License Expired	VoIP	none	9
Cisco Unity Connection Split Brain Failed	VoIP	none	10
Cisco Unity No Connection To Peer	VoIP	none	9
Critical Network Device Interface Staying Down	Network	none	9
Degraded IPSLA DNS Test	Impact	T1499.002	7
Degraded IPSLA ICMP Test	Impact	T1499.002	7
Degraded IPSLA UDP Echo Test	Impact	T1499.002	7
Degraded VoIP Call Quality	Impact	T1499.002	7
Degraded VoIP IPSLA Call Quality	Impact	T1499.002	7
EIGRP Neighbor Down	Impact	T1529	9
Excessive ICMP Unreachables	Network	none	6
FortiWeb Connection Limit Reached	Impact	T1499.002	9
IOS Packet Memory Test Failure	Network	none	9
IPSLA HTTP Test Failure	Impact	T1499.002	7
Meraki Device Cellular Connection Disconnected	Network	none	7
Meraki Device Down	Impact	T1489	9
Meraki Device IP Conflict	Network	none	7
Meraki Device Interface Down	Network	none	7
Meraki Device Port Cable Error	Network	none	8
Meraki Device VPN Connectivity Down	Network	none	9
Meraki Foreign AP Detected	Policy Violation	none	7
Meraki New DHCP Server	Network	none	7
Meraki New Splash User	Persistence	T1098.001	7
Meraki No DHCP lease	Network	none	7
Meraki Rogue DHCP Server	Policy Violation	none	7
Meraki Unreachable Device	Network	none	9
Meraki Unreachable RADIUS Server	Network	none	9
Meraki VPN Failover	Network	none	7
Network CPU Critical	Impact	T1499.002	9
Network CPU Warning	Impact	T1499.002	5
Network Device Down: no ping response	Impact	T1529	7
Network Device Failover	Impact	T1529	9
Network Device Hardware Critical	Hardware	none	9
Network Device Hardware Warning	Hardware	none	5
Network Device Health: Critical	Impact	T1499.002	9
Network Device Interface Flapping	Impact	T1529	7
Network Device Redundancy Lost	Network	none	6
Network IPS Intf Util Critical	Impact	T1498.001	9
Network IPS Intf Util Warning	Impact	T1498.001	5
Network Interface Duplex Mismatch	Network	none	7
Network Intf Error Critical	Interface	none	9
Network Intf Error Warning	Interface	none	5
Network Intf Util Critical	Impact	T1498.001	9
Network Intf Util Warning	Impact	T1498.001	5
Network Memory Critical	Impact	T1499.002	9
Network Memory Warning	Impact	T1499.002	5
Noncritical Network Device Interface Staying Down	Network	none	4
OSPF Neighbor Down	Impact	T1529	9
Poor VoIP Call Quality	Impact	T1499.002	9
Poor VoIP IPSLA Call Quality	Impact	T1499.002	9
Radvision Corrupt video packets	Video Conferencing	none	7
Radvision Ethernet Loss	Impact	T1489	7
Radvision Gateway Down	Impact	T1489	9
Radvision Hardware Removed/Swapped	Video Conferencing	none	7
Radvision ISDN Loss	Impact	T1489	7
Radvision call setup issues	Video Conferencing	none	7
Riverbed Steelhead Service Health Critical	WAN	none	9
Riverbed Steelhead System Health Critical	WAN	none	9
Riverbed Steelhead System Health Degraded	WAN	none	7
Server Intf Util Warning	Impact	T1499.001	5

Notable Activity

Name	Tactic	Technique	Severity
Linux: Creation of Kernel Module	Persistence	T1547.006	5
Linux: Creation or Modification of Systemd Service	Persistence	T1543.002	5
Linux: Job Schedule Modification	Persistence	T1053.003	5
Linux: Kernel Module Modification	Persistence	T1547.006	7
Linux: Modifications of .bash-profile and .bashrc	Persistence	T1546.004	7
Linux: Scheduled Job Execution	Persistence	T1053.003	5
UEBA Policy detects MTP read	UEBA	none	7
UEBA Policy detects MTP write	UEBA	none	7
UEBA Policy detects NFS read	UEBA	none	7
UEBA Policy detects backup applications	UEBA	none	7
UEBA Policy detects browser download	UEBA	none	7
UEBA Policy detects browser upload	UEBA	none	7
UEBA Policy detects file printed	UEBA	none	7
UEBA Policy detects files copied over remote desktop	UEBA	T1014	7
UEBA Policy detects gaming application	UEBA	none	7
UEBA Policy detects nfs write	UEBA	none	7
UEBA Policy detects potential leaver editing a CV at work	UEBA	none	7
UEBA Policy detects removable media read	UEBA	T1025	7
UEBA Policy detects removable media write	UEBA	T1025	7
UEBA Policy detects software installation	UEBA	none	7
Windows failed file access	Collection	T1005,T1565.001	7
Windows successful file access	Collection	T1005,T1565.001	5

Notable File Change

Name	Tactic	Technique	Severity
Agent FIM: Linux Directory Ownership or Permission Changed	Defense Evasion	T1222.002,T1565.001	7
Agent FIM: Linux File Changed From Baseline	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Linux File Content Modified	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Linux File Ownership or Permission Changed	Defense Evasion	T1222.002,T1565.001	9
Agent FIM: Linux File or Directory Created	Collection	T1074.001,T1565.001	7
Agent FIM: Linux File or Directory Deleted	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Changed From Baseline	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Content Modified	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Ownership Changed	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Permission Changed	Defense Evasion	T1222.001,T1565.001	7
Agent FIM: Windows File or Directory Archive Bit Changed	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File or Directory Created	Collection	T1074.001,T1565.001	7
Agent FIM: Windows File or Directory Deleted	Defense Evasion	T1070.004,T1565.001	7
Agentless FIM: Audited file or directory created	Collection	T1074.001,T1565.001	8
Agentless FIM: Audited file or directory deleted	Defense Evasion	T1070.004,T1565.001	8
Agentless FIM: Audited file or directory ownership or permission changed	Defense Evasion	T1222.002,T1565.001	9
Agentless FIM: Audited target file content modified	Defense Evasion	T1070.004,T1565.001	8
Audited file or directory content modified in SVN	Defense Evasion	T1070.004,T1565.001	8

OT Exploit

Name	Tactic	Technique	Severity
FortiGate ICS Alert: Exploitation of Remote Services	Initial Access ICS	T0866	8
ICS Alert: Activate Firmware Update Mode	Inhibit Response Function	T0800	6
ICS Alert: Alarm Suppression	Inhibit Response Function	T0878	6
ICS Alert: Automated Collection	Collection ICS	T0802	8
ICS Alert: Block Reporting Message	Inhibit Response Function	T0804	8
ICS Alert: Brute Force I/O	Impair Process Control	T0806	8
ICS Alert: Change Operating Mode	Execution ICS	T0858	8
ICS Alert: Command Blocked	Inhibit Response Function	T0803	8
ICS Alert: Command-Line Interface	Execution ICS	T0807	8
ICS Alert: Commonly Used Port	Command And Control ICS	T0885	8
ICS Alert: Connection Proxy	Command And Control ICS	T0884	8
ICS Alert: Damage to Property	Impact ICS	T0879	8
ICS Alert: Data Destruction	Inhibit Response Function	T0809	8
ICS Alert: Data from Information Repositories	Collection ICS	T0811	8
ICS Alert: Default Credentials	Lateral Movement ICS	T0812	8
ICS Alert: Denial of Control	Impact ICS	T0813	8
ICS Alert: Denial of Service	Inhibit Response Function	T0814	8
ICS Alert: Denial of View	Impact ICS	T0815	8
ICS Alert: Detect Operating Mode	Collection ICS	T0868	8
ICS Alert: Device Restart/Shutdown	Inhibit Response Function	T0816	8
ICS Alert: Drive-by Compromise	Initial Access ICS	T0817	8
ICS Alert: Execution through API	Execution ICS	T0871	8
ICS Alert: Exploit Public-Facing Application	Initial Access ICS	T0819	8
ICS Alert: Exploitation for Evasion	Evasion ICS	T0820	8
ICS Alert: Exploitation for Privilege Escalation	Privilege Escalation ICS	T0890	8
ICS Alert: Exploitation of Remote Services	Lateral Movement ICS	T0866	8
ICS Alert: External Remote Services	Initial Access ICS	T0822	8
ICS Alert: Graphical User Interface	Execution ICS	T0823	8
ICS Alert: Hooking	Execution ICS	T0874	8
ICS Alert: I/O Image	Collection ICS	T0877	8
ICS Alert: Indicator Removal on Host	Evasion ICS	T0872	8
ICS Alert: Internet Accessible Device	Initial Access ICS	T0883	8
ICS Alert: Lateral Tool Transfer	Lateral Movement ICS	T0867	8
ICS Alert: Loss of Availability	Impact ICS	T0826	8
ICS Alert: Loss of Control	Impact ICS	T0827	8
ICS Alert: Loss of Productivity and Revenue	Impact ICS	T0828	8
ICS Alert: Loss of Protection	Impact ICS	T0837	8
ICS Alert: Loss of Safety	Impact ICS	T0880	8
ICS Alert: Loss of View	Impact ICS	T0829	8
ICS Alert: Man in the Middle	Collection ICS	T0830	8
ICS Alert: Manipulate I/O Image	Inhibit Response Function	T0835	8
ICS Alert: Manipulation of Control	Impact ICS	T0831	8
ICS Alert: Manipulation of View	Impact ICS	T0832	8
ICS Alert: Masquerading	Evasion ICS	T0849	8
ICS Alert: Modify Alarm Settings	Inhibit Response Function	T0838	8
ICS Alert: Modify Controller Tasking	Execution ICS	T0821	8
ICS Alert: Modify Parameter	Impair Process Control	T0836	8
ICS Alert: Modify Program	Persistence ICS	T0889	8
ICS Alert: Module Firmware	Persistence ICS	T0839	8
ICS Alert: Monitor Process State	Collection ICS	T0801	8
ICS Alert: Native API	Execution ICS	T0834	8
ICS Alert: Network Connection Enumeration	Discovery ICS	T0840	8
ICS Alert: Network Sniffing	Discovery ICS	T0842	8
ICS Alert: Point Tag Identification	Collection ICS	T0861	8
ICS Alert: Program Download	Lateral Movement ICS	T0843	8
ICS Alert: Program Upload	Collection ICS	T0845	8
ICS Alert: Project File Infection	Persistence ICS	T0873	8
ICS Alert: Remote Services	Lateral Movement ICS	T0886	8
ICS Alert: Remote System Discovery	Discovery ICS	T0846	8
ICS Alert: Remote System Information Discovery	Discovery ICS	T0888	8
ICS Alert: Replication Through Removable Media	Initial Access ICS	T0847	8
ICS Alert: Rogue Master	Initial Access ICS	T0848	8
ICS Alert: Rootkit	Evasion ICS	T0851	8
ICS Alert: Screen Capture	Collection ICS	T0852	8
ICS Alert: Scripting	Execution ICS	T0853	8
ICS Alert: Serial COM Blocked	Inhibit Response Function	T0805	8
ICS Alert: Service Stop	Inhibit Response Function	T0881	8
ICS Alert: Spearphishing Attachment	Initial Access ICS	T0865	8
ICS Alert: Spoof Reporting Message	Evasion ICS	T0856	8
ICS Alert: Standard Application Layer Protocol	Command And Control ICS	T0869	8
ICS Alert: Supply Chain Compromise	Initial Access ICS	T0862	8
ICS Alert: System Firmware	Persistence ICS	T0857	8
ICS Alert: Theft of Operational Information	Impact ICS	T0882	8
ICS Alert: Transient Cyber Asset	Initial Access ICS	T0864	8
ICS Alert: Unauthorized Command Message	Impair Process Control	T0855	8
ICS Alert: User Execution	Execution ICS	T0863	8
ICS Alert: Valid Accounts	Persistence ICS	T0859	8
ICS Alert: Wireless Compromise	Initial Access ICS	T0860	8
ICS Alert: Wireless Sniffing	Discovery ICS	T0887	8
OT Modbus Write Command Initiated outside of Purdue Level 2		none	7
OT Permited Traffic not from Purdue Level 3 to Level 2		none	7
OT Permited Traffic not from Purdue Level 3.5 to Level 3		none	7
OT Permited Traffic not from Purdue Level 4 to Level 3.5		none	7
OT Permited Traffic not from Purdue Level 5 to Level 4		none	7
Otorio RAM2 Alert has Triggered	Policy Violation	none	9

Outbreak Alert

Name	Tactic	Technique	Severity
Crowdstrike: Known Malware	Exfiltration	T1041	9
Log4J Exploit Request Detected By Regex	Lateral Movement	T1210	7
Log4J Exploit Request Detected on Host by Fortinet Products	Lateral Movement	T1210	10
Log4J Exploit Request Detected on Network by Fortinet Products	Lateral Movement	T1210	10
Outbreak: 3CX Supply Chain Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: 3CX Supply Chain Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ABB Flow Computer Path Traversal Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Active Directory Privilege Escalation Exploit Detected on Host	Resource Development	T1584.001	9
Outbreak: Active Directory Privilege Escalation Exploit Detected on Network	Resource Development	T1584.001	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Commons Text RCE Vulnerability Detected on Network	Resource Development	T1586.002	9
Outbreak: Apache Path Traversal Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Apache Path Traversal Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache RocketMQ RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Host	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Network	Lateral Movement	T1210	9
Outbreak: BURNTCIGAR MS Signed Driver Malware detected on Host	Defense Evasion	T1036.001	9
Outbreak: BURNTCIGAR MS Signed Driver Malware detected on Network	Defense Evasion	T1036.001	9
Outbreak: CISA Top 20 Vulnerability detected on Host	Lateral Movement	T1210	9
Outbreak: Cacti Server Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Cacti Server Command Injection Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Control Web Panel Login Exploit Detected on Host	Defense Evasion	T1202	9
Outbreak: Control Web Panel Login Exploit Detected on Network	Defense Evasion	T1202	9
Outbreak: CosmicEnergy Malware Detected on Host	Lateral Movement	T1210	9
Outbreak: CosmicEnergy Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: DARKSIDE Domain Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Suspicious File Hash Found on Host	Exfiltration	T1041	9
Outbreak: DARKSIDE Suspicious File Hash Found on Network	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Host	Exploit	none	9
Outbreak: DEARCRY Infected File Detected on Network	Exploit	none	9
Outbreak: Emotet Malware Activity Detected by FortiClient	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Host	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Network	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found by Forticlient	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Host	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Network	Exfiltration	T1041	9
Outbreak: F5 BIG-IP TMM Attack - FortiGate IPS Exploit Permitted	Exploit	none	9
Outbreak: FortiGate Authentication bypass on Administrative Interface	Lateral Movement	T1210	10
Outbreak: FortiGate detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiOS SSLVPN Heap Buffer Overflow attack - CVE-2022-42475 Detected on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: HAFNIUM Exchange OWA Server Authentication Bypass	Command and Control	none	9
Outbreak: HAFNIUM FortiGate Permitted IPS Event	Command and Control	none	9
Outbreak: HAFNIUM Inbound Network Traffic	Command And Control	T1095	9
Outbreak: HAFNIUM Infected File Detected by FortiGate	Command and Control	none	9
Outbreak: HAFNIUM Outbound Network Traffic	Command And Control	T1095	9
Outbreak: HAFNIUM Suspicious File hash match	Command and Control	none	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: HermeticWiper-Foxblade Malware Detected on Host	Impact	T1485	9
Outbreak: HermeticWiper-Foxblade Malware Detected on Network	Impact	T1485	9
Outbreak: Hikvision IP Camera Command Injection Vulnerability CVE-2021-36260 on Network	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Joomla CMS Improper Access Check Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Kaseya REvil Suspicious File Hash Found on Host	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Suspicious File Hash Found on Network	Initial Access	T1195.002	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Host	Lateral Movement	T1021.002	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Network	Lateral Movement	T1021.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Host	Resource Development	T1586.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Network	Resource Development	T1586.002	9
Outbreak: Microsoft Office Follina Vuln Detected on Host	Resource Development	T1584.005	9
Outbreak: Microsoft Office Follina Vuln Detected on Network	Resource Development	T1584.005	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Multiple Vendor Camera System Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Oracle WebLogic Server Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Print Nightmare Activity Detected on Host	Exploit	none	9
Outbreak: Print Nightmare Activity Detected on Network	Exploit	none	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Host	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: Router Malware Attack Detected on Host	Privilege Escalation	T1068	9
Outbreak: Router Malware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9
Outbreak: SUNBURST Outbound Network Traffic	Command And Control	T1095	9
Outbreak: SUNBURST Suspicious File Created	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash Match	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash match by Source and Destination	Command And Control	T1095	9
Outbreak: Sandbreak vm2 sandbox module RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: SolarView Compact Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Spring4Shell Malware Detected on Network	Impact	T1485	9
Outbreak: TBK DVR Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Teclib GLPI Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: VMWare Workspace ONE Vulnerability - CVE-2022-22954 on Network	Lateral Movement	T1210	9
Outbreak: VMware Aria Operations for Networks Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Host	Privilege Escalation	T1068	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Network	Privilege Escalation	T1068	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Host	Initial Access	T1190	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Network	Initial Access	T1190	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Wordpress WPGateway Plugin Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Host	Initial Access	T1190	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Network	Initial Access	T1190	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Host	Privilege Escalation	T1068	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Network	Privilege Escalation	T1068	9
Outbreak: Zoho ManageEngine RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Router Command Injection Attack Detected on Network	Lateral Movement	T1210	9

Phishing Detected

Name	Tactic	Technique	Severity
FortiSandbox detects Phishing URL	Execution	T1204.001	9

Policy Violation

Name	Tactic	Technique	Severity
Excessive End User Mail To Unauthorized Mail Gateways	Exfiltration	T1020.001	8
AWS SecHub: Software and Configuration Violation	Impact	none	6
Cisco Call Manager Call Attempt Blocked By Policy	Suspicious Activity	none	9
Cylance Found Corrupt File	Impact	none	7
Default Password Detected by System	Policy Violation	none	7
Denied Blacklisted Destination	Policy Violation	none	9
Denied Blacklisted Source	Policy Violation	none	9
Excessive Rogue or Unsecure APs Detected	Initial Access	none	9
FortiRecon: Certificate Issue Found for an Asset	Lateral Movement	T1210	9
FortiRecon: High Severity Reputation Issue Found for an Asset	Lateral Movement	T1210	9
Host/User risk increased and crossed High threshold	FortiSIEM	none	9
Host/User risk increased and crossed Medium threshold	FortiSIEM	none	6
IRC traffic detected	Policy Violation	none	7
Office365: Admin or Delegated User Created Mailbox Forwarding Rule for another User	Collection	T1114.003	9
Office365: Mailbox Login from Outside My Country	Collection	T1114.002	9
Office365: Mailbox SendAs or SendOnBehalf has occurred	Collection	T1114.003	6
Office365: Suspicious File Type Uploaded	Resource Development	T1608.001	9
Outbound Traffic to Unapproved Public DNS Servers	Policy Violation	none	7
P2P traffic detected	Policy Violation	none	7
Permitted Blacklisted Destination	Policy Violation	none	9
Permitted Blacklisted Source	Policy Violation	none	9
Remote Desktop traffic from Internet	Lateral Movement	T1021.001,T1133,T1219	9
Rogue or Unsecure AP Detected	Initial Access	none	7
UEBA Policy detects potential pirated media	UEBA	none	7
VNC traffic from Internet	Lateral Movement	T1021.005,T1133,T1219	9
Website access policy violation	Policy Violation	none	5
Website access policy violation: High volume	Policy Violation	none	9
Website access policy violation: Multiple categories	Policy Violation	none	9
Windows: External Remote RDP Logon from Public IP	Initial Access	T1133	5
Windows: External Remote SMB Logon from Public IP	Initial Access	T1133	7
Windows: Failed Logon From Public IP	Initial Access	T1190	5
Windows: Microsoft Defender Blocked from Loading Unsigned DLL	Defense Evasion	T1574.002	7
Windows: Potential Crypto Mining Activity	Impact	T1496	7
Wireless Host Blacklisted	Policy Violation	none	9

Privilege Escalation

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Privilege Escalation Detected	Privilege Escalation	T1548.002	9
Crowdstrike: Authentication Bypass	Privilege Escalation	none	8
Crowdstrike: Privilege Escalation	Privilege Escalation	T1548.004	8
Linux Buffer overflow	Privilege Escalation	T1547.009	9
Linux: Setgid Bit Set via chmod	Privilege Escalation	T1548.001	7
Linux: Setuid Bit Set via chmod	Privilege Escalation	T1548.001	7
Linux: Trap Signals Usage	Privilege Escalation	T1546.005	5
Privilege Escalation Exploits	Privilege Escalation	T1548.004	7
Windows Debugger registry key for common Windows accessibility tools	Privilege Escalation	T1574.002	8
Windows: Addition of SID History to Active Directory Object	Privilege Escalation	T1134.005	5
Windows: Bypass UAC via Fodhelper.exe	Privilege Escalation	T1548.002	7
Windows: Interactive AT Job	Execution	T1053.002	7
Windows: Process Explorer Driver Creation By Non-Sysinternals Binary	Privilege Escalation	T1068	7
Windows: Process Monitor Driver Creation By Non-Sysinternals Binary	Privilege Escalation	T1068	5

Ransomware Detected

Name	Tactic	Technique	Severity
Crowdstrike: Ransomware	Persistence	none	8
Outbreak: DARKSIDE Ransomware File Activity Detected on Host	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Network	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Inbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Outbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: Hive Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Hive Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Kaseya REvil Ransomware File Activity Detected on Host	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Ransomware File Activity Detected on Network	Initial Access	T1195.002	9
Outbreak: Prestige Ransomware Detected on Host	Resource Development	T1586.002	9
Outbreak: Prestige Ransomware Detected on Network	Resource Development	T1586.002	9
Outbreak: VMware ESXi Server Ransomware Attack Detected on Network	Privilege Escalation	T1068	9
Ransomware detected on a host	Impact	T1486	9
Ransomware outbreak detected	Impact	T1486	10
UEBA Policy detects ransomware file types	UEBA	none	7
UEBA Policy detects ransomware note	UEBA	none	9
Windows: Suspicious Creation TXT File in User Desktop	Impact	T1486	7

Remote Access Software

Name	Tactic	Technique	Severity
Windows: Anydesk Temporary Artefact	Command And Control	T1219	5
Windows: GoToAssist Temporary Installation Artefact	Command And Control	T1219	5
Windows: Installation of TeamViewer Desktop	Command And Control	T1219	5
Windows: PDQ Deploy Remote Adminstartion Tool Execution	Execution	T1072	5
Windows: Remote Access Tool - AnyDesk Execution	Command And Control	T1219	5
Windows: Remote Access Tool - AnyDesk Piped Password Via CLI	Command And Control	T1219	5
Windows: Remote Access Tool - AnyDesk Silent Installation	Command And Control	T1219	7
Windows: Remote Access Tool Services Have Been Installed - Security	Execution	T1569.002	5
Windows: Remote Access Tool Services Have Been Installed - System	Execution	T1569.002	5
Windows: Suspicious TeamViewer Domain Access	Command And Control	T1219	5
Windows: TeamViewer Remote Session	Command And Control	T1219	5
Windows: Use of GoToAssist Remote Access Software	Command And Control	T1219	5
Windows: Use of LogMeIn Remote Access Software	Command And Control	T1219	5
Windows: Use of ScreenConnect Remote Access Software	Command And Control	T1219	5
Windows: Use of UltraVNC Remote Access Software	Command And Control	T1219	5
Windows: Use of UltraViewer Remote Access Software	Command And Control	T1219	5

Server Performance Issue

Name	Tactic	Technique	Severity
High Process CPU: Server	Impact	T1499.003	8
HyperV Logical Processor Total Run Time Percent Critical	Impact	T1499.001	5
Auto Service Stopped	Impact	T1489	4
ESX CPU Critical	Impact	T1499.001	9
ESX CPU Warning	Impact	T1499.001	5
ESX Disk I/O Critical	Impact	T1499.001	9
ESX Disk I/O Warning	Impact	T1499.001	5
ESX Memory Critical	Impact	T1499.001	9
ESX Memory Warning	Impact	T1499.001	5
ESX Network I/O Critical	Impact	T1499.001	9
ESX Network I/O Warning	Impact	T1499.001	5
ESX Server Health: Critical	Impact	T1499.001	9
ESX Server Health: Warning	Impact	T1499.001	7
Excessive FTP Client Side Errors	Impact	T1498.001	7
Excessive HTTP Client Side Errors	Impact	T1498.001	7
High Process CPU: Network Device	Impact	T1499.002	8
High Process Memory: Network Device	Impact	T1499.002	8
High Process Memory: Server	Impact	T1499.003	8
HyperV Disk I/O Warning	Impact	T1499.001	5
HyperV Disk Latency Critical	Impact	T1499.001	9
HyperV Guest Critical	Impact	T1499.001	9
HyperV Guest Hypervisor Run Time Percent Warning	Impact	T1499.001	7
HyperV Logical Processor Total Run Time Percent Warning	Impact	T1499.001	7
HyperV Page fault Critical	Impact	T1499.001	9
HyperV Page fault Warning	Impact	T1499.001	7
HyperV Remaining Guest Memory Warning	Impact	T1499.001	7
Important process down	Impact	T1489	7
Important process staying Down	Impact	T1489	9
License Issue	License	none	7
SNMP Service Unavailable	Impact	T1489	9
Server CPU Critical	Impact	T1499.001	9
Server CPU Warning	Impact	T1499.001	5
Server Degraded: Lossy Ping Response	Impact	T1529	7
Server Disk Latency Critical	Impact	T1499.001	9
Server Disk Latency Warning	Impact	T1499.001	5
Server Disk Space Critical	Impact	T1499.001	9
Server Disk space Warning	Impact	T1499.001	5
Server Down: No Ping Response	Impact	T1529	7
Server Hardware Critical	Hardware	none	9
Server Hardware Warning	Hardware	none	5
Server Intf Error Critical	Impact	T1499.001	9
Server Intf Error Warning	Impact	T1499.001	5
Server Intf Util Critical	Impact	T1499.001	9
Server Memory Critical	Impact	T1499.001	9
Server Memory Warning	Impact	T1499.001	5
Server Network Interface Flapping	Impact	T1529	7
Server Network Interface Staying Down	Network	none	4
Server Network Low Port Staying Down	Network	none	7
Server Swap Memory Critical	Impact	T1499.001	9
Service Down: No Response to STM	Impact	T1499.003	9
Service Down: No Response to STM: Has IP	Application	none	9
Service Staying Down: No Response to STM	Impact	T1499.003	8
Service Staying Down: No Response to STM: Has IP	Application	none	8
Sudden Decrease in Reported Events From A Host	FortiSIEM	none	7
Sudden Increase In System CPU Usage	Impact	T1499.001	7
Sudden Increase in Disk I/O	Impact	T1499.001	7
Sudden Increase in Ping Response Times	Impact	T1499.002	7
Sudden Increase in Reported Events From A Host	Discovery	none	7
Sudden Increase in SNMP Response Times	Impact	T1499.002	7
Sudden Increase in System Memory Usage	Impact	T1499.001	7
Sudden Increase in WMI or OMI Response Times	Impact	T1499.002	7
Unix Server Health: Critical	Impact	T1499.001	9
Unix Server Health: Warning	Impact	T1499.001	5
Unix System Shutting Down	Impact	T1529	6
Virtual Machine CPU Critical	Impact	T1499.001	9
Virtual Machine CPU Warning	Impact	T1499.001	5
Virtual Machine Health: Critical	Impact	T1499.001	9
Virtual Machine Health: Warning	Impact	T1499.001	5
Virtual Machine Memory Swapping Critical	Impact	T1499.001	9
Virtual Machine Memory Swapping Warning	Impact	T1499.001	5
Virtual Machine SCSI Bus Reset	Impact	T1499.001	9
WMI or OMI Service Unavailable	Impact	T1489	9
Windows Cluster Service Membership Error	Windows Cluster Service	none	9
Windows Cluster Service Quorum Error	Windows Cluster Service	none	9
Windows Cluster Service Startup Error	Windows Cluster Service	none	9
Windows Disk controller problem	Storage	none	9
Windows File System Replication Service Communication Error	Windows File System Replication	none	7
Windows File System Replication Service Fatal Internal Error	Windows File System Replication	none	9
Windows File System Replication Sharing violation	Windows File System Replication	none	7
Windows File System Replication Staging quota too small	Windows File System Replication	none	7
Windows Server Health: Critical	Impact	T1499.001	9
Windows Server Health: Warning	Impact	T1499.001	5
Windows Server Paging File Usage Critical	Impact	T1499.001	9
Windows Server Shutting Down	Impact	T1489	6

Services Stopped

Name	Tactic	Technique	Severity
AWS RDS Instance/Cluster Stopped	Impact	T1489	5
Windows: Application Uninstalled	Impact	T1489	3
Windows: Delete All Scheduled Tasks	Impact	T1489	7
Windows: Delete Important Scheduled Task	Impact	T1489	7
Windows: Disable Important Scheduled Task	Impact	T1489	7
Windows: Stop Windows Service Via Net.EXE	Impact	T1489	3
Windows: Stop Windows Service Via PowerShell Stop-Service	Impact	T1489	3
Windows: Stop Windows Service Via Sc.EXE	Impact	T1489	3
Windows: Suspicious Execution of Shutdown	Impact	T1529	5
Windows: Suspicious Execution of Shutdown to Log Out	Impact	T1529	5

Storage Performance Issue

Name	Tactic	Technique	Severity
ES Coordinator Node Down	Network	none	7
ES Coordinator Node Staying Down	Network	none	9
Critical NetApp Trap	Storage	none	9
Critical NetApp Trap: can be auto cleared	Storage	none	9
Datastore Space Warning	Impact	T1499.001	7
EqualLogic Connection Read/Write Latency Critical	Impact	T1499.001	9
EqualLogic Connection Read/Write Latency Warning	Impact	T1499.001	5
Isilon Protocol Latency Critical	Impact	T1499.001	9
NFS Disk space Warning	Impact	T1499.001	5
NetApp Back to Back Consistency Point	Impact	T1499.001	9
NetApp CIFS Latency Critical	Impact	T1499.001	9
NetApp CIFS Read/Write Latency Warning	Impact	T1499.001	5
NetApp FCP Read/Write Latency Critical	Impact	T1499.001	9
NetApp FCP Read/Write Latency Warning	Impact	T1499.001	5
NetApp ISCSI Read/Write Latency Critical	Impact	T1499.001	9
NetApp ISCSI Read/Write Latency Warning	Impact	T1499.001	5
NetApp NFS Read/Write Latency Critical	Impact	T1499.001	9
NetApp NFS Read/Write Latency Warning	Impact	T1499.001	5
NetApp Volume Read/Write Latency Critical	Impact	T1499.001	9
NetApp Volume Read/Write Latency Warning	Impact	T1499.001	5
Network Device Degraded: Lossy Ping Response	Impact	T1529	7
Network Device Health: Warning	Impact	T1499.001	5
Storage CPU Warning	Impact	T1499.001	5
Storage Device CPU Critical	Impact	T1499.001	9
Storage Device Disk Space Critical	Impact	T1499.001	9
Storage Hardware Critical	Hardware	none	9
Storage Hardware Warning	Hardware	none	5
Storage Port Down	Impact	T1489	9
Unregistered EMC Clariion Host	Storage	none	4
VCenter Datastore Space Critical	Impact	T1499.001	9
Warning NetApp Trap	Storage	none	7
Warning NetApp Trap: can be auto cleared	Storage	none	7

Suspicious Collection Activity

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Collection Detected	Collection	none	8
FortiRecon: Leaked Credit or Debit Cards Found Online	Collection	T1119	9
Linux: Creation of an Archive with Common Archivers	Collection	T1074.001	5
UEBA Policy detects email download	Collection	T1114.001	7
UEBA Policy detects email upload	Collection	T1114.001	7
UEBA Policy detects encryption tools	UEBA	none	7
UEBA Policy detects file archiver application	Collection	T1560.001	7
UEBA Policy detects snipping tool	UEBA	none	7
Windows Removable Media Inserts	Collection	T1025	7
Windows: 7Zip Compressing Dump Files	Collection	T1560.001	7
Windows: Audio Capture via PowerShell	Collection	T1123	5
Windows: Audio Capture via SoundRecorder	Collection	T1123	5
Windows: Browser Started with Remote Debugging	Collection	T1185	5
Windows: Compress Data and Lock With Password for Exfiltration With 7-ZIP	Collection	T1560.001	5
Windows: Copy from Admin Share	Collection	T1039	7
Windows: Data Compressed - rar.exe	Collection	T1560.001	3
Windows: Local Privilege Escalation Indicator TabTip	Collection	T1557.001	7
Windows: PUA - Mouse Lock Execution	Collection	T1056.002	5
Windows: Potential Data Stealing Via Chromium Headless Debugging	Collection	T1185	7
Windows: Potential SMB Relay Attack Tool Execution	Collection	T1557.001	9
Windows: PowerShell Get-Clipboard Cmdlet Via CLI	Collection	T1115	5
Windows: Processes Accessing the Microphone and Webcam	Collection	T1123	5
Windows: Psr.exe Capture Screenshots	Collection	T1113	5
Windows: Rar Usage with Password and Compression Level	Collection	T1560.001	7
Windows: Recon Information for Export with Command Prompt	Collection	T1119	5
Windows: RottenPotato Like Attack Pattern	Collection	T1557.001	7
Windows: Suspicious Access to Sensitive File Extensions	Collection	T1039	5
Windows: Suspicious Camera and Microphone Access	Collection	T1125	7
Windows: Suspicious Manipulation Of Default Accounts Via Net.EXE	Collection	T1560.001	7
Windows: Use of CLIP	Collection	T1115	3
Windows: Veeam Backup Database Suspicious Query	Collection	T1005	5
Windows: Winrar Compressing Dump Files	Collection	T1560.001	7
Windows: Winrar Execution in Non-Standard Folder	Collection	T1560.001	7
Windows: Zip A Folder With PowerShell For Staging In Temp	Collection	T1074.001	5

Suspicious Execution

Name	Tactic	Technique	Severity
AWS Execution via System Manager	Execution	T1059.006	3
AWS SecHub: Tactics: Execution Detected	Execution	none	8
AWS SecHub: Unusal Data Behavior Detected	Impact	none	7
AWS SecHub: Unusal Database Behavior Detected	Impact	none	7
AWS SecHub: Unusal Process Behavior Detected	Impact	none	8
AWS SecHub: Unusal Serverless Behavior Detected	Impact	none	7
AWS SecHub: Unusual Application Behavior Detected	Impact	none	7
Azure Command Execution on Virtual Machine	Execution	T1059.006	5
Crowdstrike: Drive By Download	Execution	none	8
Crowdstrike: Overwatch Detection	Execution	none	9
Cylance Found Active Script	Execution	none	7
Cylance Quarantined Host	Execution	none	7
CylanceProtect Threat Changed	Execution	none	7
Excessive WLAN Exploits: Same Source	Execution	none	9
Executable file posting from external source	Execution	none	9
Execution via local SxS Shared Module	Execution	T1129	5
High Severity WLAN Attack	Execution	none	9
Linux: Interactive Terminal Spawned via Perl	Execution	T1059.004	5
Linux: Interactive Terminal Spawned via Python	Execution	T1059.006	5
Linux: Netcat Process Activity	Execution	T1059.004	7
Linux: socat Process Activity	Execution	T1059.004	7
Linux: strace Process Activity		none	7
MS 365 Defender: Suspicious PowerShell command line Execution Alert	Execution	T1059.001	7
Malicious PowerShell Tool: PSAttack Detected	Execution	T1059.001	9
PowerShell Commandlet of Well Known Exploitation Framework Detected	Execution	T1059.001	9
PowerShell Downgrade Attack Detected	Lateral Movement	T1210	8
PowerShell Script Detected Calling a Credential Prompt	Execution	T1059.001	9
Shellshock Expression in Log Files	Execution	none	9
Suspicious Linux SSHD Errors	Execution	none	7
Suspicious Linux VSFTPD Errors	Execution	none	7
Suspicious Linux log entries	Execution	none	7
ThreatDown Nebula: PUP Blocked	Defense Evasion	T1562.001	7
ThreatDown Nebula: PUP Found	Defense Evasion	T1562.001	6
ThreatDown Nebula: Suspicious Activity Blocked	Initial Access	T1189	8
ThreatDown Nebula: Suspicious Activity Found	Initial Access	T1189	9
ThreatDown Nebula: Website Blocked	Initial Access	T1189	7
Unapproved File Execution	Execution	none	8
Windows process communicating outbound to unusual ports	Execution	T1129	6
Windows: Active Directory Kerberos DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Active Directory Parsing DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Application Removed Via Wmic.EXE	Execution	T1047	5
Windows: Arbitrary Shell Command Execution Via Settingcontent-Ms	Initial Access	T1566.001	5
Windows: Audit CVE Event	Impact	T1499.004	9
Windows: Boot Configuration Tampering Via Bcdedit.EXE	Impact	T1490	7
Windows: CLR DLL Loaded Via Office Applications	Execution	T1204.002	5
Windows: CMSTP Execution Process Access	Execution	T1559.001	7
Windows: Change PowerShell Policies to an Insecure Level	Execution	T1059.001	5
Windows: Cmd.EXE Missing Space Characters Execution Anomaly	Execution	T1059.001	7
Windows: Cobalt Strike Load by Rundll32	Defense Evasion	T1218.011	7
Windows: CobaltStrike BOF Injection Pattern	Defense Evasion	T1562.001	7
Windows: Conhost.exe CommandLine Path Traversal	Execution	T1059.003	7
Windows: ConvertTo-SecureString Cmdlet Usage Via CommandLine	Execution	T1059.001	5
Windows: Copy From VolumeShadowCopy Via Cmd.EXE	Impact	T1490	7
Windows: Created Files by Office Applications	Execution	T1204.002	7
Windows: Detection of PowerShell Execution via Sqlps.exe	Execution	T1059.001	5
Windows: DotNET Assembly DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Equation Editor Network Connection	Execution	T1203	7
Windows: Exchange PowerShell Snap-Ins Usage	Execution	T1059.001	7
Windows: Execute Code with Pester.bat	Execution	T1059.001	5
Windows: Execution in Outlook Temp Folder	Initial Access	T1566.001	7
Windows: GAC DLL Loaded Via Office Applications	Execution	T1204.002	7
Windows: HTML Help HH.EXE Suspicious Child Process	Initial Access	T1566.001	7
Windows: HandleKatz Duplicating LSASS Handle	Execution	T1106	7
Windows: Hidden Powershell in Link File Pattern	Execution	T1059.001	5
Windows: ISO File Created Within Temp Folders	Initial Access	T1566.001	7
Windows: Impacket PsExec Execution	Lateral Movement	T1021.002	7
Windows: Import PowerShell Modules From Suspicious Directories - ProcCreation	Execution	T1059.001	5
Windows: Java Running with Remote Debugging	Execution	T1203	5
Windows: Jlaive Usage For Assembly Execution In-Memory	Execution	T1059.003	5
Windows: LittleCorporal Generated Maldoc Injection	Execution	T1204.002	7
Windows: Malicious Base64 Encoded PowerShell Keywords in Command Lines	Execution	T1059.001	7
Windows: Microsoft VBA For Outlook Addin Loaded Via Outlook	Execution	T1204.002	7
Windows: NTFS Vulnerability Exploitation	Impact	T1499.001	7
Windows: Network Communication With Crypto Mining Pool	Impact	T1496	7
Windows: New Process Created Via Wmic.EXE	Execution	T1047	5
Windows: Node Process Executions	Execution	T1059.007	5
Windows: Non Interactive PowerShell Process Spawned	Execution	T1059.001	3
Windows: Office Macro File Creation	Initial Access	T1566.001	3
Windows: Office Macro File Creation From Suspicious Process	Initial Access	T1566.001	7
Windows: Office Macro File Download	Initial Access	T1566.001	5
Windows: Operator Bloopers Cobalt Strike Commands	Execution	T1059.003	7
Windows: Operator Bloopers Cobalt Strike Modules	Execution	T1059.003	7
Windows: PAExec Service Installation	Execution	T1569.002	5
Windows: PSEXEC Remote Execution File Artefact	Lateral Movement	T1570	7
Windows: PUA - CsExec Execution	Resource Development	T1587.001	7
Windows: PUA - NSudo Execution	Execution	T1569.002	7
Windows: PUA - NirCmd Execution	Execution	T1569.002	5
Windows: PUA - NirCmd Execution As LOCAL SYSTEM	Execution	T1569.002	7
Windows: PUA - RunXCmd Execution	Execution	T1569.002	7
Windows: Persistence and Execution at Scale via GPO Scheduled Task	Execution	T1053.005	7
Windows: Potential CommandLine Path Traversal Via Cmd.EXE	Execution	T1059.003	7
Windows: Potential Encoded PowerShell Patterns In CommandLine	Execution	T1059.001	3
Windows: Potential Execution of Sysinternals Tools	Resource Development	T1588.002	3
Windows: Potential Persistence Via Microsoft Compatibility Appraiser	Execution	T1053.005	5
Windows: Potential Persistence Via Powershell Search Order Hijacking - Task	Execution	T1059.001	7
Windows: Potential PowerShell Downgrade Attack	Execution	T1059.001	5
Windows: Potential Powershell ReverseShell Connection	Execution	T1059.001	7
Windows: Potential Privilege Escalation To LOCAL SYSTEM	Resource Development	T1587.001	7
Windows: Potential PsExec Remote Execution	Resource Development	T1587.001	7
Windows: Potential WinAPI Calls Via CommandLine	Execution	T1106	7
Windows: PowerShell Base64 Encoded IEX Cmdlet	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded Invoke Keyword	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded Reflective Assembly Load	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded WMI Classes	Execution	T1059.001	7
Windows: PowerShell Core DLL Loaded By Non PowerShell Process	Execution	T1059.001	5
Windows: PowerShell Script Run in AppData	Execution	T1059.001	5
Windows: PowerShell Scripts Installed as Services	Execution	T1569.002	7
Windows: PsExec/PAExec Escalation to LOCAL SYSTEM	Resource Development	T1587.001	7
Windows: Read Contents From Stdin Via Cmd.EXE	Execution	T1059.003	5
Windows: Regsvr32 DNS Activity	Execution	T1559.001	7
Windows: Regsvr32 Network Activity	Execution	T1559.001	7
Windows: Remote Access Tool - ScreenConnect Suspicious Execution	Initial Access	T1133	7
Windows: Remote PowerShell Session Host Process WinRM	Execution	T1059.001	5
Windows: Remote PowerShell Session Network	Execution	T1059.001	7
Windows: Remote PowerShell Sessions	Execution	T1059.001	7
Windows: Remote Task Creation via ATSVC Named Pipe	Execution	T1053.002	5
Windows: Renamed PAExec Execution	Defense Evasion	T1202	7
Windows: Renamed SysInternals DebugView Execution	Resource Development	T1588.002	7
Windows: Renamed Sysinternals Sdelete Execution	Impact	T1485	7
Windows: Restricted Software Access By SRP	Execution	T1072	7
Windows: SQL Client Tools PowerShell Session Detection	Execution	T1059.001	5
Windows: Scheduled Task Creation	Execution	T1053.005	3
Windows: Scheduled Task Executing Powershell Encoded Payload from Registry	Execution	T1059.001	7
Windows: Schtasks Creation Or Modification With SYSTEM Privileges	Execution	T1053.005	7
Windows: Schtasks From Suspicious Folders	Execution	T1053.005	7
Windows: Script Event Consumer Spawning Process	Execution	T1047	7
Windows: Service Started/Stopped Via Wmic.EXE	Execution	T1047	5
Windows: Sliver C2 Default Service Installation	Execution	T1569.002	7
Windows: Start Windows Service Via Net.EXE	Execution	T1569.002	3
Windows: Suspicious Add Scheduled Command Pattern	Execution	T1053.005	7
Windows: Suspicious Binary In User Directory Spawned From Office Application	Execution	T1204.002	7
Windows: Suspicious Cobalt Strike DNS Beaconing	Command And Control	T1071.004	9
Windows: Suspicious Csi.exe Usage	Execution	T1072	5
Windows: Suspicious Double Extension File Execution	Initial Access	T1566.001	9
Windows: Suspicious Encoded PowerShell Command Line	Execution	T1059.001	7
Windows: Suspicious Execution of Powershell with Base64	Execution	T1059.001	5
Windows: Suspicious File Characteristics Due to Missing Fields	Execution	T1059.006	5
Windows: Suspicious File Execution From Internet Hosted WebDav Share	Execution	T1059.001	7
Windows: Suspicious HH.EXE Execution	Initial Access	T1566.001	7
Windows: Suspicious HWP Sub Processes	Initial Access	T1566.001	7
Windows: Suspicious Microsoft OneNote Child Process	Initial Access	T1566.001	7
Windows: Suspicious Modification Of Scheduled Tasks	Execution	T1053.005	7
Windows: Suspicious Mshta.EXE Execution Patterns	Execution	T1106	7
Windows: Suspicious Outlook Child Process	Execution	T1204.002	7
Windows: Suspicious PowerShell Download and Execute Pattern	Execution	T1059.001	7
Windows: Suspicious PowerShell Encoded Command Patterns	Execution	T1059.001	7
Windows: Suspicious PowerShell Invocation From Script Engines	Execution	T1059.001	5
Windows: Suspicious PowerShell Parameter Substring	Execution	T1059.001	7
Windows: Suspicious PowerShell Parent Process	Execution	T1059.001	7
Windows: Suspicious Process Created Via Wmic.EXE	Execution	T1047	7
Windows: Suspicious Processes Spawned by WinRM	Initial Access	T1190	7
Windows: Suspicious Reg Add BitLocker	Impact	T1486	7
Windows: Suspicious Scheduled Task Creation	Execution	T1053.005	7
Windows: Suspicious Scheduled Task Creation Involving Temp Folder	Execution	T1053.005	7
Windows: Suspicious Scheduled Task Creation via Masqueraded XML File	Execution	T1053.005	5
Windows: Suspicious Scheduled Task Name As GUID	Execution	T1053.005	5
Windows: Suspicious Scheduled Task Update	Execution	T1053.005	7
Windows: Suspicious Schtasks From Env Var Folder	Execution	T1053.005	7
Windows: Suspicious Schtasks Schedule Type With High Privileges	Execution	T1053.005	5
Windows: Suspicious Schtasks Schedule Types	Execution	T1053.005	7
Windows: Suspicious Volume Shadow Copy VSS-PS.dll Load	Impact	T1490	7
Windows: Suspicious Volume Shadow Copy Vssapi.dll Load	Impact	T1490	7
Windows: Suspicious Volume Shadow Copy Vsstrace.dll Load	Impact	T1490	7
Windows: Suspicious WSMAN Provider Image Loads	Execution	T1059.001	5
Windows: T1047 Wmiprvse Wbemcomn DLL Hijack	Execution	T1047	7
Windows: Unusual Child Process of dns.exe	Initial Access	T1133	7
Windows: Usage Of Web Request Commands And Cmdlets	Execution	T1059.001	5
Windows: Use Radmin Viewer Utility	Execution	T1072	7
Windows: VBA DLL Loaded Via Office Application	Execution	T1204.002	7
Windows: VHD Image Download Via Browser	Resource Development	T1587.001	5
Windows: WMIC Remote Command Execution	Execution	T1047	5
Windows: WinDbg/CDB LOLBIN Usage	Execution	T1106	5
Windows: Windows Registry Trust Record Modification	Initial Access	T1566.001	5
Windows: Windows Shell/Scripting Processes Spawning Suspicious Programs	Execution	T1059.005	7
Windows: WmiPrvSE Spawned A Process	Execution	T1047	5
Windows: Wmiexec Default Output File	Execution	T1047	9
Windows: Wmiprvse Wbemcomn DLL Hijack: Sysmon	Execution	T1047	9
Windows: Wmiprvse Wbemcomn DLL Hijack: Sysmon V2	Execution	T1047	7

Suspicious Logon

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Logon Time Restriction Violation	Credential Access	T1110.001	8
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
AWS Management Console Root Login	Initial Access	T1078.004	9
AWS Root Login Without MFA	Initial Access	T1078.004	10
Attack Kill Chain Completion	Suspicious Activity	none	9
Disabled Windows Account Logon Attempts	Credential Access	T1110.001	9
Failed Account Activity On Prior Disabled Account	Credential Access	T1110.001	8
Microsoft Entra: Identity Protection Risky User Identified	Resource Development	T1586.002	9
Office365: Abnormal Logon Detected	Resource Development	T1586.002	9
Office365: Identity Protection Risky Detection Identified	Resource Development	T1586.002	9
Privileged Command Execution Failure	Privilege Escalation	T1548.002	9
Successful Account Activity On a Prior Disabled Account	Credential Access	T1110.001	8
Successful Windows Dormant Account Logon	Credential Access	T1110.001	9
Sudden Increase in Failed Logons To A Host	Initial Access	T1078.003	7
Sudden Increase in Successful Logons To A Host	Initial Access	T1078.003	7
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Suspicious Database Logon	Initial Access	T1078.003	7
Suspicious logon attempt	Credential Access	T1110.001	9
Transient Windows Account Usage	Suspicious Activity	none	9
Transient Windows Account Usage - Scheduled	Persistence	T1098.001	9
UEBA AI detects unusual host logon	UEBA	T1078.003	7
UEBA AI detects unusual user logoff	UEBA	none	7
Uncommon AWS Console Login	Initial Access	T1078.004	7
Uncommon Azure Portal Login	Initial Access	T1078.004	7
Uncommon GSuite Login	Initial Access	T1078.004	7
Uncommon Office365 Mail Login	Initial Access	T1078.004	7
Uncommon VPN Login	Initial Access	T1078.002	7
Uncommon Windows Server Login	Initial Access	T1078.002	7
Windows: Account Tampering - Suspicious Failed Logon Reasons	Persistence	none	5
Windows: Admin User Remote Logon	Defense Evasion	T1078.003	3
Windows: Denied Access To Remote Desktop	Lateral Movement	T1021.001	5
Windows: Login with WMI	Execution	T1047	3
Windows: RDP Login from Localhost	Lateral Movement	T1021.001	7

Suspicious Logon Attempt

Name	Tactic	Technique	Severity
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Suspicious Persistence Activity

Name	Tactic	Technique	Severity
AWS SecHub: Tactics: Persistence Detected	Persistence	none	9
Azure Privilege Identity Management Role Modified	Persistence	T1098.001	7
Common Windows process launched by unusual parent	Persistence	T1037.001	8
Common Windows process launched from unusual path	Persistence	T1037.001	8
Compromised Host Detected by Network IPS	Persistence	none	9
Crowdstrike: Establish Persistence	Persistence	none	8
Crowdstrike: Excessive suspicious activity on a host	Persistence	none	8
Crowdstrike: Exploit Pivot	Persistence	none	8
Crowdstrike: Machine Learning Anomaly Detected	Persistence	none	8
Crowdstrike: Malicious Document Detected	Persistence	none	8
Crowdstrike: Server Compromise Likely	Persistence	none	9
Crowdstrike: Suspicious Activity	Persistence	none	8
Crowdstrike: Suspicious Processes Terminated	Persistence	none	6
Cylance High Severity Threat	Persistence	none	9
Cylance Low Severity Threat	Persistence	none	3
Cylance Medium Severity Threat	Persistence	none	7
Google Workspace: API Access Permitted for OAUTH Client	Persistence	T1098.001	7
Linux: Potential Shell via Web Server	Persistence	T1505.003	7
MS 365 Defender: Persistence Detected	Persistence	none	8
MS 365 Defender: Suspicious Activity Detected	Persistence	none	7
MS 365 Defender: Suspicious Task Scheduler activity - Persistence Alert	Persistence	T1053.002	9
MS 365 Defender: Unwanted Software Detected	Persistence	none	7
Windows: A Member Was Removed From a Security-Enabled Global Group	Persistence	none	3
Windows: AADInternals PowerShell Cmdlets Execution - ProccessCreation	Persistence	none	7
Windows: ADCS Certificate Template Configuration Vulnerability	Persistence	none	3
Windows: ADCS Certificate Template Configuration Vulnerability with Risky EKU	Persistence	none	7
Windows: AWL Bypass with Winrm.vbs and WsmPty.xsl/WsmTxt.xsl: Sysmon	Persistence	none	5
Windows: AWL Bypass with Winrm.vbs and WsmPty.xsl/WsmTxt.xsl: Sysmon2	Persistence	none	5
Windows: Abused Debug Privilege by Arbitrary Parent Processes	Persistence	none	7
Windows: Abusing IEExec To Download Payloads	Persistence	none	7
Windows: Abusing Print Executable	Persistence	none	5
Windows: Active Directory Structure Export Via Csvde.EXE	Persistence	none	5
Windows: Active Directory Structure Export Via Ldifde.EXE	Persistence	none	5
Windows: Active Directory User Backdoors	Persistence	none	7
Windows: Add Insecure Download Source To Winget	Persistence	none	7
Windows: Add New Download Source To Winget	Persistence	none	5
Windows: Add Potential Suspicious New Download Source To Winget	Persistence	none	7
Windows: Add User to Local Administrators Group	Persistence	none	5
Windows: Add Windows Capability Via PowerShell Cmdlet	Persistence	none	5
Windows: Add or Remove Computer from DC	Persistence	none	3
Windows: AgentExecutor PowerShell Execution	Persistence	none	5
Windows: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE	Persistence	T1543.003	7
Windows: Anydesk Remote Access Software Service Installation	Persistence	none	5
Windows: Application Whitelisting Bypass via Dxcap.exe	Persistence	none	5
Windows: Application Whitelisting Bypass via PresentationHost.exe	Persistence	none	5
Windows: Arbitrary Binary Execution Using GUP Utility	Persistence	none	5
Windows: Arbitrary File Download Via MSPUB.EXE	Persistence	none	5
Windows: Arbitrary MSI Download Via Devinit.EXE	Persistence	none	5
Windows: Atbroker Registry Change	Persistence	none	5
Windows: Base64 MZ Header In CommandLine	Persistence	none	7
Windows: Capture Credentials with Rpcping.exe	Persistence	none	5
Windows: Certificate Exported Via Certutil.EXE	Persistence	none	5
Windows: Change Default File Association To Executable Via Assoc	Persistence	T1546.001	7
Windows: Change Default File Association Via Assoc	Persistence	T1546.001	3
Windows: Chopper Webshell Process Pattern	Persistence	T1505.003	7
Windows: Code Integrity Attempted DLL Load	Persistence	none	7
Windows: Code Integrity Blocked Driver Load	Persistence	none	7
Windows: Console CodePage Lookup Via CHCP	Persistence	none	5
Windows: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE	Persistence	none	7
Windows: Created Files by Microsoft Sync Center	Persistence	none	5
Windows: Creation Exe for Service with Unquoted Path	Persistence	T1547.009	7
Windows: Creation of a Diagcab	Persistence	none	5
Windows: Creation of a Local Hidden User Account by Registry	Persistence	T1136.001	7
Windows: DLL Execution Via Register-cimprovider.exe	Persistence	none	5
Windows: DLL Execution via Rasautou.exe	Persistence	none	5
Windows: DLL Load By System Process From Suspicious Locations	Persistence	none	7
Windows: DLL Load via LSASS	Persistence	T1547.008	7
Windows: DLL Loaded via CertOC.EXE	Persistence	none	5
Windows: DNS HybridConnectionManager Service Bus	Persistence	T1554	7
Windows: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE	Persistence	T1543.003	7
Windows: Deployment AppX Package Was Blocked By AppLocker	Persistence	none	5
Windows: Deployment Of The AppX Package Was Blocked By The Policy	Persistence	none	5
Windows: Detected Windows Software Discovery	Persistence	none	5
Windows: Detecting Fake Instances Of Hxtsr.exe	Persistence	none	5
Windows: Device Installation Blocked	Persistence	none	5
Windows: DeviceCredentialDeployment Execution	Persistence	none	5
Windows: Devtoolslauncher.exe Executes Specified Binary	Persistence	none	7
Windows: DiagTrackEoP Default Login Username	Persistence	none	9
Windows: Direct Autorun Keys Modification	Persistence	T1547.001	5
Windows: Dllhost.EXE Execution Anomaly	Persistence	none	7
Windows: DotNet CLR DLL Loaded By Scripting Applications	Persistence	none	7
Windows: Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN	Persistence	none	5
Windows: Download Arbitrary Files Via MSOHTMED.EXE	Persistence	none	5
Windows: Download Arbitrary Files Via PresentationHost.exe	Persistence	none	5
Windows: DriverQuery.EXE Execution	Persistence	none	5
Windows: Drop Binaries Into Spool Drivers Color Folder	Persistence	none	5
Windows: Dump Ntds.dit To Suspicious Location	Persistence	none	5
Windows: DumpStack.log Defender Evasion	Persistence	none	9
Windows: ETW Logging Tamper In .NET Processes	Persistence	none	7
Windows: Email Exifiltration Via Powershell	Persistence	none	7
Windows: Enabled User Right in AD to Control User Objects	Persistence	none	7
Windows: Execute Files with Msdeploy.exe	Persistence	none	5
Windows: Execute MSDT Via Answer File	Persistence	none	7
Windows: Execute Pcwrun.EXE To Leverage Follina	Persistence	none	7
Windows: Execution Of Non-Existing File	Persistence	none	7
Windows: Execution from Suspicious Folder	Persistence	none	7
Windows: Execution of Powershell Script in Public Folder	Persistence	none	7
Windows: Execution of Suspicious File Type Extension	Persistence	none	7
Windows: Execution via WorkFolders.exe	Persistence	none	7
Windows: Execution via stordiag.exe	Persistence	none	7
Windows: Explorer Process Tree Break	Persistence	none	5
Windows: Failed MSExchange Transport Agent Installation	Persistence	T1505.002	7
Windows: File Creation In Suspicious Directory By Msdt.EXE	Persistence	T1547.001	7
Windows: File Decoded From Base64/Hex Via Certutil.EXE	Persistence	none	5
Windows: File Download Using ProtocolHandler.exe	Persistence	none	5
Windows: File Encoded To Base64 Via Certutil.EXE	Persistence	none	5
Windows: Format.com FileSystem LOLBIN	Persistence	none	7
Windows: Fsutil Behavior Set SymlinkEvaluation	Persistence	none	5
Windows: Fsutil Suspicious Invocation	Persistence	none	7
Windows: GatherNetworkInfo.VBS Reconnaissance Script Output	Persistence	none	5
Windows: Gpresult Display Group Policy Information	Persistence	none	5
Windows: Gpscript Execution	Persistence	none	5
Windows: Gzip Archive Decode Via PowerShell	Persistence	none	5
Windows: Hidden Local User Creation	Persistence	T1136.001	7
Windows: HybridConnectionManager Service Installation	Persistence	T1554	7
Windows: HybridConnectionManager Service Installation: Sysmon	Persistence	none	7
Windows: IIS Native-Code Module Command Line Installation	Persistence	T1505.003	5
Windows: ISO or Image Mount Indicator in Recent Files	Persistence	none	5
Windows: Ie4uinit Lolbin Use From Invalid Path	Persistence	none	5
Windows: ImagingDevices Unusual Parent/Child Processes	Persistence	none	7
Windows: Important Windows Service Terminated Unexpectedly	Persistence	none	7
Windows: Important Windows Service Terminated With Error	Persistence	none	7
Windows: Indirect Command Execution By Program Compatibility Wizard	Persistence	none	3
Windows: InfDefaultInstall.exe .inf Execution	Persistence	none	5
Windows: Install New Package Via Winget Local Manifest	Persistence	none	5
Windows: KDC RC4-HMAC Downgrade CVE-2022-37966	Persistence	none	7
Windows: Kavremover Dropped Binary LOLBIN Usage	Persistence	none	7
Windows: KrbRelayUp Service Installation	Persistence	none	7
Windows: LOLBAS Data Exfiltration by DataSvcUtil.exe	Persistence	none	5
Windows: Legitimate Application Dropped Archive	Persistence	none	7
Windows: Legitimate Application Dropped Executable	Persistence	none	7
Windows: Legitimate Application Dropped Script	Persistence	none	7
Windows: Loading Diagcab Package From Remote Path	Persistence	none	7
Windows: Locked Workstation	Persistence	none	3
Windows: Lolbin Defaultpack.exe Use As Proxy	Persistence	none	5
Windows: Lolbin Runexehelper Use As Proxy	Persistence	none	5
Windows: Lolbin Unregmp2.exe Use As Proxy	Persistence	none	5
Windows: MSExchange Transport Agent Installation	Persistence	T1505.002	5
Windows: MSI Installation From Suspicious Locations	Persistence	none	5
Windows: MSSQL Add Account To Sysadmin Role	Persistence	none	7
Windows: MSSQL SPProcoption Set	Persistence	none	7
Windows: MSSQL XPCmdshell Option Change	Persistence	none	7
Windows: MSSQL XPCmdshell Suspicious Execution	Persistence	none	7
Windows: Malicious PE Execution by Microsoft Visual Studio Debugger	Persistence	none	5
Windows: Malicious Windows Script Components File Execution by TAEF Detection	Persistence	none	3
Windows: Manage Engine Java Suspicious Sub Process	Persistence	none	7
Windows: Microsoft IIS Connection Strings Decryption	Persistence	none	7
Windows: Microsoft Sync Center Suspicious Network Connections	Persistence	none	5
Windows: Mimikatz Kirbi File Creation	Persistence	none	9
Windows: Moriya Rootkit: System Log	Persistence	T1543.003	9
Windows: MpiExec Lolbin	Persistence	none	7
Windows: Mshtml DLL RunHTMLApplication Abuse	Persistence	none	7
Windows: Narrator s Feedback-Hub Persistence	Persistence	T1547.001	7
Windows: NetSupport Manager Service Install	Persistence	none	5
Windows: New ActiveScriptEventConsumer Created Via Wmic.EXE	Persistence	T1546.003	7
Windows: New DLL Added to AppCertDlls Registry Key	Persistence	T1546.009	5
Windows: New DLL Added to AppInit-DLLs Registry Key	Persistence	T1546.010	5
Windows: New Kernel Driver Via SC.EXE	Persistence	T1543.003	5
Windows: New PDQDeploy Service - Client Side	Persistence	T1543.003	5
Windows: New PDQDeploy Service - Server Side	Persistence	T1543.003	5
Windows: New Service Creation Using PowerShell	Persistence	T1543.003	3
Windows: New Service Creation Using Sc.EXE	Persistence	T1543.003	3
Windows: New Shim Database Created in the Default Directory	Persistence	T1547.009	5
Windows: New User Created Via Net.EXE With Never Expire Option	Persistence	T1136.001	7
Windows: Ngrok Usage with Remote Desktop Service	Persistence	none	7
Windows: Nslookup PowerShell Download Cradle - ProcessCreation	Persistence	none	5
Windows: Ntdsutil Abuse	Persistence	none	5
Windows: Office Application Startup - Office Test	Persistence	T1137.002	5
Windows: OneNote Attachment File Dropped In Suspicious Location	Persistence	none	5
Windows: OpenWith.exe Executes Specified Binary	Persistence	none	7
Windows: Outgoing Logon with New Credentials	Persistence	none	3
Windows: PCRE.NET Package Image Load	Persistence	none	7
Windows: PCRE.NET Package Temp Files	Persistence	none	7
Windows: PUA - AdvancedRun Execution	Persistence	none	5
Windows: PUA - AdvancedRun Suspicious Execution	Persistence	none	7
Windows: PUA - Fast Reverse Proxy FRP Execution	Persistence	none	7
Windows: PUA - NPS Tunneling Tool Execution	Persistence	none	7
Windows: PUA - System Informer Driver Load	Persistence	none	5
Windows: PUA - System Informer Execution	Persistence	none	5
Windows: PUA - Wsudo Suspicious Execution	Persistence	none	7
Windows: PUA- IOX Tunneling Tool Execution	Persistence	none	7
Windows: Parent in Public Folder Suspicious Process	Persistence	none	7
Windows: Password Change on Directory Service Restore Mode DSRM Account	Persistence	T1098.003	7
Windows: Password Protected ZIP File Opened	Persistence	none	5
Windows: Password Protected ZIP File Opened Email Attachment	Persistence	none	7
Windows: Password Protected ZIP File Opened Suspicious Filenames	Persistence	none	7
Windows: Password Provided In Command Line Of Net.EXE	Persistence	none	5
Windows: Path To Screensaver Binary Modified	Persistence	T1546.002	5
Windows: Perl Inline Command Execution	Persistence	none	5
Windows: Persistence Via Sticky Key Backdoor	Persistence	T1546.008	9
Windows: Persistence Via TypedPaths - CommandLine	Persistence	none	5
Windows: Phishing Pattern ISO in Archive	Persistence	none	7
Windows: Php Inline Command Execution	Persistence	none	5
Windows: PortProxy Registry Key	Persistence	none	5
Windows: Possible Shadow Credentials Added	Persistence	none	7
Windows: Possible Shim Database Persistence via sdbinst.exe	Persistence	T1546.011	7
Windows: Potential Active Directory Enumeration Using AD Module - ProcCreation	Persistence	none	5
Windows: Potential Arbitrary Code Execution Via Node.EXE	Persistence	none	7
Windows: Potential Binary Or Script Dropper Via PowerShell	Persistence	none	5
Windows: Potential COM Objects Download Cradles Usage - Process Creation	Persistence	none	5
Windows: Potential Cobalt Strike Process Patterns	Persistence	none	7
Windows: Potential Command Line Path Traversal Evasion Attempt	Persistence	none	5
Windows: Potential Credential Dumping Attempt Using New NetworkProvider - CLI	Persistence	none	7
Windows: Potential DLL File Download Via PowerShell Invoke-WebRequest	Persistence	none	5
Windows: Potential DLL Sideloading Using Coregen.exe	Persistence	none	5
Windows: Potential Discovery Activity Via Dnscmd.EXE	Persistence	T1543.003	5
Windows: Potential Malicious AppX Package Installation Attempts	Persistence	none	5
Windows: Potential Manage-bde.wsf Abuse To Proxy Execution	Persistence	none	7
Windows: Potential NTLM Coercion Via Certutil.EXE	Persistence	none	7
Windows: Potential Password Spraying Attempt Using Dsacls.EXE	Persistence	none	5
Windows: Potential Persistence Attempt Via ErrorHandler.Cmd	Persistence	none	5
Windows: Potential Persistence Via Microsoft Office Add-In	Persistence	T1137.006	7
Windows: Potential Persistence Via Netsh Helper DLL	Persistence	T1546.007	7
Windows: Potential Persistence Via Notepad Plugins	Persistence	none	5
Windows: Potential Persistence Via Outlook Form	Persistence	T1137.003	7
Windows: Potential PowerShell Execution Policy Tampering - ProcCreation	Persistence	none	7
Windows: Potential Privilege Escalation Attempt Via .Exe.Local Technique	Persistence	none	7
Windows: Potential Privilege Escalation Using Symlink Between Osk and Cmd	Persistence	T1546.008	7
Windows: Potential Process Injection Via Msra.EXE	Persistence	none	7
Windows: Potential RDP Session Hijacking Activity	Persistence	none	5
Windows: Potential Recon Activity Using DriverQuery.EXE	Persistence	none	7
Windows: Potential Remote Credential Dumping Activity	Persistence	none	7
Windows: Potential Remote Desktop Tunneling	Persistence	none	5
Windows: Potential Renamed Rundll32 Execution	Persistence	none	7
Windows: Potential RipZip Attack on Startup Folder	Persistence	none	7
Windows: Potential Signing Bypass Via Windows Developer Features	Persistence	none	7
Windows: Potential Suspicious Mofcomp Execution	Persistence	none	7
Windows: Potential Suspicious PowerShell Module File Created	Persistence	none	5
Windows: Potential Suspicious Windows Feature Enabled - ProcCreation	Persistence	none	5
Windows: Potential Windows Defender Tampering Via Wmic.EXE	Persistence	T1546.008	7
Windows: Potential Winnti Dropper Activity	Persistence	none	7
Windows: Potentially Over Permissive Permissions Granted Using Dsacls.EXE	Persistence	none	5
Windows: Potentially Suspicious GoogleUpdate Child Process	Persistence	none	7
Windows: Potentially Suspicious Network Connection To Notion API	Persistence	none	3
Windows: PowerShell Download and Execution Cradles	Persistence	none	7
Windows: PowerShell Module File Created	Persistence	none	3
Windows: PowerShell Module File Created By Non-PowerShell Process	Persistence	none	5
Windows: PowerShell Profile Modification	Persistence	T1546.013	7
Windows: PowerShell Script Dropped Via PowerShell.EXE	Persistence	none	3
Windows: PowerShell Web Download	Persistence	none	5
Windows: PowerShell Writing Startup Shortcuts	Persistence	T1547.001	7
Windows: Powershell Inline Execution From A File	Persistence	none	5
Windows: Powerview Add-DomainObjectAcl DCSync AD Extend Right	Persistence	none	7
Windows: PrinterNightmare Mimimkatz Driver Name	Persistence	none	9
Windows: Privilege Escalation via Named Pipe Impersonation	Persistence	none	7
Windows: Process Creation Using Sysnative Folder	Persistence	none	5
Windows: Process Memory Dump Via Dotnet-Dump	Persistence	none	5
Windows: Proxy Execution via Wuauclt	Persistence	none	7
Windows: Psexec Execution	Persistence	none	5
Windows: Publisher Attachment File Dropped In Suspicious Location	Persistence	none	5
Windows: Python Inline Command Execution	Persistence	none	5
Windows: Python Spawning Pretty TTY on Windows	Persistence	none	7
Windows: Query Usage To Exfil Data	Persistence	none	5
Windows: RDP File Creation From Suspicious Application	Persistence	none	7
Windows: REGISTER-APP.VBS Proxy Execution	Persistence	none	5
Windows: RTCore Suspicious Service Installation	Persistence	none	7
Windows: Reg Add RUN Key	Persistence	T1547.001	5
Windows: Regedit as Trusted Installer	Persistence	none	7
Windows: Registry Persistence Mechanisms in Recycle Bin	Persistence	none	7
Windows: Remote Access Tool - NetSupport Execution From Unusual Location	Persistence	none	5
Windows: Remote Access Tool - RURAT Execution From Unusual Location	Persistence	none	5
Windows: Remote Code Execute via Winrm.vbs	Persistence	none	5
Windows: Remote Utilities Host Service Install	Persistence	none	5
Windows: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses	Persistence	none	7
Windows: Renamed AutoHotkey.EXE Execution	Persistence	none	5
Windows: Renamed MegaSync Execution	Persistence	none	7
Windows: Renamed NetSupport RAT Execution	Persistence	none	7
Windows: Renamed Office Binary Execution	Persistence	none	7
Windows: Renamed Plink Execution	Persistence	none	7
Windows: Renamed Remote Utilities RAT RURAT Execution	Persistence	none	5
Windows: Replay Attack Detected	Persistence	none	7
Windows: Ruby Inline Command Execution	Persistence	none	5
Windows: Run PowerShell Script from Redirected Input Stream	Persistence	none	7
Windows: Rundll32 Registered COM Objects	Persistence	T1546.015	7
Windows: Rundll32 With Suspicious Parent Process	Persistence	none	5
Windows: SCM Database Privileged Operation	Persistence	none	5
Windows: Script Interpreter Execution From Suspicious Folder	Persistence	none	7
Windows: Sdiagnhost Calling Suspicious Child Process	Persistence	none	7
Windows: Security Support Provider SSP Added to LSA Configuration	Persistence	T1547.005	9
Windows: Service Installation in Suspicious Folder	Persistence	T1543.003	5
Windows: Service Installation with Suspicious Folder Pattern	Persistence	T1543.003	7
Windows: Service Installed By Unusual Client - Security	Persistence	none	7
Windows: Service Installed By Unusual Client - System	Persistence	none	7
Windows: Shells Spawned by Java	Persistence	none	5
Windows: Shells Spawned by Web Servers	Persistence	T1505.003	7
Windows: Standard User In High Privileged Group	Persistence	none	5
Windows: Startup Folder File Write	Persistence	T1547.001	5
Windows: Sticky Key Like Backdoor Execution	Persistence	T1546.008	9
Windows: Sticky Key Like Backdoor Usage - Registry	Persistence	T1546.008	9
Windows: Suspect Svchost Activity	Persistence	none	7
Windows: Suspicious ASPX File Drop by Exchange	Persistence	T1505.003	7
Windows: Suspicious Add User to Remote Desktop Users Group	Persistence	T1136.001	7
Windows: Suspicious AgentExecutor PowerShell Execution	Persistence	none	7
Windows: Suspicious AppX Package Installation Attempt	Persistence	none	5
Windows: Suspicious AppX Package Locations	Persistence	none	7
Windows: Suspicious Application Installed	Persistence	none	5
Windows: Suspicious CMD Shell Output Redirect	Persistence	none	5
Windows: Suspicious Cabinet File Expansion	Persistence	none	5
Windows: Suspicious Calculator Usage	Persistence	none	7
Windows: Suspicious Child Process Of SQL Server	Persistence	T1505.003	7
Windows: Suspicious Child Process Of Veeam Dabatase	Persistence	none	9
Windows: Suspicious Chromium Browser Instance Executed With Custom Extensions	Persistence	T1176	7
Windows: Suspicious CodePage Switch Via CHCP	Persistence	none	5
Windows: Suspicious ConfigSecurityPolicy Execution	Persistence	none	5
Windows: Suspicious Creation with Colorcpl	Persistence	none	7
Windows: Suspicious CustomShellHost Execution	Persistence	none	5
Windows: Suspicious DLL Loaded via CertOC.EXE	Persistence	none	7
Windows: Suspicious DNS Query for IP Lookup Service APIs	Persistence	none	5
Windows: Suspicious Debugger Registration Cmdline	Persistence	T1546.008	7
Windows: Suspicious Digital Signature Of AppX Package	Persistence	none	5
Windows: Suspicious DotNET CLR Usage Log Artifact	Persistence	none	7
Windows: Suspicious Double Extension Files	Persistence	none	7
Windows: Suspicious Download Via Certutil.EXE	Persistence	none	5
Windows: Suspicious Download from Office Domain	Persistence	none	7
Windows: Suspicious Driver Install by pnputil.exe	Persistence	none	5
Windows: Suspicious Driver Load from Temp	Persistence	T1543.003	5
Windows: Suspicious Dropbox API Usage	Persistence	none	7
Windows: Suspicious Electron Application Child Processes	Persistence	none	5
Windows: Suspicious Executable File Creation	Persistence	none	7
Windows: Suspicious Execution Of PDQDeployRunner	Persistence	none	5
Windows: Suspicious Execution of InstallUtil To Download	Persistence	none	5
Windows: Suspicious Execution of InstallUtil Without Log	Persistence	none	5
Windows: Suspicious File Created In PerfLogs	Persistence	none	5
Windows: Suspicious File Created Via OneNote Application	Persistence	none	7
Windows: Suspicious File Download From File Sharing Domain Via Curl.EXE	Persistence	none	7
Windows: Suspicious File Downloaded From Direct IP Via Certutil.EXE	Persistence	none	7
Windows: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE	Persistence	none	7
Windows: Suspicious File Drop by Exchange	Persistence	T1505.003	5
Windows: Suspicious FromBase64String Usage On Gzip Archive - Process Creation	Persistence	none	5
Windows: Suspicious Get-Variable.exe Creation	Persistence	none	7
Windows: Suspicious Git Clone	Persistence	none	5
Windows: Suspicious Greedy Compression Using Rar.EXE	Persistence	none	7
Windows: Suspicious GrpConv Execution	Persistence	none	7
Windows: Suspicious IIS Module Registration	Persistence	none	7
Windows: Suspicious IIS URL GlobalRules Rewrite Via AppCmd	Persistence	none	5
Windows: Suspicious Interactive PowerShell as SYSTEM	Persistence	none	7
Windows: Suspicious Kernel Dump Using Dtrace	Persistence	none	7
Windows: Suspicious LNK Double Extension File	Persistence	none	5
Windows: Suspicious MSDT Parent Process	Persistence	none	7
Windows: Suspicious MSExchangeMailboxReplication ASPX Write	Persistence	T1505.003	7
Windows: Suspicious Network Command	Persistence	none	3
Windows: Suspicious Network Connection Binary No CommandLine	Persistence	none	7
Windows: Suspicious Network Connection to IP Lookup Service APIs	Persistence	none	5
Windows: Suspicious New Service Creation	Persistence	T1543.003	7
Windows: Suspicious Non-Browser Network Communication With Google API	Persistence	none	5
Windows: Suspicious Ntdll Pipe Redirection	Persistence	none	7
Windows: Suspicious Parent Double Extension File Execution	Persistence	none	7
Windows: Suspicious PowerShell IEX Execution Patterns	Persistence	none	7
Windows: Suspicious PowerShell Invocations - Specific - ProcessCreation	Persistence	none	5
Windows: Suspicious PowerShell Mailbox Export to Share	Persistence	none	9
Windows: Suspicious Powercfg Execution To Change Lock Screen Timeout	Persistence	none	5
Windows: Suspicious Process Parents	Persistence	none	7
Windows: Suspicious Process Start Locations	Persistence	none	5
Windows: Suspicious Program Names	Persistence	none	7
Windows: Suspicious RASdial Activity	Persistence	none	5
Windows: Suspicious Reg Add Open Command	Persistence	none	5
Windows: Suspicious Remote AppX Package Locations	Persistence	none	7
Windows: Suspicious Remote Logon with Explicit Credentials	Persistence	none	5
Windows: Suspicious Run Key from Download	Persistence	T1547.001	7
Windows: Suspicious RunAs-Like Flag Combination	Persistence	none	5
Windows: Suspicious Rundll32 Invoking Inline VBScript	Persistence	none	7
Windows: Suspicious SYSTEM User Process Creation	Persistence	none	7
Windows: Suspicious Scheduled Task Write to System32 Tasks	Persistence	none	7
Windows: Suspicious ScreenSave Change by Reg.exe	Persistence	T1546.002	5
Windows: Suspicious Screensaver Binary File Creation	Persistence	T1546.002	5
Windows: Suspicious Script Execution From Temp Folder	Persistence	none	7
Windows: Suspicious Serv-U Process Pattern	Persistence	none	7
Windows: Suspicious Service Binary Directory	Persistence	none	7
Windows: Suspicious Service DACL Modification Via Set-Service Cmdlet	Persistence	T1543.003	7
Windows: Suspicious Service Installation	Persistence	T1543.003	7
Windows: Suspicious Service Installation Script	Persistence	T1543.003	7
Windows: Suspicious Service Path Modification	Persistence	T1543.003	7
Windows: Suspicious Shells Spawn by Java Utility Keytool	Persistence	none	7
Windows: Suspicious Shells Spawned by Java	Persistence	none	7
Windows: Suspicious Splwow64 Without Params	Persistence	none	7
Windows: Suspicious Startup Folder Persistence	Persistence	T1547.001	7
Windows: Suspicious SysAidServer Child	Persistence	none	5
Windows: Suspicious Usage Of ShellExec-RunDLL	Persistence	none	7
Windows: Suspicious Usage of CVE-2021-34484 or CVE 2022-21919	Persistence	none	3
Windows: Suspicious Use of CSharp Interactive Console	Persistence	none	7
Windows: Suspicious Userinit Child Process	Persistence	none	5
Windows: Suspicious Vsls-Agent Command With AgentExtensionPath Load	Persistence	none	5
Windows: Suspicious WERMGR Process Patterns	Persistence	none	7
Windows: Suspicious Windows App Activity	Persistence	none	7
Windows: Suspicious Windows Update Agent Empty Cmdline	Persistence	none	7
Windows: Suspicious WindowsTerminal Child Processes	Persistence	none	5
Windows: Suspicious Workstation Locking via Rundll32	Persistence	none	5
Windows: Suspicious X509Enrollment - Process Creation	Persistence	none	5
Windows: Suspicious desktop.ini Action	Persistence	T1547.009	5
Windows: SyncAppvPublishingServer Execute Arbitrary PowerShell Code	Persistence	none	5
Windows: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code	Persistence	none	5
Windows: Sysinternals PsSuspend Execution	Persistence	T1543.003	5
Windows: Sysinternals Tools AppX Versions Execution	Persistence	none	5
Windows: Sysmon Blocked Executable	Persistence	none	7
Windows: Sysmon Configuration Change	Persistence	none	5
Windows: Sysmon Crash	Persistence	none	7
Windows: Sysprep on AppData Folder	Persistence	none	5
Windows: System File Execution Location Anomaly	Persistence	none	7
Windows: Tap Driver Installation	Persistence	none	5
Windows: Tap Installer Execution	Persistence	none	5
Windows: Taskmgr as LOCAL-SYSTEM	Persistence	none	7
Windows: Taskmgr as Parent	Persistence	none	3
Windows: UAC Bypass Using Event Viewer RecentViews	Persistence	none	7
Windows: UAC Bypass Using EventVwr	Persistence	none	7
Windows: UAC Bypass via Windows Firewall Snap-In Hijack	Persistence	none	5
Windows: Unsigned AppX Installation Attempt Using Add-AppxPackage	Persistence	none	5
Windows: Unusual Parent Process For Cmd.EXE	Persistence	none	5
Windows: Use Of The SFTP.EXE Binary As A LOLBIN	Persistence	none	5
Windows: Use of Forfiles For Execution	Persistence	none	5
Windows: Use of OpenConsole	Persistence	none	5
Windows: Use of Pcalua For Execution	Persistence	none	5
Windows: Use of Remote.exe	Persistence	none	5
Windows: Use of Scriptrunner.exe	Persistence	none	5
Windows: Use of Squirrel.exe	Persistence	none	5
Windows: Use of Sysinternals PsService	Persistence	T1543.003	5
Windows: Use of TTDInject.exe	Persistence	none	5
Windows: Use of VSIISExeLauncher.exe	Persistence	none	5
Windows: Use of VisualUiaVerifyNative.exe	Persistence	none	5
Windows: Use of Wfc.exe	Persistence	none	5
Windows: UtilityFunctions.ps1 Proxy Dll	Persistence	none	5
Windows: VMToolsd Suspicious Child Process	Persistence	none	7
Windows: Verclsid.exe Runs COM Object	Persistence	none	5
Windows: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution	Persistence	none	5
Windows: Visual Studio NodejsTools PressAnyKey Renamed Execution	Persistence	none	5
Windows: VsCode Powershell Profile Modification	Persistence	T1546.013	5
Windows: Vulnerable Netlogon Secure Channel Connection Allowed	Persistence	none	7
Windows: Vulnerable WinRing0 Driver Load	Persistence	T1543.003	7
Windows: WINEKEY Registry Modification	Persistence	none	7
Windows: WMI Backdoor Exchange Transport Agent	Persistence	T1546.003	9
Windows: WMI Event Subscription	Persistence	T1546.003	7
Windows: WMI Persistence - Command Line Event Consumer	Persistence	T1546.003	7
Windows: WMI Persistence - Script Event Consumer	Persistence	T1546.003	5
Windows: WMI Persistence - Script Event Consumer File Write	Persistence	T1546.003	7
Windows: WMI Persistence - Security	Persistence	T1546.003	5
Windows: WMI Script Host Process Image Loaded	Persistence	T1546.003	7
Windows: WScript or CScript Dropper: Sysmon V1	Persistence	none	7
Windows: Wab Execution From Non Default Location	Persistence	none	7
Windows: Wab/Wabmig Unusual Parent Or Child Processes	Persistence	none	7
Windows: Weak or Abused Passwords In CLI	Persistence	none	5
Windows: Webshell Detection With Command Line Keywords	Persistence	T1505.003	7
Windows: Webshell Recon Detection Via CommandLine Processes	Persistence	T1505.003	7
Windows: WinSxS Executable File Creation By Non-System Process	Persistence	none	5
Windows: Windows Binaries Write Suspicious Extensions	Persistence	none	7
Windows: Windows Network Access Suspicious desktop.ini Action	Persistence	T1547.009	5
Windows: Windows Service Terminated With Error	Persistence	none	3
Windows: Windows Shell/Scripting Application File Write to Suspicious Folder	Persistence	none	7
Windows: Windows Spooler Service Suspicious Binary Load	Persistence	none	1
Windows: Windows Update Error	Persistence	none	3
Windows: Wlrmdr Lolbin Use as Launcher	Persistence	none	5
Windows: Writing Local Admin Share	Persistence	T1546.002	5
Windows: Wscript Shell Run In CommandLine	Persistence	none	7
Windows: Wuauclt Network Connection	Persistence	none	5
Windows: Wusa Extracting Cab Files From Suspicious Paths	Persistence	none	7

Suspicious Service

Name	Tactic	Technique	Severity
Windows: Cobalt Strike Service Installations: Security Log	Execution	T1569.002	7
Windows: CobaltStrike Service Installations: System Log	Execution	T1569.002	9
Windows: Metasploit Or Impacket Service Installation Via SMB PsExec	Lateral Movement	T1570	7
Windows: Meterpreter or Cobalt Strike Getsystem Service Installation - System	Defense Evasion	T1134.002	9
Windows: Meterpreter or Cobalt Strike Service Installation: Security Log	Defense Evasion	T1134.002	9
Windows: Potential Meterpreter/CobaltStrike Activity	Defense Evasion	T1134.002	7
Windows: PsExec Service Child Process Execution as LOCAL SYSTEM	Persistence	none	7
Windows: PsExec Service Execution	Persistence	none	5
Windows: PsExec Service File Creation	Execution	T1569.002	3
Windows: Renamed PsExec Service Execution	Persistence	none	7
Windows: Suspicious PsExec Execution	Lateral Movement	T1021.002	7

Systems Config Change

Name	Tactic	Technique	Severity
AWS CloudTrail Important Changes	Defense Evasion	T1562.001	7
AWS CloudTrail Log Created	Collection	T1530	3
AWS CloudTrail Log Setting Updated	Defense Evasion	T1562.008	3
AWS Config Service Tampering	Defense Evasion	T1562.006	7
AWS EC2 Network Access Control List Created	Initial Access	T1078.004	3
AWS EC2 Network Access Control List Deleted	Defense Evasion	T1562.007	9
AWS EC2 Snapshot Attribute Modified	Defense Evasion	T1578.001	5
AWS RDS Cluster Created	Persistence	T1505.003	3
AWS RDS Cluster Deleted	Impact	T1485	5
AWS S3 Bucket Configuration Deleted	Defense Evasion	T1562.008	3
AWS WAF Access Control List Deleted	Defense Evasion	T1562.007	9
AWS WAF Rule or Rule Group Deleted	Defense Evasion	T1562.007	8
ArubaOS-CX: Config Change Detected	Audit	none	7
Azure Automation Account Created	Initial Access	T1078.004	7
Azure Automation Runbook Created or Modified	Persistence	none	3
Azure Automation Runbook Deleted	Defense Evasion	T1562.001	3
Azure Automation Webhook Created	Persistence	none	3
Azure Blob Container Access Level Modification	Initial Access	T1190	7
Azure Conditional Access Policy Modified	Persistence	T1098.001	8
Azure Diagnostic Settings Deleted	Defense Evasion	T1562.008	5
Azure Event Hub Authorization Rule Created or Updated	Initial Access	T1078.004	7
Azure Firewall Policy Deleted	Defense Evasion	T1562.007	9
Azure Key Vault Modified	Credential Access	T1552.001	9
Azure Resource Group Deleted	Impact	T1485	5
Azure Storage Account Key Regenerated	Credential Access	T1528	3
Barracuda WAF: Config Change Detected	Defense Evasion	T1562.004	7
Database DDL changes	Audit	none	7
Difference between Running and Startup Config	Policy Violation	none	7
Failed Checkpoint Firewall Policy Install	Audit	none	8
FortiGate: Config Change Detected	Audit	none	7
GCP: Firewall Rule Created	Defense Evasion	T1562.007	4
GCP: Firewall Rule Deleted	Defense Evasion	T1562.007	8
GCP: Firewall Rule Updated	Defense Evasion	T1562.007	8
GCP: Logging Sink Updated	Defense Evasion	T1562.008	6
GCP: Pub/Sub Subscription Created	Collection	T1119	6
GCP: Pub/Sub Subscription Deleted	Defense Evasion	T1562.008	6
GCP: Pub/Sub Topic Created	Collection	T1119	6
GCP: Pub/Sub Topic Deleted	Defense Evasion	T1562.008	6
GCP: Storage Bucket Updated	Collection	T1530	6
GCP: VPC Network Deleted	Audit	none	9
GCP: VPC Route Added	Audit	none	6
GCP: VPC Route Deleted	Audit	none	6
Google Workspace: Application Added to Domain	Audit	none	9
Google Workspace: Domain added to Trusted Domains List	Audit	none	9
Google Workspace: Password Management Policy Changed	Audit	none	9
High throughput VPN session	Audit	none	7
Linux: Sudoers File Modification	Privilege Escalation	T1548.003	9
Long lasting VPN session	Audit	none	7
Network Installed Software Change	Defense Evasion	T1218.001	6
Office365: Delete Message Inbox Rule Created	Collection	T1114.003	9
Office365: Move To Folder Inbox Rule Created	Collection	T1114.003	6
Office365: Set-Mailbox Forwarding Action Created	Collection	T1114.003	9
Office365: Strong Authentication Disabled for a User	Resource Development	T1586.002	9
Office365: User Mailbox Forwarding Rule Created	Collection	T1114.003	9
Oracle OCI: Customer Secret Key Created	Persistence	T1098.001	9
Oracle OCI: User API Key Created and Uploaded	Persistence	T1098.001	7
Oracle OCI: User Auth Token Created	Persistence	T1098.001	7
Oracle OCI: User OAuth Client Credential Created	Persistence	T1098.001	9
Oracle OCI: User SMTP Credentials Created	Resource Development	T1585.002	7
Palo Alto Config Change Failed	Audit	none	6
Palo Alto Config Change Succeeded	Audit	none	4
Running Config Change	Defense Evasion	T1562.004	6
Running Config Change: with login info	Defense Evasion	T1562.004	6
Self-signed Windows Certificate Added		none	6
Server Installed Software Change	Defense Evasion	T1218.001	6
Startup Config Change	Defense Evasion	T1562.004	6
Startup Config Change: with login	Defense Evasion	T1562.004	6
Successful Checkpoint Firewall Policy Install	Audit	none	7
Unauthorized Palo Alto Firewall Config Change	Audit	none	8
Windows Audit Policy Changed	Defense Evasion	T1562.003	7
Windows: A Rule Has Been Deleted From The Windows Firewall Exception List	Persistence	none	5
Windows: Addition of Domain Trusts	Initial Access	T1199	5
Windows: All Rules Have Been Deleted From The Windows Firewall Configuration	Persistence	none	7
Windows: Firewall Rule Deleted Via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: Important Scheduled Task Deleted/Disabled	Execution	T1053.005	7
Windows: New Firewall Exception Rule Added For A Suspicious Folder	Persistence	none	7
Windows: New Firewall Rule Added In Windows Firewall Exception List	Persistence	none	5
Windows: New Firewall Rule Added Via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: New Port Forwarding Rule Added Via Netsh.EXX	Persistence	none	5
Windows: RDP Port Forwarding Rule Added Via Netsh.EXE	Persistence	none	7
Windows: The Windows Defender Firewall Service Failed To Load Group Policy	Persistence	none	3
Windows: Windows Defender Firewall Has Been Reset To Its Default Configuration	Persistence	none	3
Windows: Windows Firewall Settings Have Been Changed	Persistence	none	3

Traffic Anomaly

Name	Tactic	Technique	Severity
End User DNS Queries to Unauthorized DNS Servers	Command And Control	T1568.001	7
Excessive Denied Connections From An External Country	Impact	T1498.001	7
Excessive Denied DNS Queries	Command And Control	T1568.001	6
Excessive End User DNS Queries	Command And Control	T1568.001	7
Excessive Repeated DNS Queries To Same Domain	Command And Control	T1568.001	6
Invalid TCP/UDP Port Traffic	Command And Control	T1571	9
Large Inbound Transfer From Outside My Country	Command And Control	T1071.001	8
Sudden Change In DNS Data Transfer Pattern From A Specific Host	Command And Control	T1568.001	7
Sudden Increase In DNS Requests From A Specific Host	Command And Control	T1568.001	7
Sudden Increase In Firewall Connections	Impact	T1498.001	7
Traffic to bogon networks	Command and Control	none	8
Unusual ICMP Traffic	Defense Evasion	none	7
Unusually Large ICMP Echo Packets	Command And Control	T1095	9
AWS SecHub: Unusal Network Flow Behavior Detected	Impact	none	8
Blocked File Execution	Execution	none	8
Excessive End User Mail	Collection	T1114.001	8
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6
ICMP Flood From Same Source	Impact	T1498.001	7
Invalid TCP Flags: High Intensity	Discovery	none	9
Invalid TCP Flags: Medium Intensity	Discovery	none	7
Layer 2 Switch Port Security Violation	Suspicious Activity	none	9
P2P traffic consuming high network bandwidth	Policy Violation	none	7
Sudden Increase In Firewall Denied Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Denied Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Permitted Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Permitted Traffic From Host	Impact	T1498.001	7
Sudden Increase In Permitted Traffic To Host	Impact	T1498.001	7
Sudden Increase in Firewall Permitted Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase in ICMP Requests From A Host	Impact	T1498.001	7
Sudden Increase in Inbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Network Interface Errors	Interface	none	7
Sudden Increase in Network Interface Traffic	Impact	T1498.001	7
Sudden Increase in Outbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Server Process Count	Impact	T1499.001	7

Tunneling Activity

Name	Tactic	Technique	Severity
Linux: Potential DNS Tunneling via Iodine	Command And Control	T1071.004	7
Tunneled traffic detected	Command And Control	T1572	7
Windows: Communication To Ngrok Tunneling Service	Command And Control	T1572	7
Windows: DNS Exfiltration and Tunneling Tools Execution	Command And Control	T1048.001,T1071.004,T1132.001	7
Windows: PUA - Chisel Tunneling Tool Execution	Command And Control	T1090.001	7
Windows: Potential RDP Tunneling Via SSH	Command And Control	T1572	7
Windows: Potential RDP Tunneling Via SSH Plink	Command And Control	T1572	7
Windows: RDP Over Reverse SSH Tunnel	Command And Control	T1572	7
Windows: RDP over Reverse SSH Tunnel WFP	Command And Control	T1090.002	7

UEBA Anomaly

Name	Tactic	Technique	Severity
Machine Learning Anomaly Detected	Policy Violation	none	7
UEBA AI detects unusual drive unmounted	UEBA	none	7
UEBA AI detects unusual file creation	UEBA	T1074.001	7
UEBA AI detects unusual file deletion	UEBA	none	7
UEBA AI detects unusual file download	UEBA	none	7
UEBA AI detects unusual file movement	UEBA	none	7
UEBA AI detects unusual file printed	UEBA	none	7
UEBA AI detects unusual file reading	UEBA	none	7
UEBA AI detects unusual file renamed	UEBA	none	7
UEBA AI detects unusual file upload	UEBA	none	7
UEBA AI detects unusual file writing	UEBA	none	7
UEBA AI detects unusual machine off	UEBA	none	7
UEBA AI detects unusual machine on	UEBA	none	7
UEBA AI detects unusual new drive mounted	UEBA	none	7
UEBA AI detects unusual process created	UEBA	none	7
UEBA AI detects unusual process not restarted	UEBA	none	7
UEBA AI detects unusual process started	UEBA	none	7
UEBA AI detects unusual process stopped	UEBA	none	7
Windows DNS Server: Suspicious DNS Traffic Resolved	Behavioral Anomaly	none	9

Uncommon Activity

Name	Tactic	Technique	Severity
UEBA Policy detects uncommon VPN client	UEBA	none	7
Uncommon Linux SSH Login	Initial Access	T1078.002	7
Uncommon Linux process Created	Defense Evasion	T1036.004	7
Uncommon Windows Service	Defense Evasion	T1036.004	7
Uncommon Windows process Created	Defense Evasion	T1036.004	7
Uncommon Windows process via Sysmon	Defense Evasion	T1036.004	7
Windows: BITS Transfer Job With Uncommon Or Suspicious Remote TLD	Defense Evasion	T1197	5
Windows: Conhost Spawned By Uncommon Parent Process	Persistence	none	5
Windows: EVTX Created In Uncommon Location	Defense Evasion	T1562.002	5
Windows: File Download Via Bitsadmin To An Uncommon Target Folder	Defense Evasion	T1197	5
Windows: Microsoft Excel Add-In Loaded From Uncommon Location	Execution	T1204.002	5
Windows: Mstsc.EXE Execution From Uncommon Parent	Persistence	none	7
Windows: Suspicious File Creation In Uncommon AppData Folder	Persistence	none	7
Windows: Suspicious Msbuild Execution By Uncommon Parent Process	Persistence	none	5
Windows: Uncommon AppX Package Locations	Persistence	none	5
Windows: Uncommon One Time Only Scheduled Task At 00:00	Persistence	none	7

Unused Accounts Monitoring

Name	Tactic	Technique	Severity
Windows Dormant Account Detected	Credential Access	T1110.001	4

User Account Change

Name	Tactic	Technique	Severity
AWS IAM Assume Role Policy Update	Initial Access	T1078.004	6
AWS IAM Group Created	Initial Access	T1078.004	3
AWS IAM Group Deleted	Impact	T1531	3
AWS IAM User Added to Group	Persistence	T1098.001	9
ArubaOS-CX: Multiple Users Deleted	Impact	T1531	9
ArubaOS-CX: User Added	Persistence	T1136.001	9
ArubaOS-CX: User Deleted	Impact	T1531	9
Azure Global Administrator Role Added to PIM User	Persistence	T1098.001	9
Database user or group changes	Persistence	T1098.001	7
FortiGate: Admin User Added	Persistence	T1136.001	9
FortiGate: Admin User Added via Console	Persistence	T1136.001	9
FortiGate: Admin User Deleted	Impact	T1531	9
FortiGate: Admin User Deleted via Console	Impact	T1531	9
FortiSIEM User Created	Persistence	T1136.001	7
GCP: IAM Custom Role Created	Persistence	T1078.004	9
GCP: IAM Custom Role Deleted	Impact	T1531	9
GCP: IAM Member assigned role of type admin or owner	Persistence	T1098.001	9
GCP: Service Account Access Key Created	Persistence	T1098.001	9
GCP: Service Account Access Key Deleted	Impact	T1531	6
GCP: Service Account Created	Persistence	T1136.003	9
GCP: Service Account Deleted	Impact	T1531	9
GCP: Service Account Disabled	Impact	T1531	8
GCP: Storage Bucket IAM Permissions Modified	Collection	T1530	6
Google Workspace: Role Assigned to User	Persistence	T1098.001	9
Google Workspace: Role Created by User	Persistence	T1098.001	9
Google Workspace: Role Deleted by User	Audit	none	9
Google Workspace: Role Modified by User	Persistence	T1098.001	9
Group Policy Object Created	Defense Evasion	T1484.001	7
Group Policy Object Modified	Defense Evasion	T1484.001	7
Linux Account Unlocked	Persistence	T1098.001	7
Linux User Account Properties Changed	Persistence	T1098.001	7
Linux User Added to Administrative Groups	Persistence	T1098.001	9
Linux User Added to Groups	Persistence	T1098.001	7
Linux User Created	Persistence	T1136.001	8
Linux User Deleted	Persistence	T1098.001	7
Linux User Deleted from Admin Groups	Persistence	T1098.001	9
Linux User Deleted from Groups	Persistence	T1098.001	7
Linux User Name Changed	Persistence	T1098.001	7
Linux User Password Changed	Persistence	T1098.001	7
Oracle OCI: Group Created	Persistence	T1098.001	7
Oracle OCI: Policy Created	Defense Evasion	T1562.007	7
Oracle OCI: Policy Deleted	Defense Evasion	T1562.007	7
Oracle OCI: User Activated MFA	Audit	none	4
Oracle OCI: User Added to a Group	Persistence	T1098.001	9
Oracle OCI: User Created	Persistence	T1136.003	9
Oracle OCI: User Deleted	Impact	T1531	9
User Added as Owner for Azure Application	Initial Access	T1078.004	9
User Added as Owner for Azure Service Principal	Initial Access	T1078.004	9
User added to Administrator Group	Persistence	T1136.001	9
User added to Backup Operator Group	Persistence	T1136.001	6
User added to DNS Admin Group	Persistence	T1136.001	9
User added to Domain Admin Group	Persistence	T1136.001	9
User added to Remote Desktop User Group	Persistence	T1136.001	9
User deleted from Administrator Group	Impact	T1531	9
User deleted from Backup Operator Group	Impact	T1531	6
User deleted from DNS Admins Group	Impact	T1531	9
User deleted from Domain Admin Group	Impact	T1531	6
User deleted from Remote Desktop User Group	Impact	T1531	9
Windows Account Unlocked	Persistence	T1098.001	7
Windows Groups Changed	Persistence	T1098.001	7
Windows Groups Created	Persistence	T1136.001	7
Windows Groups Deleted	Persistence	T1098.001	7
Windows User Account Disabled	Persistence	T1098.001	7
Windows User Account Enabled	Persistence	T1098.001	7
Windows User Account Name Changed	Persistence	T1098.001	7
Windows User Account Properties Changed	Persistence	T1098.001	7
Windows User Added to Groups	Persistence	T1098.001	7
Windows User Created	Persistence	T1136.001	7
Windows User Deleted	Persistence	T1098.001	7
Windows User Password Changed	Persistence	T1098.001	7
Windows User Removed from Groups	Persistence	T1098.001	7
Windows User or Group Modification	Persistence	T1098.001	6
Windows: A Member Was Added to a Security-Enabled Global Group	Persistence	none	3
Windows: A Security-Enabled Global Group Was Deleted	Persistence	none	3
Windows: Computer Password Change Via Ksetup.EXE	Persistence	none	5
Windows: Local User Creation	Persistence	T1136.001	3
Windows: Logged-On User Password Change Via Ksetup.EXE	Persistence	none	5
Windows: New User Created Via Net.EXE	Persistence	T1136.001	5
Windows: New or Renamed User Account with $ in Attribute SamAccountName	Persistence	none	7
Windows: Suspicious Windows ANONYMOUS LOGON Local Account Created	Persistence	T1136.002	7
Windows: User Added to Local Administrators	Persistence	none	5

Vulnerability found

Name	Tactic	Technique	Severity
AWS SecHub: Host Vulnerability Detected	Impact	T1499.004	8
Otorio RAM2 Vulnerability Discovered	Policy Violation	none	9
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9

Weakening Security

Name	Tactic	Technique	Severity
AWS EC2 Encryption Disabled	Defense Evasion	T1600.001	9
AWS IAM MFA Device Deactivated	Impact	T1531	9
CyberArk Vault CPM Password Disabled	Credential Access	none	8
Default password usage	Initial Access	none	7
Exposed Service Detected on Host	Lateral Movement	T1210	9
Google Workspace: 2FA Enforcement Disabled for Organization	Audit	none	9
Google Workspace: 2FA Verification Disabled for Organization	Audit	none	10
Inbound insecure protocol traffic detected	Credential Access	T1552.001	7
Linux: Attempt to Disable CarbonBlack Service	Defense Evasion	T1562.004	9
Linux: Attempt to Disable Crowdstrike Service	Defense Evasion	T1562.004	9
Linux: Attempts to Disable IPTables or Firewall	Defense Evasion	T1562.004	9
Linux: Command Line History Deleted	Defense Evasion	T1070.003	9
Linux: SELinux Disabled	Defense Evasion	T1562.001	9
Multi-Factor Authentication Disabled for an Azure User	Impact	T1531,T1562.001	9
Oracle OCI: User Disabled MFA	Persistence	T1098.001	9
Outbound insecure protocol traffic from non guest network detected	Credential Access	T1552.001	7
UEBA Policy detects antivirus not started	UEBA	none	7
UEBA Policy detects antivirus stopped	UEBA	none	7
Windows: Disable Windows Defender AV Security Monitoring	Defense Evasion	T1562.001	7
Windows: Disabled IE Security Features	Defense Evasion	T1562.001	7
Windows: Disabled RestrictedAdminMode For RDS - ProcCreation	Defense Evasion	T1112	7
Windows: Firewall Disabled via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: LSA PPL Protection Disabled Via Reg.EXE	Persistence	none	7
Windows: MSSQL Disable Audit Settings	Persistence	none	7
Windows: Powershell Defender Disable Scan Feature	Defense Evasion	T1562.001	7
Windows: Raccine Uninstall	Defense Evasion	T1562.001	7
Windows: Reg Disable Security Service	Defense Evasion	T1562.001	7
Windows: Windows Defender Threat Detection Disabled - Service	Defense Evasion	T1562.001	3
Windows: Windows Firewall Disabled via PowerShell	Persistence	none	5
Windows: Write Protect For Storage Disabled	Persistence	none	5

Rules by Data Source

AlertLogic logs via ALERTLOGIC_API_v3 or ALERTLOGIC_IRIS_API

Name	Tactic	Technique	Severity
AlertLogic Incident	Execution	none	7

Any Device Agentless FIM via SSH

Name	Tactic	Technique	Severity
Agent FIM: Linux File Content Modified	Defense Evasion	T1070.004,T1565.001	7
Agentless FIM: Audited file or directory created	Collection	T1074.001,T1565.001	8
Agentless FIM: Audited file or directory deleted	Defense Evasion	T1070.004,T1565.001	8
Agentless FIM: Audited file or directory ownership or permission changed	Defense Evasion	T1222.002,T1565.001	9
Agentless FIM: Audited target file content modified	Defense Evasion	T1070.004,T1565.001	8
Audited file or directory content modified in SVN	Defense Evasion	T1070.004,T1565.001	8

Any Device Config Monitoring via SSH

Name	Tactic	Technique	Severity
Difference between Running and Startup Config	Policy Violation	none	7
Running Config Change	Defense Evasion	T1562.004	6
Startup Config Change	Defense Evasion	T1562.004	6

Any Device via FortiSIEM Discovery

Name	Tactic	Technique	Severity
Default Password Detected by System	Policy Violation	none	7

Any Device via Ping Monitoring

Name	Tactic	Technique	Severity
Network Device Degraded: Lossy Ping Response	Impact	T1529	7
Network Device Down: no ping response	Impact	T1529	7
Server Degraded: Lossy Ping Response	Impact	T1529	7
Server Down: No Ping Response	Impact	T1529	7
Sudden Increase in Ping Response Times	Impact	T1499.002	7

Any Device via SNMP

Name	Tactic	Technique	Severity
Critical Network Device Interface Staying Down	Network	none	9
High Process CPU: Network Device	Impact	T1499.002	8
High Process Memory: Network Device	Impact	T1499.002	8
Network CPU Critical	Impact	T1499.002	9
Network CPU Warning	Impact	T1499.002	5
Network Device Hardware Critical	Hardware	none	9
Network Device Hardware Warning	Hardware	none	5
Network Device Health: Critical	Impact	T1499.002	9
Network Device Health: Warning	Impact	T1499.001	5
Network Device Interface Flapping	Impact	T1529	7
Network IPS Intf Util Critical	Impact	T1498.001	9
Network IPS Intf Util Warning	Impact	T1498.001	5
Network Intf Error Critical	Interface	none	9
Network Intf Error Warning	Interface	none	5
Network Intf Util Critical	Impact	T1498.001	9
Network Intf Util Warning	Impact	T1498.001	5
Network Memory Critical	Impact	T1499.002	9
Network Memory Warning	Impact	T1499.002	5
Noncritical Network Device Interface Staying Down	Network	none	4
SNMP Service Unavailable	Impact	T1489	9
Server Network Interface Flapping	Impact	T1529	7
Server Network Interface Staying Down	Network	none	4
Storage Hardware Critical	Hardware	none	9
Storage Hardware Warning	Hardware	none	5
Sudden Increase in SNMP Response Times	Impact	T1499.002	7

Any Device via STM Monitoring

Name	Tactic	Technique	Severity
Service Degraded: Slow Response to STM	Impact	T1489	7
Service Degraded: Slow Response to STM: Has IP	Impact	T1499.003	7
Service Down: No Response to STM	Impact	T1499.003	9
Service Down: No Response to STM: Has IP	Application	none	9
Service Staying Down: No Response to STM	Impact	T1499.003	8
Service Staying Down: No Response to STM: Has IP	Application	none	8
Sudden Increase in STM Response Times	Impact	T1499.002	7

Any Device via Syslog or SNMP

Name	Tactic	Technique	Severity
Server Hardware Critical	Hardware	none	9
Server Hardware Warning	Hardware	none	5
Storage Port Down	Impact	T1489	9

Any Log Ingested by FortiSIEM

Name	Tactic	Technique	Severity
Sudden Decrease in Reported Events From A Host	FortiSIEM	none	7
Sudden Increase in Reported Events From A Host	Discovery	none	7

Any Network Device via SSH Process Monitoring

Name	Tactic	Technique	Severity
Network Installed Software Change	Defense Evasion	T1218.001	6

Any UPS Device via SNMP

Name	Tactic	Technique	Severity
UPS Battery Metrics Critical	UPS	none	9
UPS Battery Status Critical	UPS	none	9

Apache via Syslog

Name	Tactic	Technique	Severity
Brute Force App Login Success	Credential Access	T1110.001	9
Excessive HTTP Client Side Errors	Impact	T1498.001	7
Excessive Web Request Failures	Application	none	7
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

APC NetBotz monitoring via SNMP

Name	Tactic	Technique	Severity
NetBotz camera motion detected	Environmental	none	7
NetBotz module door open	Environmental	none	7

APC via SNMP Trap

Name	Tactic	Technique	Severity
Critical APC Trap	Environmental	none	9
Critical APC Trap: can be auto cleared	Environmental	none	9
Warning APC Trap	Environmental	none	7
Warning APC Trap: can be auto cleared	Environmental	none	7

Armis Asset Intelligence Platform via Syslog

Name	Tactic	Technique	Severity
Armis Alert Detected	Behavioral Anomaly	none	9

Aruba CX Switches via Syslog

Name	Tactic	Technique	Severity
ArubaOS-CX: Config Change Detected	Audit	none	7
ArubaOS-CX: Multiple Users Deleted	Impact	T1531	9
ArubaOS-CX: User Added	Persistence	T1136.001	9
ArubaOS-CX: User Deleted	Impact	T1531	9

Aruba WLC via SNMP Trap

Name	Tactic	Technique	Severity
Rogue or Unsecure AP Detected	Initial Access	none	7

Aruba WLC via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9

AWS CloudTrail via AWS_CLOUDTRAIL

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
AWS CloudTrail Important Changes	Defense Evasion	T1562.001	7
AWS CloudTrail Log Created	Collection	T1530	3
AWS CloudTrail Log Deleted	Defense Evasion	T1562.008	9
AWS CloudTrail Log Setting Updated	Defense Evasion	T1562.008	3
AWS CloudTrail Log Suspended	Defense Evasion	T1562.008	9
AWS CloudWatch Alarm Deleted	Defense Evasion	T1562.008	5
AWS CloudWatch Log Group Deleted	Defense Evasion	T1070.004	9
AWS CloudWatch Log Stream Deleted	Defense Evasion	T1070.004	9
AWS Config Service Tampering	Defense Evasion	T1562.006	7
AWS Configuration Recorder Stopped	Defense Evasion	T1562.008	7
AWS EC2 Encryption Disabled	Defense Evasion	T1600.001	9
AWS EC2 Flow Log Deleted	Defense Evasion	T1562.008	7
AWS EC2 Network Access Control List Created	Initial Access	T1078.004	3
AWS EC2 Network Access Control List Deleted	Defense Evasion	T1562.007	9
AWS EC2 Snapshot Attribute Modified	Defense Evasion	T1578.001	5
AWS EC2 User Data Download	Defense Evasion	T1562.001	6
AWS Execution via System Manager	Execution	T1059.006	3
AWS GuardDuty Detector Deleted	Defense Evasion	T1562.008	7
AWS IAM Assume Role Policy Update	Initial Access	T1078.004	6
AWS IAM Brute Force of Assume Role Policy	Credential Access	T1110.001	7
AWS IAM Group Created	Initial Access	T1078.004	3
AWS IAM Group Deleted	Impact	T1531	3
AWS IAM MFA Device Deactivated	Impact	T1531	9
AWS IAM Password Recovery Requested	Initial Access	T1078.004	9
AWS IAM User Added to Group	Persistence	T1098.001	9
AWS Instance or Snapshot Discovery	Discovery	T1580	3
AWS Management Console Brute Force of Root User Identity	Credential Access	T1110.001	10
AWS Management Console Root Login	Initial Access	T1078.004	9
AWS RDS Cluster Created	Persistence	T1505.003	3
AWS RDS Cluster Deleted	Impact	T1485	5
AWS RDS Instance/Cluster Stopped	Impact	T1489	5
AWS Root Login Without MFA	Initial Access	T1078.004	10
AWS S3 Bucket Configuration Deleted	Defense Evasion	T1562.008	3
AWS Secret Accessed in Secrets Manager	Credential Access	T1528	7
AWS WAF Access Control List Deleted	Defense Evasion	T1562.007	9
AWS WAF Rule or Rule Group Deleted	Defense Evasion	T1562.007	8
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
Uncommon AWS Console Login	Initial Access	T1078.004	7

AWS Discovery via AWS_SDK

Name	Tactic	Technique	Severity
AWS EC2 Instance Down	Impact	T1529	4

AWS ELB via Syslog

Name	Tactic	Technique	Severity
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

AWS Security Hub via AWS_HUB_SDK

Name	Tactic	Technique	Severity
AWS SecHub: Host Vulnerability Detected	Impact	T1499.004	8
AWS SecHub: Software and Configuration Violation	Impact	none	6
AWS SecHub: Tactics: Collection Detected	Collection	none	8
AWS SecHub: Tactics: Command-and-Control Detected	Command and Control	none	8
AWS SecHub: Tactics: Credential Access Detected	Credential Access	none	8
AWS SecHub: Tactics: Defense Evasion Detected	Defense Evasion	none	8
AWS SecHub: Tactics: Discovery Detected	Discovery	none	7
AWS SecHub: Tactics: Execution Detected	Execution	none	8
AWS SecHub: Tactics: Impact: Data Destruction Detected	Impact	none	7
AWS SecHub: Tactics: Impact: Data Exfiltration Detected	Impact	none	8
AWS SecHub: Tactics: Impact: Data Exposure Detected	Impact	none	8
AWS SecHub: Tactics: Impact: Denial of Service Detected	Impact	T1498.001	8
AWS SecHub: Tactics: Initial Access Detected	Initial Access	none	7
AWS SecHub: Tactics: Lateral Movement Detected	Lateral Movement	none	8
AWS SecHub: Tactics: Persistence Detected	Persistence	none	9
AWS SecHub: Tactics: Privilege Escalation Detected	Privilege Escalation	T1548.002	9
AWS SecHub: Unusal Data Behavior Detected	Impact	none	7
AWS SecHub: Unusal Database Behavior Detected	Impact	none	7
AWS SecHub: Unusal Network Flow Behavior Detected	Impact	none	8
AWS SecHub: Unusal Process Behavior Detected	Impact	none	8
AWS SecHub: Unusal Serverless Behavior Detected	Impact	none	7
AWS SecHub: Unusual Application Behavior Detected	Impact	none	7
Suspicious logon attempt	Credential Access	T1110.001	9

Barracuda WAF via Syslog

Name	Tactic	Technique	Severity
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

Barracuda Web Application Firewall via Syslog

Name	Tactic	Technique	Severity
Barracuda WAF: Config Change Detected	Defense Evasion	T1562.004	7

BIND DNS via Syslog

Name	Tactic	Technique	Severity
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9

BlueCoat via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Carbon Black Security Platform via Syslog

Name	Tactic	Technique	Severity
Carbon Black Fatal Errors	Application	none	8
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

Checkpoint Firewall via Syslog or LEA

Name	Tactic	Technique	Severity
Failed Checkpoint Firewall Policy Install	Audit	none	8
Successful Checkpoint Firewall Policy Install	Audit	none	7
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

Checkpoint IPS-1 via LEA/Syslog

Name	Tactic	Technique	Severity
ARP Exploit	Credential Access	T1557.002	7
Adware process found	Persistence	none	7
Backdoor Found by Network IPS	Execution	T1204.001	9
Code Injection Attack detected by NIPS	Execution	none	9
Compromised Host Detected by Network IPS	Persistence	none	9
Default password usage	Initial Access	none	7
Distributed DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack on Network Devices by Network IPS	Impact	T1498.001	9
DoS Attack on WLAN Infrastructure by Network IPS	Impact	T1498.001	9
Excessive WLAN Exploits: Same Source	Execution	none	9
High Risk Rating Cisco IPS Exploit	Execution	none	9
High Severity Inbound Denied Security Exploit	Execution	none	5
High Severity Inbound Permitted IPS Exploit	Execution	none	9
High Severity Outbound Denied IPS Exploit	Execution	none	9
High Severity Outbound Permitted IPS Exploit	Execution	none	9
High Severity WLAN Attack	Execution	none	9
IPS/AV Evasion attempts	Defense Evasion	T1211	7
IRC traffic detected	Policy Violation	none	7
Identity Spoofing Exploit	Credential Access	T1557.002	7
Info Leak Exploits	Discovery	none	5
Malware found by firewall but not remediated	Persistence	none	9
Multiple Distinct IPS Events From Same Src	Execution	none	9
Multiple IPS Detected Scans From Same Src	Discovery	T1046	7
P2P traffic detected	Policy Violation	none	7
Phishing attack found but not remediated	Reconnaissance	T1598.002,T1598.003	9
Privilege Escalation Exploits	Privilege Escalation	T1548.004	7
Replay Exploit	Credential Access	T1557.002	7
Rootkit found	Persistence	T1014,T1554,T1601.001	9
Session Hijacking Exploit	Credential Access	T1557.002	7
Spyware Found by Network IPS	Execution	T1204.001	9
Stealth Scan using a tool	Discovery	T1046	9
System Exploit Detected by Network IPS	Execution	none	7
System Exploit Detected by Network IPS: Likely Success	Execution	none	9
Targeted System/Application Scan	Discovery	T1046	7
Tunneled traffic detected	Command And Control	T1572	7
WLAN Scan	Discovery	T1046	7
Website defacement attack	Impact	T1491.001,T1491.002	9
Wireless MITM attack detected by Network IPS	Credential Access	T1557.002	9

Checkpoint via Syslog or Netflow

Name	Tactic	Technique	Severity
End User DNS Queries to Unauthorized DNS Servers	Command And Control	T1568.001	7
Excessive Denied Connections From An External Country	Impact	T1498.001	7
Excessive Denied Connections From Same Src	Impact	T1498.001	8
Excessive Denied Connections To A Port	Impact	T1498.001	7
Excessive Denied Connections To Same Destination	Impact	T1498.001	8
Excessive Denied DNS Queries	Command And Control	T1568.001	6
Excessive End User DNS Queries	Command And Control	T1568.001	7
Excessive End User Mail To Unauthorized Mail Gateways	Exfiltration	T1020.001	8
Excessive SNMP Port 161 Traffic from a Source to the same Destination	Collection	T1602.001	5
Half Open TCP DDOS Attack	Impact	T1498.001	7
Heavy Half Open TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy Half Open TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy ICMP Ping sweep	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy UDP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy UDP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	9
Invalid TCP/UDP Port Traffic	Command And Control	T1571	9
Large Inbound Transfer From Outside My Country	Command And Control	T1071.001	8
Large Outbound Transfer To Outside My Country	Exfiltration	T1048.001	8
Sudden Change In DNS Data Transfer Pattern From A Specific Host	Command And Control	T1568.001	7
Sudden Increase In DNS Requests From A Specific Host	Command And Control	T1568.001	7
TCP DDOS Attack	Impact	T1498.001	8
Traffic to bogon networks	Command and Control	none	8
Unusual ICMP Traffic	Defense Evasion	none	7
Unusually Large ICMP Echo Packets	Command And Control	T1095	9
Blocked File Execution	Execution	none	8
Blocklist User Agent Match	Exfiltration	T1041	9
Dynamically generated host name: malware likely	Command And Control	T1568.002	7
Excessive End User Mail	Collection	T1114.001	8
Excessive ICMP Unreachables	Network	none	6
Heavy Half Open TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy Half Open TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy UDP Port Scan: Multiple Hosts	Discovery	T1046	9
Heavy UDP Port Scan: Single Host	Discovery	T1046	7
ICMP Flood From Same Source	Impact	T1498.001	7
Inbound Traffic from Open Proxies	Command And Control	T1090.002	9
Inbound Traffic from Tor Network	Command And Control	T1090.002	9
Inbound insecure protocol traffic detected	Credential Access	T1552.001	7
Invalid TCP Flags: High Intensity	Discovery	none	9
Invalid TCP Flags: Medium Intensity	Discovery	none	7
Large Outbound Transfer	Exfiltration	T1048.001	8
Log4J Exploit Request Detected By Regex	Lateral Movement	T1210	7
Malware hash match	Exfiltration	T1041	9
OT Permited Traffic not from Purdue Level 3 to Level 2		none	7
OT Permited Traffic not from Purdue Level 3.5 to Level 3		none	7
OT Permited Traffic not from Purdue Level 4 to Level 3.5		none	7
OT Permited Traffic not from Purdue Level 5 to Level 4		none	7
Outbound Traffic to Open Proxies	Command And Control	T1090.002	9
Outbound Traffic to Tor Network	Command And Control	T1090.002	9
Outbound Traffic to Unapproved Public DNS Servers	Policy Violation	none	7
Outbound insecure protocol traffic from non guest network detected	Credential Access	T1552.001	7
Outbreak: DARKSIDE Domain Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Inbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Outbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: FortiGate detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: HAFNIUM Inbound Network Traffic	Command And Control	T1095	9
Outbreak: HAFNIUM Outbound Network Traffic	Command And Control	T1095	9
Outbreak: SUNBURST Outbound Network Traffic	Command And Control	T1095	9
P2P traffic consuming high network bandwidth	Policy Violation	none	7
Permitted Traffic from AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Blocklist DE Malware IP List	Exfiltration	T1041	9
Permitted Traffic from C2 Tracker Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CINS Score Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CertPL Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Cisco Talos Malware IP List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Permitted Traffic from Emerging Threat IP List	Command and Control	none	7
Permitted Traffic from FireHol Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiGuard Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Greensnow Malware IP List	Exfiltration	T1041	9
Permitted Traffic from IPSum Malware IP List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware IP List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Proofpoint Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Snort Malware IP List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware IP List	Exfiltration	T1041	9
Remote Desktop traffic from Internet	Lateral Movement	T1021.001,T1133,T1219	9
Sudden Increase In Firewall Denied Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Denied Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Permitted Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Permitted Traffic From Host	Impact	T1498.001	7
Sudden Increase In Permitted Traffic To Host	Impact	T1498.001	7
Sudden Increase in Firewall Permitted Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase in ICMP Requests From A Host	Impact	T1498.001	7
Sudden Increase in Inbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Outbound Firewall Aggregate Denies	Impact	T1498.001	7
Traffic to AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Traffic to Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Traffic to Blocklist DE Malware IP List	Exfiltration	T1041	9
Traffic to C2 Tracker Malware IP List	Exfiltration	T1041	9
Traffic to CINS Score Malware IP List	Exfiltration	T1041	9
Traffic to CertPL Malware Domain List	Exfiltration	T1041	9
Traffic to Cisco Talos Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware Domain List	Exfiltration	T1041	9
Traffic to DigitalSide Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware URL List	Exfiltration	T1041	9
Traffic to Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Traffic to Emerging Threat IP List	Exfiltration	T1048.001	7
Traffic to FireHol Malware IP List	Exfiltration	T1041	9
Traffic to FortiGuard Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware Domain List	Exfiltration	T1041	9
Traffic to FortiRecon Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware URL List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware Domain List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware IP List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware URL List	Exfiltration	T1041	9
Traffic to Greensnow Malware IP List	Exfiltration	T1041	9
Traffic to IPSum Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware Domain List	Exfiltration	T1041	9
Traffic to MISP Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware URL List	Exfiltration	T1041	9
Traffic to Mandiant Malware Domain List	Exfiltration	T1041	9
Traffic to Mandiant Malware IP List	Exfiltration	T1041	9
Traffic to Mandiant Malware URL List	Exfiltration	T1041	9
Traffic to OpenCTI Malware Domain List	Exfiltration	T1041	9
Traffic to OpenCTI Malware IP List	Exfiltration	T1041	9
Traffic to OpenCTI Malware URL List	Exfiltration	T1041	9
Traffic to OpenPhish Malware URL List	Exfiltration	T1041	9
Traffic to Proofpoint Malware IP List	Exfiltration	T1041	9
Traffic to Snort Malware IP List	Exfiltration	T1041	9
Traffic to ThreatFox Malware URL List	Exfiltration	T1041	9
Traffic to TweetFeed Malware Domain List	Exfiltration	T1041	9
Traffic to TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to TweetFeed Malware URL List	Exfiltration	T1041	9
VNC traffic from Internet	Lateral Movement	T1021.005,T1133,T1219	9

Cisco ACI via Cisco_APIC_API

Name	Tactic	Technique	Severity
Cisco ACI Cluster Unavailable	SDN	none	9
Cisco ACI Critical Fault	SDN	none	9
Cisco ACI Node Health Critical	SDN	none	9
Cisco ACI Node Health Warning	SDN	none	7
Cisco ACI System Health Critical	SDN	none	9
Cisco ACI System Health Warning	SDN	none	7
Cisco ACI Tenant Health Critical	SDN	none	9
Cisco ACI Tenant Health Warning	SDN	none	7

Cisco AMP via CISCO_AMP_STREAM_API

Name	Tactic	Technique	Severity
Spyware Found And Cleaned	Execution	T1204.001	5

Cisco Application Visibility and Control (AVC) logs via Netflow V9

Name	Tactic	Technique	Severity
Cisco AVC: Application Flows with QoS Queue Packet Drops	Application	none	5
Cisco AVC: Application Response Time Late	Application	none	7
Cisco AVC: P2P Applications that exceed interface utilization	Interface	none	1

Cisco ASA via SSH

Name	Tactic	Technique	Severity
Running Config Change: with login info	Defense Evasion	T1562.004	6
Startup Config Change: with login	Defense Evasion	T1562.004	6

Cisco ASA via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Account Locked: Network Device	Credential Access	T1110.001	9
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Denied Blacklisted Destination	Policy Violation	none	9
Denied Blacklisted Source	Policy Violation	none	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Permitted Blacklisted Destination	Policy Violation	none	9
Permitted Blacklisted Source	Policy Violation	none	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Cisco ASA VPN Monitoring via SNMP

Name	Tactic	Technique	Severity
High throughput VPN session	Audit	none	7
Long lasting VPN session	Audit	none	7

Cisco Call Manager via CDR Records

Name	Tactic	Technique	Severity
Degraded VoIP Call Quality	Impact	T1499.002	7
Poor VoIP Call Quality	Impact	T1499.002	9

Cisco Call Manager via Syslog

Name	Tactic	Technique	Severity
Cisco Call Manager Active Partition Disk Low	Storage Space	none	8
Cisco Call Manager CPU High	CPU	none	8
Cisco Call Manager Call Attempt Blocked By Policy	Suspicious Activity	none	9
Cisco Call Manager Certificate Mismatch	Suspicious Activity	none	9
Cisco Call Manager Core Dump File Found	VoIP	none	8
Cisco Call Manager DDR Block Prevention	Suspicious Activity	none	9
Cisco Call Manager DDR Down	Impact	T1489	9
Cisco Call Manager DRF Failed	VoIP	none	9
Cisco Call Manager EMCC Failed In Local Cluster	VoIP	none	9
Cisco Call Manager EMCC Failed In Remote Cluster	VoIP	none	9
Cisco Call Manager EMCC Login Failure	Credential Access	T1110.001	7
Cisco Call Manager Excessive Active BLF subscriptions	VoIP	none	9
Cisco Call Manager Excessive Voice Quality Reports	VoIP	none	9
Cisco Call Manager IME Service TLS Connection Failure	VoIP	none	9
Cisco Call Manager Inactive Partition Disk Low	Storage Space	none	7
Cisco Call Manager License Grace Period Expired	VoIP	none	7
Cisco Call Manager Location Out Of Bandwidth	VoIP	none	10
Cisco Call Manager Not Connected To Enterprise License Manager	VoIP	none	9
Cisco Call Manager Spare Partition Disk Usage Critical	Storage Space	none	8
Cisco Call Manager Spare Partition Disk Usage Warning	Storage Space	none	7
Cisco Call Manager Swap Disk Low	Storage Space	none	8
Cisco Call Manager Syslog Pattern Match	VoIP	none	7
Cisco Call Manager Syslog Severity Match	VoIP	none	7
Cisco Call Manager System In Overage	VoIP	none	9
Cisco Call Manager System Version Mismatch	VoIP	none	9
Cisco Call Manager User Defined Search String Found In Log	VoIP	none	5
Cisco Call Manager Virtual Memory Low	Memory	none	8
Cisco CallManager CDR Agent Send Failed	VoIP	none	9
Cisco CallManager CDR File Delivery Failed	VoIP	none	9
Cisco CallManager CDR High Disk Usage	Storage Space	none	9
Cisco CallManager CDR Max Disk Usage Exceeded	Storage Space	none	9
Cisco CallManager Call Route List Exhausted	VoIP	none	7
Cisco CallManager Cluster Member Down	Impact	T1489	10
Cisco CallManager Critical Service Down	Impact	T1489	9
Cisco CallManager DB Replication Error	VoIP	none	7
Cisco CallManager DB Replication Failure	VoIP	none	9
Cisco CallManager Database Notification Failure	VoIP	none	8
Cisco CallManager Excessive Authentication Failure	Credential Access	T1110.001	7
Cisco CallManager Hardware Failure	VoIP	none	9
Cisco CallManager High Call Latency: Code Yellow	VoIP	none	8
Cisco CallManager IME Distributed Cache Inactive	VoIP	none	7
Cisco CallManager IME Insufficient Fallback Identifiers: No PSTN Fallback	VoIP	none	7
Cisco CallManager IME Over Quota	VoIP	none	9
Cisco CallManager IME Quality Alert	VoIP	none	9
Cisco CallManager IME Service Authentication Error	Authentication	none	7
Cisco CallManager LogPartition High Water Mark Exceeded	VoIP	none	9
Cisco CallManager LogPartition Low Water Mark Exceeded	VoIP	none	7
Cisco CallManager MGCP DChannel is out of service	VoIP	none	9
Cisco CallManager Malicious Call Trace	Suspicious Activity	none	9
Cisco CallManager Media List Exhausted	VoIP	none	9
Cisco CallManager Node Excessive Process and Thread	VoIP	none	7
Cisco CallManager Node High CPU	CPU	none	8
Cisco CallManager Registered Device Count Exceeded	VoIP	none	7
Cisco CallManager Registered Device Count Increased	VoIP	none	7
Cisco CallManager Registered Media Count Increased	VoIP	none	6
Cisco CallManager Registered Phone Decreased	VoIP	none	8
Cisco Local To Remote Call Manager Communication Problem	VoIP	none	9
Cisco Local To Remote Call Manager TCP Connection Failed	VoIP	none	9
Cisco Unified Contact Center Express Autopurging completed	VoIP	none	7
Cisco Unified Contact Center Express Database Replication Failed	VoIP	none	8
Cisco Unified Contact Center Express Database Replication Stopped	VoIP	none	9
Cisco Unified Contact Center Express Database Unavailable	VoIP	none	9
Cisco Unified Contact Center Express Database Update Issue	VoIP	none	9
Cisco Unified Contact Center Express JVM heap memory high	Memory	none	8
Cisco Unified Contact Center Express Report Execution Failed	VoIP	none	7
Cisco Unified Contact Center Express Report Server Uncoverable Error	VoIP	none	8
Cisco Unity Connection Disk utilization Critical	Storage Space	none	9
Cisco Unity Connection Disk utilization Warning	Storage Space	none	7
Cisco Unity Connection Failback Failed	VoIP	none	10
Cisco Unity Connection Failover Failed	VoIP	none	10
Cisco Unity Connection Failover Succeeded	VoIP	none	7
Cisco Unity Connection License About To Expire	VoIP	none	7
Cisco Unity Connection License Expired	VoIP	none	9
Cisco Unity Connection Split Brain Failed	VoIP	none	10
Cisco Unity No Connection To Peer	VoIP	none	9

Cisco FireAMP via FIREAMP_CLOUD_API or ESTREAMER_SDK

Name	Tactic	Technique	Severity
FireAMP Malicious file execution	Persistence	none	9
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

Cisco IOS IPSLA Monitoring via SNMP

Name	Tactic	Technique	Severity
Degraded IPSLA DNS Test	Impact	T1499.002	7
Degraded IPSLA ICMP Test	Impact	T1499.002	7
Degraded IPSLA UDP Echo Test	Impact	T1499.002	7
Degraded VoIP IPSLA Call Quality	Impact	T1499.002	7
IPSLA HTTP Test Failure	Impact	T1499.002	7
Poor VoIP IPSLA Call Quality	Impact	T1499.002	9

Cisco IOS via SSH

Name	Tactic	Technique	Severity
Running Config Change: with login info	Defense Evasion	T1562.004	6
Startup Config Change: with login	Defense Evasion	T1562.004	6

Cisco IOS via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Account Locked: Network Device	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
EIGRP Neighbor Down	Impact	T1529	9
IOS Packet Memory Test Failure	Network	none	9
Lateral Movement Detected	Lateral Movement	none	9
Layer 2 Switch Port Security Violation	Suspicious Activity	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Network Device Redundancy Lost	Network	none	6
Network Interface Duplex Mismatch	Network	none	7
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8

Cisco IOS Via Syslog

Name	Tactic	Technique	Severity
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Cisco IOS via Syslog or Netflow

Name	Tactic	Technique	Severity
Heavy Half Open TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Sudden Change In DNS Data Transfer Pattern From A Specific Host	Command And Control	T1568.001	7
Sudden Increase In DNS Requests From A Specific Host	Command And Control	T1568.001	7
Outbreak: DARKSIDE Domain Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Inbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Outbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: HAFNIUM Inbound Network Traffic	Command And Control	T1095	9
Outbreak: HAFNIUM Outbound Network Traffic	Command And Control	T1095	9
Outbreak: SUNBURST Outbound Network Traffic	Command And Control	T1095	9
Sudden Increase In Firewall Denied Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Denied Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Permitted Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Permitted Traffic From Host	Impact	T1498.001	7
Sudden Increase In Permitted Traffic To Host	Impact	T1498.001	7
Sudden Increase in Firewall Permitted Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase in ICMP Requests From A Host	Impact	T1498.001	7
Sudden Increase in Inbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Outbound Firewall Aggregate Denies	Impact	T1498.001	7

Cisco IronPort via Syslog

Name	Tactic	Technique	Severity
Mail Hard Bounce Delivery Failures	Mail Server	none	7

Cisco Meraki via SNMP trap

Name	Tactic	Technique	Severity
Meraki Device Cellular Connection Disconnected	Network	none	7
Meraki Device Down	Impact	T1489	9
Meraki Device IP Conflict	Network	none	7
Meraki Device Interface Down	Network	none	7
Meraki Device Port Cable Error	Network	none	8
Meraki Device VPN Connectivity Down	Network	none	9
Meraki Foreign AP Detected	Policy Violation	none	7
Meraki New DHCP Server	Network	none	7
Meraki New Splash User	Persistence	T1098.001	7
Meraki No DHCP lease	Network	none	7
Meraki Rogue DHCP Server	Policy Violation	none	7
Meraki Unreachable Device	Network	none	9
Meraki Unreachable RADIUS Server	Network	none	9
Meraki VPN Failover	Network	none	7

Cisco Umbrella via AWS_S3

Name	Tactic	Technique	Severity
Cisco Umbrella: Failed DNS Requests to Malware Domains: Same source and Multiple Destinations	Command And Control	T1071.004	9
Cisco Umbrella: Intelligent Proxy Blocked a Malware Request by Policy	Command And Control	T1071.004	9
Cisco Umbrella: Multiple Failed DNS Requests to a Malware Domain: Same Source and Destination	Command And Control	T1071.004	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9

Cisco Umbrella via HTTPS_ADVANCED (Umbrella API)

Name	Tactic	Technique	Severity
Cisco Umbrella: Failed DNS Requests to Malware Domains: Same source and Multiple Destinations	Command And Control	T1071.004	9
Cisco Umbrella: Intelligent Proxy Blocked a Malware Request by Policy	Command And Control	T1071.004	9
Cisco Umbrella: Multiple Failed DNS Requests to a Malware Domain: Same Source and Destination	Command And Control	T1071.004	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9

Cisco WLAN via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9

Cisco WLC via SNMP Trap

Name	Tactic	Technique	Severity
Excessive Rogue or Unsecure APs Detected	Initial Access	none	9
Wireless Host Blacklisted	Policy Violation	none	9

Cisco WLC via SNMP Trap

Name	Tactic	Technique	Severity
Rogue or Unsecure AP Detected	Initial Access	none	7

Crowdstrike via FALCON_STREAMING_API or FALCON_DATA_REPLICATOR

Name	Tactic	Technique	Severity
Crowdstrike: Activity Prevented	Malware	none	6
Crowdstrike: Attacker Methodology	Malware	none	8
Crowdstrike: Authentication Bypass	Privilege Escalation	none	8
Crowdstrike: Blocked Exploit	Execution	none	6
Crowdstrike: Credential Theft Detected	Credential Access	none	8
Crowdstrike: Data Deletion	Impact	none	8
Crowdstrike: Data Theft	Impact	none	8
Crowdstrike: Drive By Download	Execution	none	8
Crowdstrike: Establish Persistence	Persistence	none	8
Crowdstrike: Evade Detection	Defense Evasion	none	8
Crowdstrike: Excessive suspicious activity on a host	Persistence	none	8
Crowdstrike: Exploit Pivot	Persistence	none	8
Crowdstrike: File Blocked With Matching Hash	Execution	none	6
Crowdstrike: Intel Detection	Persistence	none	9
Crowdstrike: Known Malware	Exfiltration	T1041	9
Crowdstrike: Machine Learning Anomaly Detected	Persistence	none	8
Crowdstrike: Malicious Document Detected	Persistence	none	8
Crowdstrike: NextGen Antivirus based Malware	Persistence	none	8
Crowdstrike: Overwatch Detection	Execution	none	9
Crowdstrike: Privilege Escalation	Privilege Escalation	T1548.004	8
Crowdstrike: Ransomware	Persistence	none	8
Crowdstrike: Server Compromise Likely	Persistence	none	9
Crowdstrike: Social Engineering	Defense Evasion	none	7
Crowdstrike: Suspicious Activity	Persistence	none	8
Crowdstrike: Suspicious Processes Terminated	Persistence	none	6
Crowdstrike: User Compromise	Command and Control	none	8
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

CyberArk Enterprise Password Vault via Syslog

Name	Tactic	Technique	Severity
CyberArk Vault Blocked Operations	Credential Access	none	8
CyberArk Vault CPM Password Disabled	Credential Access	none	8
CyberArk Vault Excessive Failed PSM Connections	Credential Access	none	8
CyberArk Vault Excessive Impersonations	Credential Access	none	8
CyberArk Vault Excessive PSM Keystroke Logging Failure	Credential Access	none	8
CyberArk Vault Excessive PSM Session Monitoring Failure	Credential Access	T1110.001	8
CyberArk Vault Excessive Password Release Failure	Credential Access	T1110.001	8
CyberArk Vault File Operation Failure	Credential Access	none	8
CyberArk Vault Object Content Validation Failure	Credential Access	none	8
CyberArk Vault Unauthorized User Stations	Credential Access	none	8
CyberArk Vault User History Clear	Defense Evasion	T1070.003	8

CyberX via Syslog

Name	Tactic	Technique	Severity
CyberX Detected Malware	Behavioral Anomaly	none	9

Cylance Protect via Syslog

Name	Tactic	Technique	Severity
Cylance Blocked Exploit	Execution	none	7
Cylance Found Active Script	Execution	none	7
Cylance Found Corrupt File	Impact	none	7
Cylance High Severity Threat	Persistence	none	9
Cylance Low Severity Threat	Persistence	none	3
Cylance Medium Severity Threat	Persistence	none	7
Cylance Quarantined Host	Execution	none	7
Cylance Waived Threat	Execution	none	3
CylanceProtect Threat Changed	Execution	none	7
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

Dell EquaLogic via SNMP

Name	Tactic	Technique	Severity
EqualLogic Connection Read/Write Latency Critical	Impact	T1499.001	9
EqualLogic Connection Read/Write Latency Warning	Impact	T1499.001	5

Digital Defense via FRONTLINE_API

Name	Tactic	Technique	Severity
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9

Dragos Platform via Syslog and Nozomi SCADA Guardian/CMC via NOZOMI_API

Name	Tactic	Technique	Severity
ICS Alert: Activate Firmware Update Mode	Inhibit Response Function	T0800	6
ICS Alert: Alarm Suppression	Inhibit Response Function	T0878	6
ICS Alert: Automated Collection	Collection ICS	T0802	8
ICS Alert: Block Reporting Message	Inhibit Response Function	T0804	8
ICS Alert: Brute Force I/O	Impair Process Control	T0806	8
ICS Alert: Change Operating Mode	Execution ICS	T0858	8
ICS Alert: Command Blocked	Inhibit Response Function	T0803	8
ICS Alert: Command-Line Interface	Execution ICS	T0807	8
ICS Alert: Commonly Used Port	Command And Control ICS	T0885	8
ICS Alert: Connection Proxy	Command And Control ICS	T0884	8
ICS Alert: Damage to Property	Impact ICS	T0879	8
ICS Alert: Data Destruction	Inhibit Response Function	T0809	8
ICS Alert: Data from Information Repositories	Collection ICS	T0811	8
ICS Alert: Default Credentials	Lateral Movement ICS	T0812	8
ICS Alert: Denial of Control	Impact ICS	T0813	8
ICS Alert: Denial of Service	Inhibit Response Function	T0814	8
ICS Alert: Denial of View	Impact ICS	T0815	8
ICS Alert: Detect Operating Mode	Collection ICS	T0868	8
ICS Alert: Device Restart/Shutdown	Inhibit Response Function	T0816	8
ICS Alert: Drive-by Compromise	Initial Access ICS	T0817	8
ICS Alert: Execution through API	Execution ICS	T0871	8
ICS Alert: Exploit Public-Facing Application	Initial Access ICS	T0819	8
ICS Alert: Exploitation for Evasion	Evasion ICS	T0820	8
ICS Alert: Exploitation for Privilege Escalation	Privilege Escalation ICS	T0890	8
ICS Alert: Exploitation of Remote Services	Lateral Movement ICS	T0866	8
ICS Alert: External Remote Services	Initial Access ICS	T0822	8
ICS Alert: Graphical User Interface	Execution ICS	T0823	8
ICS Alert: Hooking	Execution ICS	T0874	8
ICS Alert: I/O Image	Collection ICS	T0877	8
ICS Alert: Indicator Removal on Host	Evasion ICS	T0872	8
ICS Alert: Internet Accessible Device	Initial Access ICS	T0883	8
ICS Alert: Lateral Tool Transfer	Lateral Movement ICS	T0867	8
ICS Alert: Loss of Availability	Impact ICS	T0826	8
ICS Alert: Loss of Control	Impact ICS	T0827	8
ICS Alert: Loss of Productivity and Revenue	Impact ICS	T0828	8
ICS Alert: Loss of Protection	Impact ICS	T0837	8
ICS Alert: Loss of Safety	Impact ICS	T0880	8
ICS Alert: Loss of View	Impact ICS	T0829	8
ICS Alert: Man in the Middle	Collection ICS	T0830	8
ICS Alert: Manipulate I/O Image	Inhibit Response Function	T0835	8
ICS Alert: Manipulation of Control	Impact ICS	T0831	8
ICS Alert: Manipulation of View	Impact ICS	T0832	8
ICS Alert: Masquerading	Evasion ICS	T0849	8
ICS Alert: Modify Alarm Settings	Inhibit Response Function	T0838	8
ICS Alert: Modify Controller Tasking	Execution ICS	T0821	8
ICS Alert: Modify Parameter	Impair Process Control	T0836	8
ICS Alert: Modify Program	Persistence ICS	T0889	8
ICS Alert: Module Firmware	Persistence ICS	T0839	8
ICS Alert: Monitor Process State	Collection ICS	T0801	8
ICS Alert: Native API	Execution ICS	T0834	8
ICS Alert: Network Connection Enumeration	Discovery ICS	T0840	8
ICS Alert: Network Sniffing	Discovery ICS	T0842	8
ICS Alert: Point Tag Identification	Collection ICS	T0861	8
ICS Alert: Program Download	Lateral Movement ICS	T0843	8
ICS Alert: Program Upload	Collection ICS	T0845	8
ICS Alert: Project File Infection	Persistence ICS	T0873	8
ICS Alert: Remote Services	Lateral Movement ICS	T0886	8
ICS Alert: Remote System Discovery	Discovery ICS	T0846	8
ICS Alert: Remote System Information Discovery	Discovery ICS	T0888	8
ICS Alert: Replication Through Removable Media	Initial Access ICS	T0847	8
ICS Alert: Rogue Master	Initial Access ICS	T0848	8
ICS Alert: Rootkit	Evasion ICS	T0851	8
ICS Alert: Screen Capture	Collection ICS	T0852	8
ICS Alert: Scripting	Execution ICS	T0853	8
ICS Alert: Serial COM Blocked	Inhibit Response Function	T0805	8
ICS Alert: Service Stop	Inhibit Response Function	T0881	8
ICS Alert: Spearphishing Attachment	Initial Access ICS	T0865	8
ICS Alert: Spoof Reporting Message	Evasion ICS	T0856	8
ICS Alert: Standard Application Layer Protocol	Command And Control ICS	T0869	8
ICS Alert: Supply Chain Compromise	Initial Access ICS	T0862	8
ICS Alert: System Firmware	Persistence ICS	T0857	8
ICS Alert: Theft of Operational Information	Impact ICS	T0882	8
ICS Alert: Transient Cyber Asset	Initial Access ICS	T0864	8
ICS Alert: Unauthorized Command Message	Impair Process Control	T0855	8
ICS Alert: User Execution	Execution ICS	T0863	8
ICS Alert: Valid Accounts	Persistence ICS	T0859	8
ICS Alert: Wireless Compromise	Initial Access ICS	T0860	8
ICS Alert: Wireless Sniffing	Discovery ICS	T0887	8

EMC Clarion via NaviSecCli

Name	Tactic	Technique	Severity
Unregistered EMC Clariion Host	Storage	none	4

F5 via Syslog

Name	Tactic	Technique	Severity
Brute Force App Login Success	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

FireEye HX via Syslog

Name	Tactic	Technique	Severity
FireEye HX IOC found	Persistence	none	9

FireEye MPS via Syslog

Name	Tactic	Technique	Severity
FireEye Malware Callback	Exfiltration	T1041	9

Firewalls via SNMP

Name	Tactic	Technique	Severity
Sudden Increase In Firewall Connections	Impact	T1498.001	7

FortiAnalyzer via Syslog

Name	Tactic	Technique	Severity
FortiAnalyzer: No logs received from a device in 4 hours	Network	none	6

FortiClient via FortiEMS_API

Name	Tactic	Technique	Severity
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9

FortiClient via Syslog

Name	Tactic	Technique	Severity
Log4J Exploit Request Detected on Host by Fortinet Products	Lateral Movement	T1210	10
Outbreak: 3CX Supply Chain Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Active Directory Privilege Escalation Exploit Detected on Host	Resource Development	T1584.001	9
Outbreak: Adobe ColdFusion Access Control Bypass Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Akira Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Androxgh0st Malware Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Apache ActiveMQ Ransomware Attack Detected on Host	Lateral Movement	T1210	10
Outbreak: Apache Path Traversal Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Apache Struts 2 RCE Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Host	Lateral Movement	T1210	9
Outbreak: BURNTCIGAR MS Signed Driver Malware detected on Host	Defense Evasion	T1036.001	9
Outbreak: Black Basta Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: CDATA Web Management System RCE Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: CISA Alert AA24-249A Russian Cyber Espionage Attack Detected on Host	Impact	T1485	9
Outbreak: CISA Top 20 Vulnerability detected on Host	Lateral Movement	T1210	9
Outbreak: Cacti Server Command Injection Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: ConnectWise ScreenConnect Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Control Web Panel Login Exploit Detected on Host	Defense Evasion	T1202	9
Outbreak: CosmicEnergy Malware Detected on Host	Lateral Movement	T1210	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Host	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Host	Exploit	none	9
Outbreak: Emotet Malware Activity Detected by FortiClient	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Host	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Network	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found by Forticlient	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Network	Exfiltration	T1041	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: HermeticWiper-Foxblade Malware Detected on Host	Impact	T1485	9
Outbreak: Hive Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Jenkins RCE Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: JetBrains TeamCity Authentication Bypass Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Kaseya REvil Ransomware File Activity Detected on Host	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Suspicious File Hash Found on Host	Initial Access	T1195.002	9
Outbreak: Lazarus RAT Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Mallox Ransomware Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Host	Lateral Movement	T1021.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Host	Resource Development	T1586.002	9
Outbreak: Microsoft Office Follina Vuln Detected on Host	Resource Development	T1584.005	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Microsoft SharePoint Server Elevation of Privilege Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Mitel MiCollab Unauthorized Access Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: PAN OS GlobalProtect Command Injection Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Prestige Ransomware Detected on Host	Resource Development	T1586.002	9
Outbreak: Prestige Ransomware Detected on Network	Resource Development	T1586.002	9
Outbreak: Print Nightmare Activity Detected on Host	Exploit	none	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Host	Lateral Movement	T1210	9
Outbreak: Router Malware Attack Detected on Host	Privilege Escalation	T1068	9
Outbreak: Sunhillo SureLine Command Injection Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: Synacor Zimbra Collaboration Command Execution Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: Sysrv-K Botnet Activity Detected on Host	Resource Development	T1584.005	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Host	Lateral Movement	T1210	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Host	Privilege Escalation	T1068	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Host	Initial Access	T1190	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Host	Lateral Movement	T1210	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Host	Initial Access	T1190	9
Outbreak: Zerobot Botnet Activity Detected on Host	Lateral Movement	T1210	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Host	Privilege Escalation	T1068	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Host	Lateral Movement	T1210	9
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9
Spyware Found And Cleaned	Execution	T1204.001	5

FortiDeceptor via Syslog

Name	Tactic	Technique	Severity
Account Locked: Network Device	Credential Access	T1110.001	9
FortiDeceptor: IPS Attack to Decoy	Lateral Movement	none	9
FortiDeceptor: Successful FTP/TFTP Operations to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful IOT SCADA Operations to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful RDP Login to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful SAMBA Operations to Decoy	Initial Access ICS	T0886	9
FortiDeceptor: Successful SSH Login to Decoy	Initial Access ICS	T0886	9
Suspicious logon attempt	Credential Access	T1110.001	9

FortiEDR via Syslog

Name	Tactic	Technique	Severity
FortiEDR: Inconclusive or PUP Process Blocked	Execution	T1204.002	7
FortiEDR: Inconclusive or PUP Process Detected	Execution	T1204.002	8
FortiEDR: Likely Safe Process Blocked	Execution	T1204.002	2
FortiEDR: Likely Safe Process Detected	Execution	T1204.002	4
FortiEDR: Malicious Process Blocked	Execution	T1204.002	9
FortiEDR: Malicious Process Detected	Execution	T1204.002	10
FortiEDR: Safe Process Blocked	Execution	T1204.002	1
FortiEDR: Safe Process Detected	Execution	T1204.002	3
FortiEDR: Suspicious Process Blocked	Execution	T1204.002	7
FortiEDR: Suspicious Process Detected	Execution	T1204.002	8
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

FortiEMS via Syslog

Name	Tactic	Technique	Severity
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Outbreak: Apache RocketMQ RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Multiple Vendor Camera System Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Nice Linear eMerge Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: SolarView Compact Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: VMware Aria Operations for Networks Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Spyware found but not remediated	Execution	T1204.001	9

FortiGate via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
ARP Exploit	Credential Access	T1557.002	7
Account Locked: Network Device	Credential Access	T1110.001	9
Adware process found	Persistence	none	7
Backdoor Found by Network IPS	Execution	T1204.001	9
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Code Injection Attack detected by NIPS	Execution	none	9
Compromised Host Detected by Network IPS	Persistence	none	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Default password usage	Initial Access	none	7
Distributed DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack on Network Devices by Network IPS	Impact	T1498.001	9
DoS Attack on WLAN Infrastructure by Network IPS	Impact	T1498.001	9
Excessive WLAN Exploits: Same Source	Execution	none	9
FortiGate ICS Alert: Exploitation of Remote Services	Initial Access ICS	T0866	8
FortiGate detects Botnet	Command and Control	none	9
FortiGate: Admin User Added	Persistence	T1136.001	9
FortiGate: Admin User Added via Console	Persistence	T1136.001	9
FortiGate: Admin User Deleted	Impact	T1531	9
FortiGate: Admin User Deleted via Console	Impact	T1531	9
FortiGate: Config Change Detected	Audit	none	7
High Risk Rating Cisco IPS Exploit	Execution	none	9
High Severity Inbound Denied Security Exploit	Execution	none	5
High Severity Inbound Permitted IPS Exploit	Execution	none	9
High Severity Outbound Denied IPS Exploit	Execution	none	9
High Severity Outbound Permitted IPS Exploit	Execution	none	9
High Severity WLAN Attack	Execution	none	9
Host Quarantined by FortiGate	Policy Violation	none	9
IPS/AV Evasion attempts	Defense Evasion	T1211	7
IRC traffic detected	Policy Violation	none	7
Identity Spoofing Exploit	Credential Access	T1557.002	7
Info Leak Exploits	Discovery	none	5
Lateral Movement Detected	Lateral Movement	none	9
Log4J Exploit Request Detected on Network by Fortinet Products	Lateral Movement	T1210	10
Malware found but not remediated	Exfiltration	T1041	9
Malware found by firewall but not remediated	Persistence	none	9
Malware outbreak	Lateral Movement	none	9
Multiple Distinct IPS Events From Same Src	Execution	none	9
Multiple IPS Detected Scans From Same Src	Discovery	T1046	7
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Multiple Login Failures: Net Device: No Source IP	Credential Access	T1110.001	9
OT Modbus Write Command Initiated outside of Purdue Level 2		none	7
Outbreak: 3CX Supply Chain Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ABB Flow Computer Path Traversal Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Active Directory Privilege Escalation Exploit Detected on Network	Resource Development	T1584.001	9
Outbreak: Adobe ColdFusion Access Control Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Akira Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Androxgh0st Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache ActiveMQ Ransomware Attack Detected on Network	Lateral Movement	T1210	10
Outbreak: Apache Commons Text RCE Vulnerability Detected on Network	Resource Development	T1586.002	9
Outbreak: Apache OFBiz RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Path Traversal Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache RocketMQ RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Struts 2 RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Network	Lateral Movement	T1210	9
Outbreak: BURNTCIGAR MS Signed Driver Malware detected on Network	Defense Evasion	T1036.001	9
Outbreak: Black Basta Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: CDATA Web Management System RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: CISA Alert AA24-249A Russian Cyber Espionage Attack Detected on Network	Impact	T1485	9
Outbreak: Cacti Server Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Check Point Quantum Security Gateways Information Disclosure Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Cisco IOS XE Web UI Attack Detected on Network	Lateral Movement	T1210,T1036.004	9
Outbreak: Citrix Bleed Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ConnectWise ScreenConnect Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Control Web Panel Login Exploit Detected on Network	Defense Evasion	T1202	9
Outbreak: CosmicEnergy Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Network	Exfiltration	T1041	9
Outbreak: DARKSIDE Suspicious File Hash Found on Host	Exfiltration	T1041	9
Outbreak: DARKSIDE Suspicious File Hash Found on Network	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Network	Exploit	none	9
Outbreak: Dlink Multiple Devices Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Emotet Malware Activity Detected on Host	Exfiltration	T1041	9
Outbreak: Emotet Malware Activity Detected on Network	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Host	Exfiltration	T1041	9
Outbreak: Emotet Suspicious File Hash Found on Network	Exfiltration	T1041	9
Outbreak: F5 BIG-IP TMM Attack - FortiGate IPS Exploit Permitted	Exploit	none	9
Outbreak: FortiGate Authentication bypass on Administrative Interface	Lateral Movement	T1210	10
Outbreak: FortiManager Command Execution Vulnerability Detected on Device	Lateral Movement	T1210	9
Outbreak: FortiManager Command Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: FortiOS SSLVPN Heap Buffer Overflow attack - CVE-2022-42475 Detected on Network	Lateral Movement	T1210	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: GeoServer RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: HAFNIUM FortiGate Permitted IPS Event	Command and Control	none	9
Outbreak: HAFNIUM Infected File Detected by FortiGate	Command and Control	none	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: HermeticWiper-Foxblade Malware Detected on Network	Impact	T1485	9
Outbreak: Hikvision IP Camera Command Injection Vulnerability CVE-2021-36260 on Network	Lateral Movement	T1210	9
Outbreak: Hive Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Connect Secure and Policy Secure Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Jenkins RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: JetBrains TeamCity Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Joomla CMS Improper Access Check Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Kaseya REvil Ransomware File Activity Detected on Network	Initial Access	T1195.002	9
Outbreak: Kaseya REvil Suspicious File Hash Found on Network	Initial Access	T1195.002	9
Outbreak: Lazarus RAT Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Mallox Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Network	Lateral Movement	T1021.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Network	Resource Development	T1586.002	9
Outbreak: Microsoft Office Follina Vuln Detected on Network	Resource Development	T1584.005	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft SharePoint Server Elevation of Privilege Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Mitel MiCollab Unauthorized Access Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Multiple Vendor Camera System Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Nice Linear eMerge Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Oracle WebLogic Server Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PAN OS GlobalProtect Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PHP CGI OS Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Palo Alto Expedition Missing Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Palo Alto Networks Management Interface Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Print Nightmare Activity Detected on Network	Exploit	none	9
Outbreak: Progress Kemp LoadMaster OS Command Injection Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: Router Malware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9
Outbreak: SUNBURST Suspicious File Hash Match	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash match by Source and Destination	Command And Control	T1095	9
Outbreak: Sandbreak vm2 sandbox module RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ServiceNow Remote Code Execution Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: SolarView Compact Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Spring4Shell Malware Detected on Network	Impact	T1485	9
Outbreak: Sunhillo SureLine Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Synacor Zimbra Collaboration Command Execution Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Sysrv-K Botnet Activity Detected on Network	Resource Development	T1584.005	9
Outbreak: TBK DVR Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Teclib GLPI Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: VMWare Workspace ONE Vulnerability - CVE-2022-22954 on Network	Lateral Movement	T1210	9
Outbreak: VMware Aria Operations for Networks Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: VMware ESXi Server Ransomware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Network	Privilege Escalation	T1068	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Network	Initial Access	T1190	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Wordpress WPGateway Plugin Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Network	Initial Access	T1190	9
Outbreak: Zerobot Botnet Activity Detected on Network	Lateral Movement	T1210	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Network	Privilege Escalation	T1068	9
Outbreak: Zoho ManageEngine RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Router Command Injection Attack Detected on Network	Lateral Movement	T1210	9
P2P traffic detected	Policy Violation	none	7
Phishing attack found but not remediated	Reconnaissance	T1598.002,T1598.003	9
Privilege Escalation Exploits	Privilege Escalation	T1548.004	7
Privileged Command Execution Failure	Privilege Escalation	T1548.002	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Replay Exploit	Credential Access	T1557.002	7
Rootkit found	Persistence	T1014,T1554,T1601.001	9
Session Hijacking Exploit	Credential Access	T1557.002	7
Spam/Malicious Mail Attachment found but not remediated	Collection	T1114.001	7
Spyware Found by Network IPS	Execution	T1204.001	9
Spyware found but not remediated	Execution	T1204.001	9
Stealth Scan using a tool	Discovery	T1046	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
System Exploit Detected by Network IPS	Execution	none	7
System Exploit Detected by Network IPS: Likely Success	Execution	none	9
Targeted System/Application Scan	Discovery	T1046	7
Tunneled traffic detected	Command And Control	T1572	7
WLAN Scan	Discovery	T1046	7
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9
Website access policy violation	Policy Violation	none	5
Website access policy violation: High volume	Policy Violation	none	9
Website access policy violation: Multiple categories	Policy Violation	none	9
Website defacement attack	Impact	T1491.001,T1491.002	9
Wireless MITM attack detected by Network IPS	Credential Access	T1557.002	9

FortiGate via Syslog or Netflow

Name	Tactic	Technique	Severity
End User DNS Queries to Unauthorized DNS Servers	Command And Control	T1568.001	7
Excessive Denied Connections From An External Country	Impact	T1498.001	7
Excessive Denied Connections From Same Src	Impact	T1498.001	8
Excessive Denied Connections To A Port	Impact	T1498.001	7
Excessive Denied Connections To Same Destination	Impact	T1498.001	8
Excessive Denied DNS Queries	Command And Control	T1568.001	6
Excessive End User DNS Queries	Command And Control	T1568.001	7
Excessive End User Mail To Unauthorized Mail Gateways	Exfiltration	T1020.001	8
Excessive SNMP Port 161 Traffic from a Source to the same Destination	Collection	T1602.001	5
Half Open TCP DDOS Attack	Impact	T1498.001	7
Heavy Half Open TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy Half Open TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy ICMP Ping sweep	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy UDP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy UDP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	9
Invalid TCP/UDP Port Traffic	Command And Control	T1571	9
Large Inbound Transfer From Outside My Country	Command And Control	T1071.001	8
Large Outbound Transfer To Outside My Country	Exfiltration	T1048.001	8
Sudden Change In DNS Data Transfer Pattern From A Specific Host	Command And Control	T1568.001	7
Sudden Increase In DNS Requests From A Specific Host	Command And Control	T1568.001	7
TCP DDOS Attack	Impact	T1498.001	8
Traffic to bogon networks	Command and Control	none	8
Unusual ICMP Traffic	Defense Evasion	none	7
Unusually Large ICMP Echo Packets	Command And Control	T1095	9
Blocked File Execution	Execution	none	8
Blocklist User Agent Match	Exfiltration	T1041	9
Dynamically generated host name: malware likely	Command And Control	T1568.002	7
Excessive End User Mail	Collection	T1114.001	8
Excessive ICMP Unreachables	Network	none	6
Heavy Half Open TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy Half Open TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy UDP Port Scan: Multiple Hosts	Discovery	T1046	9
Heavy UDP Port Scan: Single Host	Discovery	T1046	7
ICMP Flood From Same Source	Impact	T1498.001	7
Inbound Traffic from Open Proxies	Command And Control	T1090.002	9
Inbound Traffic from Tor Network	Command And Control	T1090.002	9
Inbound insecure protocol traffic detected	Credential Access	T1552.001	7
Invalid TCP Flags: High Intensity	Discovery	none	9
Invalid TCP Flags: Medium Intensity	Discovery	none	7
Large Outbound Transfer	Exfiltration	T1048.001	8
Log4J Exploit Request Detected By Regex	Lateral Movement	T1210	7
Malware hash match	Exfiltration	T1041	9
OT Permited Traffic not from Purdue Level 3 to Level 2		none	7
OT Permited Traffic not from Purdue Level 3.5 to Level 3		none	7
OT Permited Traffic not from Purdue Level 4 to Level 3.5		none	7
OT Permited Traffic not from Purdue Level 5 to Level 4		none	7
Outbound Traffic to Open Proxies	Command And Control	T1090.002	9
Outbound Traffic to Tor Network	Command And Control	T1090.002	9
Outbound Traffic to Unapproved Public DNS Servers	Policy Violation	none	7
Outbound insecure protocol traffic from non guest network detected	Credential Access	T1552.001	7
Outbreak: DARKSIDE Domain Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Inbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Outbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: FortiGate detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: HAFNIUM Inbound Network Traffic	Command And Control	T1095	9
Outbreak: HAFNIUM Outbound Network Traffic	Command And Control	T1095	9
Outbreak: SUNBURST Outbound Network Traffic	Command And Control	T1095	9
P2P traffic consuming high network bandwidth	Policy Violation	none	7
Permitted Traffic from AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Blocklist DE Malware IP List	Exfiltration	T1041	9
Permitted Traffic from C2 Tracker Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CINS Score Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CertPL Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Cisco Talos Malware IP List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Permitted Traffic from Emerging Threat IP List	Command and Control	none	7
Permitted Traffic from FireHol Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiGuard Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Greensnow Malware IP List	Exfiltration	T1041	9
Permitted Traffic from IPSum Malware IP List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware IP List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Proofpoint Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Snort Malware IP List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware IP List	Exfiltration	T1041	9
Remote Desktop traffic from Internet	Lateral Movement	T1021.001,T1133,T1219	9
Sudden Increase In Firewall Denied Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Denied Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Permitted Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Permitted Traffic From Host	Impact	T1498.001	7
Sudden Increase In Permitted Traffic To Host	Impact	T1498.001	7
Sudden Increase in Firewall Permitted Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase in ICMP Requests From A Host	Impact	T1498.001	7
Sudden Increase in Inbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Outbound Firewall Aggregate Denies	Impact	T1498.001	7
Traffic to AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Traffic to Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Traffic to Blocklist DE Malware IP List	Exfiltration	T1041	9
Traffic to C2 Tracker Malware IP List	Exfiltration	T1041	9
Traffic to CINS Score Malware IP List	Exfiltration	T1041	9
Traffic to CertPL Malware Domain List	Exfiltration	T1041	9
Traffic to Cisco Talos Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware Domain List	Exfiltration	T1041	9
Traffic to DigitalSide Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware URL List	Exfiltration	T1041	9
Traffic to Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Traffic to Emerging Threat IP List	Exfiltration	T1048.001	7
Traffic to FireHol Malware IP List	Exfiltration	T1041	9
Traffic to FortiGuard Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware Domain List	Exfiltration	T1041	9
Traffic to FortiRecon Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware URL List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware Domain List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware IP List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware URL List	Exfiltration	T1041	9
Traffic to Greensnow Malware IP List	Exfiltration	T1041	9
Traffic to IPSum Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware Domain List	Exfiltration	T1041	9
Traffic to MISP Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware URL List	Exfiltration	T1041	9
Traffic to Mandiant Malware Domain List	Exfiltration	T1041	9
Traffic to Mandiant Malware IP List	Exfiltration	T1041	9
Traffic to Mandiant Malware URL List	Exfiltration	T1041	9
Traffic to OpenCTI Malware Domain List	Exfiltration	T1041	9
Traffic to OpenCTI Malware IP List	Exfiltration	T1041	9
Traffic to OpenCTI Malware URL List	Exfiltration	T1041	9
Traffic to OpenPhish Malware URL List	Exfiltration	T1041	9
Traffic to Proofpoint Malware IP List	Exfiltration	T1041	9
Traffic to Snort Malware IP List	Exfiltration	T1041	9
Traffic to ThreatFox Malware URL List	Exfiltration	T1041	9
Traffic to TweetFeed Malware Domain List	Exfiltration	T1041	9
Traffic to TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to TweetFeed Malware URL List	Exfiltration	T1041	9
VNC traffic from Internet	Lateral Movement	T1021.005,T1133,T1219	9

FortiMail via Syslog

Name	Tactic	Technique	Severity
FortiMail Failover	Mail Server	none	7
FortiMail: AntiVirus Phishing URL found	Collection	T1114.001	9
FortiMail: Antispam Malicious URL found	Collection	T1114.001	9
FortiMail: Malicious Spam File Attachment Found	Collection	T1114.001	9
Malware found in mail	Collection	T1114.001	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Network	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Network	Exploit	none	9
Spam/Malicious Mail Attachment found but not remediated	Collection	T1114.001	7

FortiManager via Syslog

Name	Tactic	Technique	Severity
Outbreak: FortiManager Command Execution Vulnerability Detected on Device	Lateral Movement	T1210	9
Outbreak: FortiManager Command Execution Vulnerability Detected on Network	Lateral Movement	T1210	9

FortiNDR Cloud API

Name	Tactic	Technique	Severity
FortiNDR Cloud: High Severity Detection triggered for a Host	Privilege Escalation	T1068	9
FortiNDR Cloud: Low Severity Detection triggered for a Host	Privilege Escalation	T1068	4
FortiNDR Cloud: Moderate Severity Detection triggered for a Host	Privilege Escalation	T1068	7

FortiNDR On-premise via Syslog

Name	Tactic	Technique	Severity
FortiNDR: Attack Chain Blocked	Malware	none	8

FortiNDR via Syslog

Name	Tactic	Technique	Severity
FortiNDR: Attack Chain Permitted	Malware	none	10
Outbreak: DARKSIDE Ransomware File Activity Detected on Network	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Network	Exploit	none	9

FortiProxy via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
ARP Exploit	Credential Access	T1557.002	7
Account Locked: Network Device	Credential Access	T1110.001	9
Adware process found	Persistence	none	7
Backdoor Found by Network IPS	Execution	T1204.001	9
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Code Injection Attack detected by NIPS	Execution	none	9
Compromised Host Detected by Network IPS	Persistence	none	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Default password usage	Initial Access	none	7
Distributed DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack on Network Devices by Network IPS	Impact	T1498.001	9
DoS Attack on WLAN Infrastructure by Network IPS	Impact	T1498.001	9
Excessive WLAN Exploits: Same Source	Execution	none	9
High Risk Rating Cisco IPS Exploit	Execution	none	9
High Severity Inbound Denied Security Exploit	Execution	none	5
High Severity Inbound Permitted IPS Exploit	Execution	none	9
High Severity Outbound Denied IPS Exploit	Execution	none	9
High Severity Outbound Permitted IPS Exploit	Execution	none	9
High Severity WLAN Attack	Execution	none	9
IPS/AV Evasion attempts	Defense Evasion	T1211	7
IRC traffic detected	Policy Violation	none	7
Identity Spoofing Exploit	Credential Access	T1557.002	7
Info Leak Exploits	Discovery	none	5
Lateral Movement Detected	Lateral Movement	none	9
Log4J Exploit Request Detected on Network by Fortinet Products	Lateral Movement	T1210	10
Malware found but not remediated	Exfiltration	T1041	9
Malware found by firewall but not remediated	Persistence	none	9
Malware outbreak	Lateral Movement	none	9
Multiple Distinct IPS Events From Same Src	Execution	none	9
Multiple IPS Detected Scans From Same Src	Discovery	T1046	7
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Outbreak: 3CX Supply Chain Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ABB Flow Computer Path Traversal Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Active Directory Privilege Escalation Exploit Detected on Network	Resource Development	T1584.001	9
Outbreak: Adobe ColdFusion Access Control Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Adobe ColdFusion Deserialization of Untrusted Data Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Agent Tesla Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Akira Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Androxgh0st Malware Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache ActiveMQ Ransomware Attack Detected on Network	Lateral Movement	T1210	10
Outbreak: Apache Commons Text RCE Vulnerability Detected on Network	Resource Development	T1586.002	9
Outbreak: Apache OFBiz RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Path Traversal Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache RocketMQ RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Apache Struts 2 RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Confluence CVE-2022-26134 Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Atlassian Pre-Auth Arbitrary File Read Vuln detected on Network	Lateral Movement	T1210	9
Outbreak: Black Basta Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: CDATA Web Management System RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: CISA Alert AA24-249A Russian Cyber Espionage Attack Detected on Network	Impact	T1485	9
Outbreak: Cacti Server Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Check Point Quantum Security Gateways Information Disclosure Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Cisco IOS XE Web UI Attack Detected on Network	Lateral Movement	T1210,T1036.004	9
Outbreak: Citrix Bleed Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: ConnectWise ScreenConnect Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Control Web Panel Login Exploit Detected on Network	Defense Evasion	T1202	9
Outbreak: CosmicEnergy Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: Dlink Multiple Devices Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: FortiGate Authentication bypass on Administrative Interface	Lateral Movement	T1210	10
Outbreak: FortiOS SSLVPN Heap Buffer Overflow attack - CVE-2022-42475 Detected on Network	Lateral Movement	T1210	9
Outbreak: Fortra GoAnywhere MFT RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: GeoServer RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Google Chromium WebP Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Host	Lateral Movement	T1210	9
Outbreak: HTTP2 Rapid Reset Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Hikvision IP Camera Command Injection Vulnerability CVE-2021-36260 on Network	Lateral Movement	T1210	9
Outbreak: Hive Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: IBM Aspera Faspex Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Connect Secure and Policy Secure Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Ivanti Endpoint Manager Mobile Authentication Bypass Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Jenkins RCE Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: JetBrains TeamCity Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Joomla CMS Improper Access Check Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Lazarus RAT Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Mallox Ransomware Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Driver RCE vulnerability - CVE-2022-26809 Detected on Network	Lateral Movement	T1021.002	9
Outbreak: Microsoft Exchange Autodiscover RCE ProxyNotShell Detected on Network	Resource Development	T1586.002	9
Outbreak: Microsoft Office Follina Vuln Detected on Network	Resource Development	T1584.005	9
Outbreak: Microsoft Office and Windows HTML RCE Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft Outlook Elevation of Privilege Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Microsoft SharePoint Server Elevation of Privilege Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Mitel MiCollab Unauthorized Access Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Multiple Vendor Camera System Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Nice Linear eMerge Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Oracle WebLogic Server Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PAN OS GlobalProtect Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: PHP CGI OS Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Palo Alto Expedition Missing Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Palo Alto Networks Management Interface Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: PaperCut MF/NG Improper Access Control Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress Kemp LoadMaster OS Command Injection Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress MOVEit Transfer SQL Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Progress Telerik UI Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Realtek SDK Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Redigo Malware Detected on Network	Lateral Movement	T1210	9
Outbreak: Router Malware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9
Outbreak: Sandbreak vm2 sandbox module RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ServiceNow Remote Code Execution Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: SolarView Compact Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Spring4Shell Malware Detected on Network	Impact	T1485	9
Outbreak: Sunhillo SureLine Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Synacor Zimbra Collaboration Command Execution Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Sysrv-K Botnet Activity Detected on Network	Resource Development	T1584.005	9
Outbreak: TBK DVR Authentication Bypass Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: TP-Link Archer AX-21 Command Injection Attack Detected on Network	Lateral Movement	T1210	9
Outbreak: Teclib GLPI Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: ThinkPHP Remote Code Execution Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: VMWare Workspace ONE Vulnerability - CVE-2022-22954 on Network	Lateral Movement	T1210	9
Outbreak: VMware Aria Operations for Networks Command Injection Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: VMware ESXi Server Ransomware Attack Detected on Network	Privilege Escalation	T1068	9
Outbreak: VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: Win32k Elevation of Privilege Vulnerability Detected on Network	Privilege Escalation	T1068	9
Outbreak: Windows HTTP Protocol Stack RCE Detected on Network	Initial Access	T1190	9
Outbreak: WooCommerce Payments Improper Authentication Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Wordpress WPGateway Plugin Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: X.509 Email Address Buffer Overflow in OpenSSL 3.0.0 to 3.0.6 detected on Network	Initial Access	T1190	9
Outbreak: Zerobot Botnet Activity Detected on Network	Lateral Movement	T1210	9
Outbreak: Zimbra Collaboration Mboximport Vulnerability on Network	Privilege Escalation	T1068	9
Outbreak: Zoho ManageEngine RCE Vulnerability Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Multiple Firewall Vuln Detected on Network	Lateral Movement	T1210	9
Outbreak: Zyxel Router Command Injection Attack Detected on Network	Lateral Movement	T1210	9
P2P traffic detected	Policy Violation	none	7
Phishing attack found but not remediated	Reconnaissance	T1598.002,T1598.003	9
Privilege Escalation Exploits	Privilege Escalation	T1548.004	7
Privileged Command Execution Failure	Privilege Escalation	T1548.002	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Replay Exploit	Credential Access	T1557.002	7
Rootkit found	Persistence	T1014,T1554,T1601.001	9
Session Hijacking Exploit	Credential Access	T1557.002	7
Spam/Malicious Mail Attachment found but not remediated	Collection	T1114.001	7
Spyware Found by Network IPS	Execution	T1204.001	9
Spyware found but not remediated	Execution	T1204.001	9
Stealth Scan using a tool	Discovery	T1046	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
System Exploit Detected by Network IPS	Execution	none	7
System Exploit Detected by Network IPS: Likely Success	Execution	none	9
Targeted System/Application Scan	Discovery	T1046	7
Tunneled traffic detected	Command And Control	T1572	7
WLAN Scan	Discovery	T1046	7
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9
Website access policy violation	Policy Violation	none	5
Website access policy violation: High volume	Policy Violation	none	9
Website access policy violation: Multiple categories	Policy Violation	none	9
Website defacement attack	Impact	T1491.001,T1491.002	9
Wireless MITM attack detected by Network IPS	Credential Access	T1557.002	9

FortiRecon via HTTPS Advanced API Integration

Name	Tactic	Technique	Severity
Exposed Service Detected on Host	Lateral Movement	T1210	9
FortiRecon: Certificate Issue Found for an Asset	Lateral Movement	T1210	9
FortiRecon: High Severity Reputation Issue Found for an Asset	Lateral Movement	T1210	9
FortiRecon: Leaked Credit or Debit Cards Found Online	Collection	T1119	9

FortiSandbox via Syslog

Name	Tactic	Technique	Severity
FortiSandbox detects Botnet	Command and Control	none	9
FortiSandbox detects Network Attack	Execution	none	7
FortiSandbox detects Phishing URL	Execution	T1204.001	9
FortiSandbox detects URL Malware	Exfiltration	T1041	9
FortiSandbox detects file malware with high or medium risk	Exfiltration	T1041	9
FortiSandbox detects malicious file malware from file upload	Exfiltration	T1041	9
FortiSandbox detects multiple attacks from same source	Lateral Movement	none	9
FortiSandbox detects multiple hosts with infected files	Exfiltration	T1041	9
FortiSandbox detects unknown risk file malware	Exfiltration	T1041	7
Outbreak: DARKSIDE Ransomware File Activity Detected on Host	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Host	Exploit	none	9
Outbreak: SUNBURST Suspicious File Hash Match	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash match by Source and Destination	Command And Control	T1095	9

FortiSIEM

Name	Tactic	Technique	Severity
FortiSIEM DB Leader Changed	FortiSIEM	none	7
FortiSIEM Replication Leader Changed	FortiSIEM	none	7

FortiSIEM Machine Learning based Detecion

Name	Tactic	Technique	Severity
Machine Learning Anomaly Detected	Policy Violation	none	7

FortiSIEM Profiling

Name	Tactic	Technique	Severity
Sudden Increase In System CPU Usage	Impact	T1499.001	7
Sudden Increase in Network Interface Errors	Interface	none	7
Sudden Increase in Network Interface Traffic	Impact	T1498.001	7
Sudden Increase in System Memory Usage	Impact	T1499.001	7

FortiSIEM Self Monitoring

Name	Tactic	Technique	Severity
ES Coordinator Node Down	Network	none	7
ES Coordinator Node Staying Down	Network	none	9
ClickHouse Log Integrity System Errors Detected	FortiSIEM	none	9
ClickHouse Log Integrity Violation Detected	FortiSIEM	none	7
Discovered Device Incorrectly Merged: Overlapping IP	FortiSIEM	none	5
Elasticsearch Disaster Recovery: Restore Failed	FortiSIEM	none	9
Elasticsearch Disaster Recovery: Snapshot Failed	FortiSIEM	none	9
EventDB: Event Retention Policy Error	FortiSIEM	none	9
EventDB: Event Retention Policy Violation	FortiSIEM	none	9
EventDB: Excessive Data Retention Policy Execution Time	FortiSIEM	none	8
External Event Dropped By License	FortiSIEM	none	7
FortiSIEM Agent Operational Error	FortiSIEM	none	7
FortiSIEM Archive Purging Completed	FortiSIEM	none	4
FortiSIEM Archive Purging Failed	FortiSIEM	none	9
FortiSIEM Archive Purging Started	FortiSIEM	none	10
FortiSIEM CMDB Disk space low - prune failed to keep free disk space above high threshold	FortiSIEM	none	9
FortiSIEM CMDB Disk space low - prune successful	FortiSIEM	none	4
FortiSIEM ClickHouse Storage Space Critical	FortiSIEM	none	9
FortiSIEM ClickHouse Storage Space Low	FortiSIEM	none	6
FortiSIEM EPS License Exceeded	FortiSIEM	none	9
FortiSIEM Event Archiving Completed	FortiSIEM	none	4
FortiSIEM Event Archiving Failed	FortiSIEM	none	9
FortiSIEM EventDB event store failed	FortiSIEM	none	10
FortiSIEM Online Event Successfully Purged	FortiSIEM	none	4
FortiSIEM Performance Monitoring Relay Not Working: All Devices delayed	FortiSIEM	none	9
FortiSIEM Report Server Removed After License Expiry	FortiSIEM	none	10
FortiSIEM User Created	Persistence	T1136.001	7
FortiSIEM: Low Available Archive Space	FortiSIEM	none	5
FortiSIEM: Low Available EventDB Storage	FortiSIEM	none	4
FortiSIEM: Too Many Unknown Events	FortiSIEM	none	9
Host/User risk increased and crossed High threshold	FortiSIEM	none	9
Host/User risk increased and crossed Medium threshold	FortiSIEM	none	6
Inbound Incident Integration Error	FortiSIEM	none	7
Incident Notification Error	FortiSIEM	none	9
Large Supervisor JMS Request Queue	FortiSIEM	none	9
Large Supervisor JMS System Queue	FortiSIEM	none	9
Large Worker Input Event Queue	FortiSIEM	none	9
Large Worker Input SVN Queue	FortiSIEM	none	9
Missing specific performance metric from a device	FortiSIEM	none	5
No Events Reported From External Apps In Last Hour	FortiSIEM	none	10
No Events Reported From External Devices In Last Hour	FortiSIEM	none	10
No logs from a device	FortiSIEM	none	6
No logs from any device via Collector/Worker	FortiSIEM	none	9
No performance metrics from a device	FortiSIEM	none	5
Outbound Incident Integration Error	FortiSIEM	none	9
Performance Monitoring Error	FortiSIEM	none	5
Performance monitoring jobs deleted by discovery	FortiSIEM	none	5
Performance monitoring jobs not picked up for execution	FortiSIEM	none	5
Scheduled Report Send Error	FortiSIEM	none	9
System Collector Event Delayed	FortiSIEM	none	6

FortiSIEM via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Account Locked: FortiSIEM	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

FortiSwitch via Syslog

Name	Tactic	Technique	Severity
Account Locked: Network Device	Credential Access	T1110.001	9

FortiWeb Cloud via Syslog

Name	Tactic	Technique	Severity
FortiWeb: Permitted Inbound Attack Detected	Lateral Movement	T1210	9

FortiWeb via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
FortiWeb Connection Limit Reached	Impact	T1499.002	9
FortiWeb: Permitted Inbound Attack Detected	Lateral Movement	T1210	9
Lateral Movement Detected	Lateral Movement	none	9
Outbreak: DARKSIDE Ransomware File Activity Detected on Network	Exfiltration	T1041	9
Outbreak: DEARCRY Infected File Detected on Network	Exploit	none	9
Outbreak: FortiWeb detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected VMware Spring Cloud Func RCE Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: FortiWeb detected Zerobot Botnet Activity on Network	Lateral Movement	T1210	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9
Website access policy violation	Policy Violation	none	5
Website access policy violation: High volume	Policy Violation	none	9
Website access policy violation: Multiple categories	Policy Violation	none	9

Foundry Ironware Config Change Monitoring via Syslog

Name	Tactic	Technique	Severity
Running Config Change: with login info	Defense Evasion	T1562.004	6
Startup Config Change: with login	Defense Evasion	T1562.004	6

Google GCP via GOOGLE_Pub_Sub

Name	Tactic	Technique	Severity
GCP: Firewall Rule Created	Defense Evasion	T1562.007	4
GCP: Firewall Rule Deleted	Defense Evasion	T1562.007	8
GCP: Firewall Rule Updated	Defense Evasion	T1562.007	8
GCP: IAM Custom Role Created	Persistence	T1078.004	9
GCP: IAM Custom Role Deleted	Impact	T1531	9
GCP: IAM Member assigned role of type admin or owner	Persistence	T1098.001	9
GCP: Logging Sink Deleted	Defense Evasion	T1562.008	8
GCP: Logging Sink Updated	Defense Evasion	T1562.008	6
GCP: Pub/Sub Subscription Created	Collection	T1119	6
GCP: Pub/Sub Subscription Deleted	Defense Evasion	T1562.008	6
GCP: Pub/Sub Topic Created	Collection	T1119	6
GCP: Pub/Sub Topic Deleted	Defense Evasion	T1562.008	6
GCP: Service Account Access Key Created	Persistence	T1098.001	9
GCP: Service Account Access Key Deleted	Impact	T1531	6
GCP: Service Account Created	Persistence	T1136.003	9
GCP: Service Account Deleted	Impact	T1531	9
GCP: Service Account Disabled	Impact	T1531	8
GCP: Storage Bucket IAM Permissions Modified	Collection	T1530	6
GCP: Storage Bucket Updated	Collection	T1530	6
GCP: Storage or Logging Bucket Deleted	Defense Evasion	T1562.008	6
GCP: VPC Network Deleted	Audit	none	9
GCP: VPC Route Added	Audit	none	6
GCP: VPC Route Deleted	Audit	none	6

Google Workspace via GOOGLE_APPS_ADMIN_SDK

Name	Tactic	Technique	Severity
Google Workspace: 2FA Enforcement Disabled for Organization	Audit	none	9
Google Workspace: 2FA Verification Disabled for Organization	Audit	none	10
Google Workspace: API Access Permitted for OAUTH Client	Persistence	T1098.001	7
Google Workspace: Application Added to Domain	Audit	none	9
Google Workspace: Domain added to Trusted Domains List	Audit	none	9
Google Workspace: Password Management Policy Changed	Audit	none	9
Google Workspace: Role Assigned to User	Persistence	T1098.001	9
Google Workspace: Role Created by User	Persistence	T1098.001	9
Google Workspace: Role Deleted by User	Audit	none	9
Google Workspace: Role Modified by User	Persistence	T1098.001	9
Uncommon GSuite Login	Initial Access	T1078.004	7

Hillstone Firewall via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8

Hillstone Firewall Via Syslog

Name	Tactic	Technique	Severity
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

HP Procurve via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

IBM AIX via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

IBM DB2 via JDBC

Name	Tactic	Technique	Severity
Database DDL changes	Audit	none	7
Database user or group changes	Persistence	T1098.001	7
Multiple Logon Failures: Database	Credential Access	T1110.001	9
Multiple Logon Failures: Misc App	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: Database	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Suspicious Database Logon	Initial Access	T1078.003	7

InfoBlox NiOS via Syslog

Name	Tactic	Technique	Severity
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6

Isilon OneFS Monitoring via SNMP

Name	Tactic	Technique	Severity
Isilon Protocol Latency Critical	Impact	T1499.001	9

JBOSS via Syslog

Name	Tactic	Technique	Severity
Brute Force App Login Success	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9

Juniper JunOS via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Juniper SRX via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8

Juniper SRX Via Syslog

Name	Tactic	Technique	Severity
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Juniper SSG via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Juniper SSLVPN via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9

Liebert FPC Monitoring via SNMP

Name	Tactic	Technique	Severity
FPC Current THD high	Environmental	none	9
FPC Voltage THD high	Environmental	none	9
FPC ground current high	Environmental	none	9

Liebert HVAC Mionitoring via SNMP

Name	Tactic	Technique	Severity
HVAC humidity high	HVAC	none	9
HVAC humidity low	HVAC	none	9
HVAC temp high	HVAC	none	9
HVAC temp low	HVAC	none	9

Linux File Monitoring via FortiSIEM Agent

Name	Tactic	Technique	Severity
Linux: Creation of Kernel Module	Persistence	T1547.006	5
Linux: Creation or Modification of Systemd Service	Persistence	T1543.002	5
Linux: Job Schedule Modification	Persistence	T1053.003	5
Linux: Modifications of .bash-profile and .bashrc	Persistence	T1546.004	7
Linux: Sudoers File Modification	Privilege Escalation	T1548.003	9
Modification of ld.so.preload	Defense Evasion	T1055.009	5

Linux FIM via FortiSIEM Agent

Name	Tactic	Technique	Severity
Agent FIM: Linux Directory Ownership or Permission Changed	Defense Evasion	T1222.002,T1565.001	7
Agent FIM: Linux File Changed From Baseline	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Linux File Ownership or Permission Changed	Defense Evasion	T1222.002,T1565.001	9
Agent FIM: Linux File or Directory Created	Collection	T1074.001,T1565.001	7
Agent FIM: Linux File or Directory Deleted	Defense Evasion	T1070.004,T1565.001	7

Linux Performance Monitoring via SNMP or FortiSIEM Agent

Name	Tactic	Technique	Severity
Database Server Disk Latency Critical	Storage I/O	none	8
Important process down	Impact	T1489	7
Important process staying Down	Impact	T1489	9

Linux Process Monitoring via FortiSIEM Agent

Name	Tactic	Technique	Severity
Enumeration of System Information	Discovery	T1082	5
Linux Account Discovery via Built-In Tools	Discovery	T1087.001	5
Linux: Attempt to Disable CarbonBlack Service	Defense Evasion	T1562.004	9
Linux: Attempt to Disable Crowdstrike Service	Defense Evasion	T1562.004	9
Linux: Attempt to Disable Syslog Service	Defense Evasion	T1562.004	9
Linux: Attempts to Disable IPTables or Firewall	Defense Evasion	T1562.004	9
Linux: Base16/32/64 Encoding/Decoding Activity	Defense Evasion	T1140	7
Linux: Clear System Logs	Defense Evasion	T1070.002	9
Linux: Command Line History Deleted	Defense Evasion	T1070.003	9
Linux: Creation of an Archive with Common Archivers	Collection	T1074.001	5
Linux: Deobfuscate/Decode Files or Information via hexdump	Command And Control	T1132.001	7
Linux: Discovery of Domain Groups	Discovery	T1069.002	5
Linux: Discovery of Network Environment via Built-in Tools	Discovery	T1016.001	5
Linux: File Deletion via Shred	Defense Evasion	T1070.004	9
Linux: File Permission Modification in Writable Absolute Directory By non-root user	Defense Evasion	T1222.002	7
Linux: File Permission Modification in Writable Relative Directory By non-root user	Defense Evasion	T1222.002	7
Linux: Hidden Files and Directories Created	Defense Evasion	T1564.001	7
Linux: Hping Process Activity	Discovery	T1018	7
Linux: Interactive Terminal Spawned via Perl	Execution	T1059.004	5
Linux: Interactive Terminal Spawned via Python	Execution	T1059.006	5
Linux: Kernel Module Enumeration	Discovery	T1518.001	5
Linux: Kernel Module Modification	Persistence	T1547.006	7
Linux: Kernel Module Removed	Defense Evasion	T1562.001	7
Linux: Mknod Process Activity	Command And Control	T1071.004	7
Linux: NMAP Process Activity	Reconnaissance	T1592.002,T1595.001	7
Linux: Netcat Process Activity	Execution	T1059.004	7
Linux: Network Sniffing via Tcpdump	Credential Access	T1040	5
Linux: Nping Process Activity	Reconnaissance	T1595.001	7
Linux: Potential DNS Tunneling via Iodine	Command And Control	T1071.004	7
Linux: Potential Shell via Web Server	Persistence	T1505.003	7
Linux: Process Discovery via Built-In Applications	Discovery	T1057,T1518.001	5
Linux: Processes with Trailing Spaces	Defense Evasion	T1036.006	7
Linux: Remote Terminal Session Started	Lateral Movement	T1021.004	5
Linux: SELinux Disabled	Defense Evasion	T1562.001	9
Linux: Scheduled Job Execution	Persistence	T1053.003	5
Linux: Searching for Passwords in Files	Credential Access	T1552.001	5
Linux: Setgid Bit Set via chmod	Privilege Escalation	T1548.001	7
Linux: Setuid Bit Set via chmod	Privilege Escalation	T1548.001	7
Linux: System Network Connections Discovery	Discovery	T1049	5
Linux: Timestomping using Touch Command	Defense Evasion	T1070.006	5
Linux: Trap Signals Usage	Privilege Escalation	T1546.005	5
Linux: Unusual Process Execution from Temp	Defense Evasion	T1202	7
Linux: User Discovery via Whoami	Discovery	T1033	5
Linux: Virtual Machine Fingerprinting By non-root User	Discovery	T1082	5
Linux: socat Process Activity	Execution	T1059.004	7
Linux: strace Process Activity		none	7
Password Policy Enumeration	Discovery	T1201	5

Linux via FortiSIEM Agent

Name	Tactic	Technique	Severity
Uncommon Linux process Created	Defense Evasion	T1036.004	7

Linux via SNMP

Name	Tactic	Technique	Severity
High Process CPU: Server	Impact	T1499.003	8
High Process Memory: Server	Impact	T1499.003	8
Server CPU Critical	Impact	T1499.001	9
Server CPU Warning	Impact	T1499.001	5
Server Disk Latency Critical	Impact	T1499.001	9
Server Disk Latency Warning	Impact	T1499.001	5
Server Disk Space Critical	Impact	T1499.001	9
Server Disk space Warning	Impact	T1499.001	5
Server Installed Software Change	Defense Evasion	T1218.001	6
Server Intf Error Critical	Impact	T1499.001	9
Server Intf Error Warning	Impact	T1499.001	5
Server Intf Util Critical	Impact	T1499.001	9
Server Intf Util Warning	Impact	T1499.001	5
Server Memory Critical	Impact	T1499.001	9
Server Memory Warning	Impact	T1499.001	5
Server Network Low Port Staying Down	Network	none	7
Server Swap Memory Critical	Impact	T1499.001	9
Sudden Increase in Server Process Count	Impact	T1499.001	7
Unix Server Health: Critical	Impact	T1499.001	9
Unix Server Health: Warning	Impact	T1499.001	5

Linux via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Account Locked: Server	Credential Access	T1110.001	8
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Linux Account Unlocked	Persistence	T1098.001	7
Linux Buffer overflow	Privilege Escalation	T1547.009	9
Linux User Account Properties Changed	Persistence	T1098.001	7
Linux User Added to Administrative Groups	Persistence	T1098.001	9
Linux User Added to Groups	Persistence	T1098.001	7
Linux User Created	Persistence	T1136.001	8
Linux User Deleted	Persistence	T1098.001	7
Linux User Deleted from Admin Groups	Persistence	T1098.001	9
Linux User Deleted from Groups	Persistence	T1098.001	7
Linux User Name Changed	Persistence	T1098.001	7
Linux User Password Changed	Persistence	T1098.001	7
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Privileged Command Execution Failure	Privilege Escalation	T1548.002	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Shellshock Expression in Log Files	Execution	none	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Linux SSHD Errors	Execution	none	7
Suspicious Linux VSFTPD Errors	Execution	none	7
Suspicious Linux log entries	Execution	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
Unix System Shutting Down	Impact	T1529	6

Name	Tactic	Technique	Severity
Sudden Increase in Failed Logons To A Host	Initial Access	T1078.003	7
Sudden Increase in Successful Logons To A Host	Initial Access	T1078.003	7
Uncommon Linux SSH Login	Initial Access	T1078.002	7
Uncommon VPN Login	Initial Access	T1078.002	7
Uncommon Windows Server Login	Initial Access	T1078.002	7
Uncommon Windows Service	Defense Evasion	T1036.004	7

Microsoft 365 Defender via Graph API

Name	Tactic	Technique	Severity
MS 365 Defender: Delivery Detected	Impact	none	8
MS 365 Defender: Exploit Detected	Execution	none	9
MS 365 Defender: Malware Detected	Exfiltration	T1041	9
MS 365 Defender: Persistence Detected	Persistence	none	8
MS 365 Defender: Suspicious Activity Detected	Persistence	none	7
MS 365 Defender: Unwanted Software Detected	Persistence	none	7

Microsoft 365 Defender via HTTPS_ADVANCED (Graph API)

Name	Tactic	Technique	Severity
MS 365 Defender: Generic Alert	PH_RULE_SECURITY_Suspicious_Activity	none	7
MS 365 Defender: Incident Triggered	Suspicious Activity	none	7
MS 365 Defender: Ingress Tool Transfer Alert	Command And Control	T1105	7
MS 365 Defender: LSASS Memory - Credential Access Alert	Credential Access	T1003.001	9
MS 365 Defender: Masquerading - Execution Alert	Defense Evasion	T1036.004	9
MS 365 Defender: OS Credential Dumping - Suspicious Activity Alert	Credential Access	T1003.007	9
MS 365 Defender: Process Injection - Defense Evasion Alert	Defense Evasion	T1055.001	9
MS 365 Defender: Suspicious PowerShell command line Execution Alert	Execution	T1059.001	7
MS 365 Defender: Suspicious Process Discovery - Discovery Alert	Discovery	T1057	7
MS 365 Defender: Suspicious Task Scheduler activity - Persistence Alert	Persistence	T1053.002	9
MS 365 Defender: System Network Configuration Discovery - Discovery Alert	Discovery	T1016.001	6
MS 365 Defender: System Service Discovery - Discovery Alert	Discovery	T1007	6

Microsoft Azure Event Hub via AZURE_PYTHON_SDK

Name	Tactic	Technique	Severity
Azure Automation Account Created	Initial Access	T1078.004	7
Azure Automation Runbook Created or Modified	Persistence	none	3
Azure Automation Runbook Deleted	Defense Evasion	T1562.001	3
Azure Automation Webhook Created	Persistence	none	3
Azure Blob Container Access Level Modification	Initial Access	T1190	7
Azure Command Execution on Virtual Machine	Execution	T1059.006	5
Azure Conditional Access Policy Modified	Persistence	T1098.001	8
Azure Diagnostic Settings Deleted	Defense Evasion	T1562.008	5
Azure Event Hub Authorization Rule Created or Updated	Initial Access	T1078.004	7
Azure Event Hub Deleted	Defense Evasion	T1562.008	9
Azure External Guest User Invitation	Initial Access	T1078.004	3
Azure Firewall Policy Deleted	Defense Evasion	T1562.007	9
Azure Global Administrator Role Added to PIM User	Persistence	T1098.001	9
Azure Key Vault Modified	Credential Access	T1552.001	9
Azure Network Watcher Deleted	Defense Evasion	T1562.007	5
Azure Privilege Identity Management Role Modified	Persistence	T1098.001	7
Azure Resource Group Deleted	Impact	T1485	5
Azure Storage Account Key Regenerated	Credential Access	T1528	3
MS 365 Defender: Generic Alert	PH_RULE_SECURITY_Suspicious_Activity	none	7
MS 365 Defender: Incident Triggered	Suspicious Activity	none	7
MS 365 Defender: Ingress Tool Transfer Alert	Command And Control	T1105	7
MS 365 Defender: LSASS Memory - Credential Access Alert	Credential Access	T1003.001	9
MS 365 Defender: Masquerading - Execution Alert	Defense Evasion	T1036.004	9
MS 365 Defender: OS Credential Dumping - Suspicious Activity Alert	Credential Access	T1003.007	9
MS 365 Defender: Process Injection - Defense Evasion Alert	Defense Evasion	T1055.001	9
MS 365 Defender: Suspicious PowerShell command line Execution Alert	Execution	T1059.001	7
MS 365 Defender: Suspicious Process Discovery - Discovery Alert	Discovery	T1057	7
MS 365 Defender: Suspicious Task Scheduler activity - Persistence Alert	Persistence	T1053.002	9
MS 365 Defender: System Network Configuration Discovery - Discovery Alert	Discovery	T1016.001	6
MS 365 Defender: System Service Discovery - Discovery Alert	Discovery	T1007	6
Multi-Factor Authentication Disabled for an Azure User	Impact	T1531,T1562.001	9
Possible Consent Grant Attack via Azure-Registered Application	Credential Access	T1528	7
User Added as Owner for Azure Application	Initial Access	T1078.004	9
User Added as Owner for Azure Service Principal	Initial Access	T1078.004	9

Microsoft Azure via Azure CLI

Name	Tactic	Technique	Severity
Azure Infrastructure Discovery	Discovery	T1580	3
Azure Service Discovery	Discovery	T1526	3

Microsoft Defender

Name	Tactic	Technique	Severity
Microsoft ATA Center: Security Alert Triggered	Behavioral Anomaly	none	6

Microsoft Defender for Endpoint via HTTPS_ADVANCED

Name	Tactic	Technique	Severity
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

Microsoft DNS via FortiSIEM Agent

Name	Tactic	Technique	Severity
Excessive Uncommon DNS Queries	Exfiltration	T1048.002	6

Microsoft Entra Identity Protection via HTTPS_ADVANCED (Graph API)

Name	Tactic	Technique	Severity
Microsoft Entra: Identity Protection Risky User Identified	Resource Development	T1586.002	9

Microsoft Exchange monitoring via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Exchange Server Mailbox Queue high	Impact	T1499.002	7
Exchange Server RPC latency high	Impact	T1499.002	7
Exchange Server RPC request high	Impact	T1499.002	7
Exchange Server SMTP Queue high	Impact	T1499.002	7

Microsoft HyperV via OMI

Name	Tactic	Technique	Severity
HyperV Logical Processor Total Run Time Percent Critical	Impact	T1499.001	5
HyperV Disk I/O Warning	Impact	T1499.001	5
HyperV Disk Latency Critical	Impact	T1499.001	9
HyperV Guest Critical	Impact	T1499.001	9
HyperV Guest Hypervisor Run Time Percent Warning	Impact	T1499.001	7
HyperV Logical Processor Total Run Time Percent Warning	Impact	T1499.001	7
HyperV Page fault Critical	Impact	T1499.001	9
HyperV Page fault Warning	Impact	T1499.001	7
HyperV Remaining Guest Memory Warning	Impact	T1499.001	7

Microsoft IIS Performance Monitoring via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
IIS Virtual Memory Critical	Impact	T1499.003	9

Microsoft IIS via FortiSIEM Agent

Name	Tactic	Technique	Severity
Excessive FTP Client Side Errors	Impact	T1498.001	7
Excessive HTTP Client Side Errors	Impact	T1498.001	7
Excessive Web Request Failures	Application	none	7
Outbreak: HAFNIUM Exchange OWA Server Authentication Bypass	Command and Control	none	9
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

Microsoft IIS via Syslog

Name	Tactic	Technique	Severity
Brute Force App Login Success	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9

Microsoft Office 365 via Management Activity API

Name	Tactic	Technique	Severity
Office365: Abnormal Logon Detected	Resource Development	T1586.002	9
Office365: Admin or Delegated User Created Mailbox Forwarding Rule for another User	Collection	T1114.003	9
Office365: Brute Force Login Attempts - Same Source	Credential Access	T1110.003	7
Office365: Brute Force Login Attempts - Same User	Credential Access	T1110.001	7
Office365: Brute Force Logon Success	Credential Access	T1110.003	9
Office365: Delete Message Inbox Rule Created	Collection	T1114.003	9
Office365: Identity Protection Risky Detection Identified	Resource Development	T1586.002	9
Office365: Mailbox Login from Outside My Country	Collection	T1114.002	9
Office365: Mailbox SendAs or SendOnBehalf has occurred	Collection	T1114.003	6
Office365: Move To Folder Inbox Rule Created	Collection	T1114.003	6
Office365: Set-Mailbox Forwarding Action Created	Collection	T1114.003	9
Office365: Strong Authentication Disabled for a User	Resource Development	T1586.002	9
Office365: Suspicious File Type Uploaded	Resource Development	T1608.001	9
Office365: User Mailbox Forwarding Rule Created	Collection	T1114.003	9
Uncommon Office365 Mail Login	Initial Access	T1078.004	7

Microsoft Office365 via Management Activity API

Name	Tactic	Technique	Severity
Uncommon Azure Portal Login	Initial Access	T1078.004	7

Microsoft SQL Server via JDBC

Name	Tactic	Technique	Severity
Database DDL changes	Audit	none	7
Database user or group changes	Persistence	T1098.001	7
Excessively Slow SQL Server DB Query	Database	none	7
Multiple Logon Failures: Database	Credential Access	T1110.001	9
Multiple Logon Failures: Misc App	Credential Access	T1110.001	6
MySQL Database Instance Down	Impact	T1489	9
Repeated Multiple Logon Failures: Database	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
SQL Server Excessive Blocking	Database	none	7
SQL Server Excessive Deadlock	Database	none	7
SQL Server Excessive Full Scan	Discovery	T1046	7
SQL Server Excessive Page Read/Write	Database	none	7
SQL Server Low Buffer Cache Hit Ratio	Database	none	7
SQL Server Low Free Pages in Buffer Pool	Database	none	7
SQL Server Low Log Cache Hit Ratio	Database	none	7
Slow MySQL DB Query	Database	none	7
Suspicious Database Logon	Initial Access	T1078.003	7

Microsoft Windows Application Log via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Excessive Destination Windows DC Replication Failure	Domain Controller	none	9
Excessive Source Windows DC Replication Failure	Domain Controller	none	9
Failed Windows DC Diagnostic Test	Domain Controller	none	9
Microsoft SQL Server Instance Down	Impact	T1489	9
Network Device Failover	Impact	T1529	9
SQL Server scheduled job failed	Database	none	7
Windows Cluster Service Membership Error	Windows Cluster Service	none	9
Windows Cluster Service Quorum Error	Windows Cluster Service	none	9
Windows Cluster Service Startup Error	Windows Cluster Service	none	9
Windows File System Replication Down	Impact	T1489	9
Windows File System Replication Service Communication Error	Windows File System Replication	none	7
Windows File System Replication Service Fatal Internal Error	Windows File System Replication	none	9
Windows File System Replication Sharing violation	Windows File System Replication	none	7
Windows File System Replication Staging quota too small	Windows File System Replication	none	7
Windows: Audit CVE Event	Impact	T1499.004	9
Windows: Backup Catalog Deleted	Defense Evasion	T1070.004	5
Windows: MSI Installation From Suspicious Locations	Persistence	none	5
Windows: MSI Installation From Web	Defense Evasion	T1218.007	5
Windows: MSSQL Add Account To Sysadmin Role	Persistence	none	7
Windows: MSSQL Disable Audit Settings	Persistence	none	7
Windows: MSSQL SPProcoption Set	Persistence	none	7
Windows: MSSQL XPCmdshell Option Change	Persistence	none	7
Windows: MSSQL XPCmdshell Suspicious Execution	Persistence	none	7
Windows: Microsoft Malware Protection Engine Crash	Defense Evasion	T1562.001	7
Windows: Microsoft Malware Protection Engine Crash - WER	Defense Evasion	T1562.001	7
Windows: Potential Credential Dumping Via WER - Application	Credential Access	T1003.001	7
Windows: Restricted Software Access By SRP	Execution	T1072	7
Windows: Suspicious Usage of CVE-2021-34484 or CVE 2022-21919	Persistence	none	3
Windows: Sysinternals Tools AppX Versions Execution	Persistence	none	5

Microsoft Windows AppX Deployment logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Deployment AppX Package Was Blocked By AppLocker	Persistence	none	5
Windows: Deployment Of The AppX Package Was Blocked By The Policy	Persistence	none	5
Windows: Potential Malicious AppX Package Installation Attempts	Persistence	none	5
Windows: Suspicious AppX Package Installation Attempt	Persistence	none	5
Windows: Suspicious AppX Package Locations	Persistence	none	7
Windows: Suspicious Digital Signature Of AppX Package	Persistence	none	5
Windows: Suspicious Remote AppX Package Locations	Persistence	none	7
Windows: Uncommon AppX Package Locations	Persistence	none	5

Microsoft Windows BitsClient logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: BITS Transfer Job Download To Potential Suspicious Folder	Defense Evasion	T1197	7
Windows: BITS Transfer Job With Uncommon Or Suspicious Remote TLD	Defense Evasion	T1197	5

Microsoft Windows Certificate Monitoring via FortiSIEM Agent

Name	Tactic	Technique	Severity
Self-signed Windows Certificate Added		none	6

Microsoft Windows Code Integrity/Operational logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Code Integrity Attempted DLL Load	Persistence	none	7
Windows: Code Integrity Blocked Driver Load	Persistence	none	7

Microsoft Windows Diagnosis Scripted logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Loading Diagcab Package From Remote Path	Persistence	none	7

Microsoft Windows DNS (with debug log enabled) via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows DNS Server: Suspicious DNS Traffic Resolved	Behavioral Anomaly	none	9

Microsoft Windows DNS via FortiSIEM Agent

Name	Tactic	Technique	Severity
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9
Windows: DNS Query for Anonfiles.com Domain - DNS Client	Exfiltration	T1567.002	7
Windows: DNS Query for Ufile.io Upload Domain - DNS Client	Exfiltration	T1567.002	7

Microsoft Windows FIM via FortiSIEM Agent

Name	Tactic	Technique	Severity
Agent FIM: Windows File Changed From Baseline	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Content Modified	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Ownership Changed	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File Permission Changed	Defense Evasion	T1222.001,T1565.001	7
Agent FIM: Windows File or Directory Archive Bit Changed	Defense Evasion	T1070.004,T1565.001	7
Agent FIM: Windows File or Directory Created	Collection	T1074.001,T1565.001	7
Agent FIM: Windows File or Directory Deleted	Defense Evasion	T1070.004,T1565.001	7
Windows Server USB File Write	Exfiltration	T1052.001	7

Microsoft Windows Firewall with Advanced Security logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: New Firewall Exception Rule Added For A Suspicious Folder	Persistence	none	7

Microsoft Windows MSExchange Management Logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Failed MSExchange Transport Agent Installation	Persistence	T1505.002	7

Microsoft Windows OpenSSH/Operational and OpenSSH/Admin Logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: OpenSSH Server Listening On Socket	Lateral Movement	T1021.004	5

Microsoft Windows osquery via FortiSIEM Agent

Name	Tactic	Technique	Severity
Common Windows process launched by unusual parent	Persistence	T1037.001	8
Common Windows process launched from unusual path	Persistence	T1037.001	8
Windows Debugger registry key for common Windows accessibility tools	Privilege Escalation	T1574.002	8
Windows Process with deleted binaries	Defense Evasion	T1070.004	8
Windows process communicating outbound to unusual ports	Execution	T1129	6

Microsoft Windows Performance Monitoring via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
High Process CPU: Server	Impact	T1499.003	8
Auto Service Stopped	Impact	T1489	4
Database Server Disk Latency Critical	Storage I/O	none	8
High Process Memory: Server	Impact	T1499.003	8
Important process down	Impact	T1489	7
Important process staying Down	Impact	T1489	9
Manual Service Started	Server	none	6
Server CPU Critical	Impact	T1499.001	9
Server CPU Warning	Impact	T1499.001	5
Server Disk Latency Critical	Impact	T1499.001	9
Server Disk Latency Warning	Impact	T1499.001	5
Server Disk Space Critical	Impact	T1499.001	9
Server Disk space Warning	Impact	T1499.001	5
Server Intf Error Critical	Impact	T1499.001	9
Server Intf Error Warning	Impact	T1499.001	5
Server Intf Util Critical	Impact	T1499.001	9
Server Intf Util Warning	Impact	T1499.001	5
Server Memory Critical	Impact	T1499.001	9
Server Memory Warning	Impact	T1499.001	5
Server Network Low Port Staying Down	Network	none	7
Server Swap Memory Critical	Impact	T1499.001	9
Sudden Increase in Server Process Count	Impact	T1499.001	7
Windows Server Health: Critical	Impact	T1499.001	9
Windows Server Health: Warning	Impact	T1499.001	5
Windows Server Paging File Usage Critical	Impact	T1499.001	9

Microsoft Windows Powershell Operational Logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Malicious PowerShell Tool: PSAttack Detected	Execution	T1059.001	9
PowerShell Commandlet of Well Known Exploitation Framework Detected	Execution	T1059.001	9
PowerShell Downgrade Attack Detected	Lateral Movement	T1210	8
PowerShell Script Detected Calling a Credential Prompt	Execution	T1059.001	9
Windows: Powershell opening TCP Connection	Command and Control	none	7

Microsoft Windows Print Service log via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Dump Ntds.dit To Suspicious Location	Persistence	none	5
Windows: Ntdsutil Abuse	Persistence	none	5

Microsoft Windows Security Log via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Logon Time Restriction Violation	Credential Access	T1110.001	8
Disabled Windows Account Logon Attempts	Credential Access	T1110.001	9
Failed Account Activity On Prior Disabled Account	Credential Access	T1110.001	8
Group Policy Object Created	Defense Evasion	T1484.001	7
Group Policy Object Modified	Defense Evasion	T1484.001	7
Multiple Windows Accounts Disabled by Administrator	Defense Evasion	none	9
Ransomware detected on a host	Impact	T1486	9
Ransomware outbreak detected	Impact	T1486	10
Successful Account Activity On a Prior Disabled Account	Credential Access	T1110.001	8
Transient Windows Account Usage	Suspicious Activity	none	9
User added to Administrator Group	Persistence	T1136.001	9
User added to Backup Operator Group	Persistence	T1136.001	6
User added to DNS Admin Group	Persistence	T1136.001	9
User added to Domain Admin Group	Persistence	T1136.001	9
User added to Remote Desktop User Group	Persistence	T1136.001	9
User deleted from Administrator Group	Impact	T1531	9
User deleted from Backup Operator Group	Impact	T1531	6
User deleted from DNS Admins Group	Impact	T1531	9
User deleted from Domain Admin Group	Impact	T1531	6
User deleted from Remote Desktop User Group	Impact	T1531	9
Windows Account Unlocked	Persistence	T1098.001	7
Windows Audit Policy Changed	Defense Evasion	T1562.003	7
Windows Groups Changed	Persistence	T1098.001	7
Windows Groups Created	Persistence	T1136.001	7
Windows Groups Deleted	Persistence	T1098.001	7
Windows Logging Service Shutdown	Defense Evasion	T1562.002	9
Windows Security Log Cleared	Defense Evasion	T1070.001	9
Windows Security Log is Full	Defense Evasion	T1070.001	9
Windows User Account Disabled	Persistence	T1098.001	7
Windows User Account Enabled	Persistence	T1098.001	7
Windows User Account Name Changed	Persistence	T1098.001	7
Windows User Account Properties Changed	Persistence	T1098.001	7
Windows User Added to Groups	Persistence	T1098.001	7
Windows User Created	Persistence	T1136.001	7
Windows User Deleted	Persistence	T1098.001	7
Windows User Password Changed	Persistence	T1098.001	7
Windows User Removed from Groups	Persistence	T1098.001	7
Windows User or Group Modification	Persistence	T1098.001	6
Windows failed file access	Collection	T1005,T1565.001	7
Windows successful file access	Collection	T1005,T1565.001	5
Windows: A Member Was Added to a Security-Enabled Global Group	Persistence	none	3
Windows: A Member Was Removed From a Security-Enabled Global Group	Persistence	none	3
Windows: A Rule Has Been Deleted From The Windows Firewall Exception List	Persistence	none	5
Windows: A Security-Enabled Global Group Was Deleted	Persistence	none	3
Windows: AD Object WriteDAC Access	Defense Evasion	T1222.001	9
Windows: AD Privileged Users or Groups Reconnaissance	Discovery	T1087.002	7
Windows: AD User Enumeration	Discovery	T1087.002	5
Windows: ADCS Certificate Template Configuration Vulnerability	Persistence	none	3
Windows: ADCS Certificate Template Configuration Vulnerability with Risky EKU	Persistence	none	7
Windows: Access to ADMIN$ Share	Lateral Movement	T1021.002	3
Windows: Account Tampering - Suspicious Failed Logon Reasons	Persistence	none	5
Windows: Active Directory Replication from Non Machine Account	Credential Access	T1003.006	9
Windows: Active Directory User Backdoors	Persistence	none	7
Windows: Add or Remove Computer from DC	Persistence	none	3
Windows: Addition of Domain Trusts	Initial Access	T1199	5
Windows: Addition of SID History to Active Directory Object	Privilege Escalation	T1134.005	5
Windows: Admin User Remote Logon	Defense Evasion	T1078.003	3
Windows: All Rules Have Been Deleted From The Windows Firewall Configuration	Persistence	none	7
Windows: Application Uninstalled	Impact	T1489	3
Windows: Atera Agent Installation	Command And Control	T1219	7
Windows: Azure AD Health Monitoring Agent Registry Keys Access	Discovery	T1012	5
Windows: Azure AD Health Service Agents Registry Keys Access	Discovery	T1012	5
Windows: BITS Transfer Job Download From Direct IP	Defense Evasion	T1197	7
Windows: BITS Transfer Job Download From File Sharing Domains	Defense Evasion	T1197	7
Windows: BITS Transfer Job Downloading File Potential Suspicious Extension	Defense Evasion	T1197	5
Windows: Cobalt Strike Service Installations: Security Log	Execution	T1569.002	7
Windows: Credential Dumping Tools Service Execution - Security	Execution	T1569.002	7
Windows: DCERPC SMB Spoolss Named Pipe	Lateral Movement	T1021.002	5
Windows: DCOM Internet Explorer.Application Iertutil DLL Hijack: Security Log	Lateral Movement	T1021.003	7
Windows: DPAPI Domain Backup Key Extraction	Credential Access	T1003.004	7
Windows: DPAPI Domain Master Key Backup Attempt	Credential Access	T1003.004	5
Windows: Denied Access To Remote Desktop	Lateral Movement	T1021.001	5
Windows: Device Installation Blocked	Persistence	none	5
Windows: DiagTrackEoP Default Login Username	Persistence	none	9
Windows: Enabled User Right in AD to Control User Objects	Persistence	none	7
Windows: External Disk Drive or USB Storage Device	Initial Access	T1091,T1200	3
Windows: External Remote RDP Logon from Public IP	Initial Access	T1133	5
Windows: External Remote SMB Logon from Public IP	Initial Access	T1133	7
Windows: Failed Logon From Public IP	Initial Access	T1190	5
Windows: Failed to execute Privileged Service LsaRegisterLogonProcess	Credential Access	T1558.003	7
Windows: First Time Seen Remote Named Pipe	Lateral Movement	T1021.002	7
Windows: Generic Password Dumper Activity on LSASS	Credential Access	T1003.001	7
Windows: Hacktool Ruler	Defense Evasion	T1550.002	7
Windows: Hidden Local User Creation	Persistence	T1136.001	7
Windows: HybridConnectionManager Service Installation	Persistence	T1554	7
Windows: ISO Image Mount	Initial Access	T1566.001	5
Windows: Impacket PsExec Execution	Lateral Movement	T1021.002	7
Windows: Important Scheduled Task Deleted/Disabled	Execution	T1053.005	7
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: Security Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: Security Log	Persistence	none	7
Windows: Invoke-Obfuscation STDIN Launcher: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR Launcher: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: Security Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Rundll32: Security Log	Execution	T1059.001	7
Windows: Kerberos Manipulation	Credential Access	T1212	7
Windows: LSASS Access from Non System Account	Credential Access	T1003.001	7
Windows: Local User Creation	Persistence	T1136.001	3
Windows: Locked Workstation	Persistence	none	3
Windows: Login with WMI	Execution	T1047	3
Windows: Metasploit Or Impacket Service Installation Via SMB PsExec	Lateral Movement	T1570	7
Windows: Metasploit SMB Authentication	Lateral Movement	T1021.002	7
Windows: Meterpreter or Cobalt Strike Service Installation: Security Log	Defense Evasion	T1134.002	9
Windows: Microsoft Defender Blocked from Loading Unsigned DLL	Defense Evasion	T1574.002	7
Windows: Mimikatz DC Sync	Credential Access	T1003.006	7
Windows: New Firewall Rule Added In Windows Firewall Exception List	Persistence	none	5
Windows: New or Renamed User Account with $ in Attribute SamAccountName	Persistence	none	7
Windows: Outgoing Logon with New Credentials	Persistence	none	3
Windows: Pass the Hash Activity 2	Defense Evasion	T1550.002	5
Windows: Password Change on Directory Service Restore Mode DSRM Account	Persistence	T1098.003	7
Windows: Password Dumper Activity on LSASS	Credential Access	T1003.001	7
Windows: Password Protected ZIP File Opened	Persistence	none	5
Windows: Password Protected ZIP File Opened Email Attachment	Persistence	none	7
Windows: Password Protected ZIP File Opened Suspicious Filenames	Persistence	none	7
Windows: Persistence and Execution at Scale via GPO Scheduled Task	Execution	T1053.005	7
Windows: PetitPotam Suspicious Kerberos TGT Request	Credential Access	T1187	7
Windows: Possible DC Shadow Attack	Defense Evasion	T1207	5
Windows: Possible Impacket SecretDump Remote Activity	Credential Access	T1003.004	7
Windows: Possible PetitPotam Coerce Authentication Attempt	Credential Access	T1187	7
Windows: Possible Shadow Credentials Added	Persistence	none	7
Windows: Potential Access Token Abuse	Defense Evasion	T1134.001	5
Windows: Potential Active Directory Reconnaissance/Enumeration Via LDAP	Discovery	T1482	5
Windows: Potential Privileged System Service Operation - SeLoadDriverPrivilege	Defense Evasion	T1562.001	5
Windows: Powerview Add-DomainObjectAcl DCSync AD Extend Right	Persistence	none	7
Windows: Processes Accessing the Microphone and Webcam	Collection	T1123	5
Windows: Protected Storage Service Access	Lateral Movement	T1021.002	7
Windows: RDP Login from Localhost	Lateral Movement	T1021.001	7
Windows: RDP over Reverse SSH Tunnel WFP	Command And Control	T1090.002	7
Windows: Reconnaissance Activity	Discovery	T1087.002	7
Windows: Register new Logon Process by Rubeus	Credential Access	T1558.003	9
Windows: Remote Access Tool Services Have Been Installed - Security	Execution	T1569.002	5
Windows: Remote PowerShell Sessions	Execution	T1059.001	7
Windows: Remote Service Activity via SVCCTL Named Pipe	Lateral Movement	T1021.002	5
Windows: Remote Task Creation via ATSVC Named Pipe	Execution	T1053.002	5
Windows: Replay Attack Detected	Persistence	none	7
Windows: RottenPotato Like Attack Pattern	Collection	T1557.001	7
Windows: SAM Registry Hive Handle Request	Credential Access	T1012,T1552.002	9
Windows: SCM Database Handle Failure	Discovery	T1010	5
Windows: SCM Database Privileged Operation	Persistence	none	5
Windows: SMB Create Remote File Admin Share	Lateral Movement	T1021.002	7
Windows: Scanner PoC for CVE-2019-0708 RDP RCE Vuln	Lateral Movement	T1210	9
Windows: Secure Deletion with SDelete	Defense Evasion	T1070.004,T1027.005	5
Windows: Service Installed By Unusual Client - Security	Persistence	none	7
Windows: Standard User In High Privileged Group	Persistence	none	5
Windows: Successful Overpass the Hash Attempt	Defense Evasion	T1550.002	7
Windows: Suspicious Access to Sensitive File Extensions	Collection	T1039	5
Windows: Suspicious Kerberos RC4 Ticket Encryption	Credential Access	T1558.003	5
Windows: Suspicious LDAP-Attributes Used	Command And Control	T1001.003	7
Windows: Suspicious PsExec Execution	Lateral Movement	T1021.002	7
Windows: Suspicious Rejected SMB Guest Logon From IP	Credential Access	T1110.001	5
Windows: Suspicious Remote Logon with Explicit Credentials	Persistence	none	5
Windows: Suspicious Scheduled Task Creation	Execution	T1053.005	7
Windows: Suspicious Scheduled Task Update	Execution	T1053.005	7
Windows: Suspicious Task Added by Bitsadmin	Defense Evasion	T1197	3
Windows: Suspicious Task Added by Powershell	Defense Evasion	T1197	3
Windows: Suspicious Teams Application Related ObjectAcess Event	Credential Access	T1528	7
Windows: Suspicious Windows ANONYMOUS LOGON Local Account Created	Persistence	T1136.002	7
Windows: SysKey Registry Keys Access	Discovery	T1012	9
Windows: Sysmon Channel Reference Deletion	Defense Evasion	T1112	7
Windows: Sysmon Crash	Persistence	none	7
Windows: T1047 Wmiprvse Wbemcomn DLL Hijack	Execution	T1047	7
Windows: Tap Driver Installation	Persistence	none	5
Windows: The Windows Defender Firewall Service Failed To Load Group Policy	Persistence	none	3
Windows: Transferring Files with Credential Data via Network Shares	Credential Access	T1003.001,T1003.002,T1003.003	5
Windows: Unauthorized System Time Modification	Defense Evasion	T1070.006	3
Windows: Unsigned Binary Loaded From Suspicious Location	Defense Evasion	T1574.002	7
Windows: User Added to Local Administrators	Persistence	none	5
Windows: VSSAudit Security Event Source Registration	Credential Access	T1003.002	1
Windows: WCE wceaux dll Access	Lateral Movement	T1550.002	9
Windows: WMI Persistence - Security	Persistence	T1546.003	5
Windows: Windows Defender Exclusion Set	Defense Evasion	T1562.001	7
Windows: Windows Defender Firewall Has Been Reset To Its Default Configuration	Persistence	none	3
Windows: Windows Firewall Settings Have Been Changed	Persistence	none	3
Windows: Windows Network Access Suspicious desktop.ini Action	Persistence	T1547.009	5
Windows: Windows Pcap Drivers	Credential Access	T1040	5

Microsoft Windows Shell Core logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Suspicious Application Installed	Persistence	none	5

Microsoft Windows Sysmon via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows Process Tampering Detected	Defense Evasion	T1055.009	9
DNS Traffic to Anomali ThreatStream Malware Domains	Exfiltration	T1048.001	9
DNS Traffic to FortiGuard Malware Domains	Exfiltration	T1048.001	9
Execution via local SxS Shared Module	Execution	T1129	5
Outbreak: HAFNIUM Suspicious File hash match	Command and Control	none	9
Outbreak: SUNBURST Domain Traffic	Command And Control	T1568.001	9
Outbreak: SUNBURST Suspicious File Created	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash Match	Command and Control	none	9
Outbreak: SUNBURST Suspicious File Hash match by Source and Destination	Command And Control	T1095	9
Uncommon Windows process Created	Defense Evasion	T1036.004	7
Uncommon Windows process via Sysmon	Defense Evasion	T1036.004	7
Windows: 7Zip Compressing Dump Files	Collection	T1560.001	7
Windows: AADInternals PowerShell Cmdlets Execution - ProccessCreation	Persistence	none	7
Windows: AWL Bypass with Winrm.vbs and WsmPty.xsl/WsmTxt.xsl: Sysmon	Persistence	none	5
Windows: AWL Bypass with Winrm.vbs and WsmPty.xsl/WsmTxt.xsl: Sysmon2	Persistence	none	5
Windows: Abuse of Service Permissions to Hide Services Via Set-Service	Defense Evasion	T1574.011	7
Windows: Abused Debug Privilege by Arbitrary Parent Processes	Persistence	none	7
Windows: Abusing IEExec To Download Payloads	Persistence	none	7
Windows: Abusing Print Executable	Persistence	none	5
Windows: Active Directory Database Snapshot Via ADExplorer	Credential Access	T1552.001	5
Windows: Active Directory Kerberos DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Active Directory Parsing DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: Active Directory Structure Export Via Csvde.EXE	Persistence	none	5
Windows: Active Directory Structure Export Via Ldifde.EXE	Persistence	none	5
Windows: Add Insecure Download Source To Winget	Persistence	none	7
Windows: Add New Download Source To Winget	Persistence	none	5
Windows: Add Potential Suspicious New Download Source To Winget	Persistence	none	7
Windows: Add SafeBoot Keys Via Reg Utility	Defense Evasion	T1562.001	7
Windows: Add User to Local Administrators Group	Persistence	none	5
Windows: Add Windows Capability Via PowerShell Cmdlet	Persistence	none	5
Windows: AgentExecutor PowerShell Execution	Persistence	none	5
Windows: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE	Persistence	T1543.003	7
Windows: Always Install Elevated MSI Spawned Cmd And Powershell	Defense Evasion	T1548.002	5
Windows: Always Install Elevated Windows Installer	Defense Evasion	T1548.002	5
Windows: Anydesk Temporary Artefact	Command And Control	T1219	5
Windows: AppInstaller Attempts From URL by DNS	Command And Control	T1105	5
Windows: Application Removed Via Wmic.EXE	Execution	T1047	5
Windows: Application Whitelisting Bypass via Bginfo	Defense Evasion	T1202	5
Windows: Application Whitelisting Bypass via Dnx.exe	Defense Evasion	T1027.004	5
Windows: Application Whitelisting Bypass via Dxcap.exe	Persistence	none	5
Windows: Application Whitelisting Bypass via PresentationHost.exe	Persistence	none	5
Windows: Arbitrary Binary Execution Using GUP Utility	Persistence	none	5
Windows: Arbitrary File Download Via MSPUB.EXE	Persistence	none	5
Windows: Arbitrary MSI Download Via Devinit.EXE	Persistence	none	5
Windows: Arbitrary Shell Command Execution Via Settingcontent-Ms	Initial Access	T1566.001	5
Windows: Aruba Network Service Potential DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Atbroker Registry Change	Persistence	none	5
Windows: Audio Capture via PowerShell	Collection	T1123	5
Windows: Audio Capture via SoundRecorder	Collection	T1123	5
Windows: Audit Policy Tampering Via Auditpol	Defense Evasion	T1562.002	7
Windows: Audit Policy Tampering Via NT Resource Kit Auditpol	Defense Evasion	T1562.002	7
Windows: Automated Collection Command Prompt	Credential Access	T1552.001	5
Windows: Bad Opsec Defaults Sacrificial Processes With Improper Arguments	Defense Evasion	T1218.011	7
Windows: Base64 MZ Header In CommandLine	Persistence	none	7
Windows: BloodHound Collection Files	Discovery	T1482	7
Windows: Boot Configuration Tampering Via Bcdedit.EXE	Impact	T1490	7
Windows: Browser Started with Remote Debugging	Collection	T1185	5
Windows: Bypass UAC via CMSTP	Defense Evasion	T1548.002	7
Windows: Bypass UAC via Fodhelper.exe	Privilege Escalation	T1548.002	7
Windows: Bypass UAC via WSReset.exe	Defense Evasion	T1548.002	7
Windows: CLR DLL Loaded Via Office Applications	Execution	T1204.002	5
Windows: CMSTP Execution Process Access	Execution	T1559.001	7
Windows: CMSTP Execution Process Creation	Defense Evasion	T1218.003	7
Windows: CMSTP Execution Registry Event	Defense Evasion	T1218.003	7
Windows: CMSTP UAC Bypass via COM Object Access	Defense Evasion	T1548.002	7
Windows: Capture Credentials with Rpcping.exe	Persistence	none	5
Windows: Certificate Exported Via Certutil.EXE	Persistence	none	5
Windows: Change Default File Association To Executable Via Assoc	Persistence	T1546.001	7
Windows: Change Default File Association Via Assoc	Persistence	T1546.001	3
Windows: Change PowerShell Policies to an Insecure Level	Execution	T1059.001	5
Windows: Chopper Webshell Process Pattern	Persistence	T1505.003	7
Windows: CleanWipe Usage	Defense Evasion	T1562.001	5
Windows: Cmd.EXE Missing Space Characters Execution Anomaly	Execution	T1059.001	7
Windows: Cobalt Strike Load by Rundll32	Defense Evasion	T1218.011	7
Windows: CobaltStrike BOF Injection Pattern	Defense Evasion	T1562.001	7
Windows: Code Execution via Pcwutl.dll	Defense Evasion	T1218.011	5
Windows: Command Line Execution with Suspicious URL and AppData Strings	Command And Control	T1105	5
Windows: Communication To Ngrok Tunneling Service	Command And Control	T1572	7
Windows: Compress Data and Lock With Password for Exfiltration With 7-ZIP	Collection	T1560.001	5
Windows: Compress Data and Lock With Password for Exfiltration With WINZIP	Collection	T1560.001	5
Windows: Computer Discovery And Export Via Get-ADComputer Cmdlet	Discovery	T1033	5
Windows: Computer Password Change Via Ksetup.EXE	Persistence	none	5
Windows: Computer System Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Conhost Parent Process Executions	Defense Evasion	T1202	5
Windows: Conhost Spawned By Uncommon Parent Process	Persistence	none	5
Windows: Conhost.exe CommandLine Path Traversal	Execution	T1059.003	7
Windows: Connection Initiated Via Certutil.EXE	Command And Control	T1105	7
Windows: Console CodePage Lookup Via CHCP	Persistence	none	5
Windows: Control Panel Items	Defense Evasion	T1218.002	7
Windows: ConvertTo-SecureString Cmdlet Usage Via CommandLine	Execution	T1059.001	5
Windows: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE	Persistence	none	7
Windows: Copy From VolumeShadowCopy Via Cmd.EXE	Impact	T1490	7
Windows: Copy from Admin Share	Collection	T1039	7
Windows: Copying Sensitive Files with Credential Data	Credential Access	T1003.003	7
Windows: CreateDump Process Dump	Credential Access	T1003.001	7
Windows: Created Files by Microsoft Sync Center	Persistence	none	5
Windows: Created Files by Office Applications	Execution	T1204.002	7
Windows: Creation Exe for Service with Unquoted Path	Persistence	T1547.009	7
Windows: Creation Of Non-Existent System DLL	Defense Evasion	T1574.002	5
Windows: Creation of a Diagcab	Persistence	none	5
Windows: Creation of a Local Hidden User Account by Registry	Persistence	T1136.001	7
Windows: Creation of an WerFault.exe in Unusual Folder	Defense Evasion	T1574.001	7
Windows: Cred Dump Tools Dropped Files	Credential Access	T1003.005	7
Windows: Curl Download And Execute Combination	Command And Control	T1105	7
Windows: DLL Execution Via Register-cimprovider.exe	Persistence	none	5
Windows: DLL Execution via Rasautou.exe	Persistence	none	5
Windows: DLL Load By System Process From Suspicious Locations	Persistence	none	7
Windows: DLL Load via LSASS	Persistence	T1547.008	7
Windows: DLL Loaded From Suspicious Location Via Cmspt.EXE	Defense Evasion	T1218.003	7
Windows: DLL Loaded via CertOC.EXE	Persistence	none	5
Windows: DLL Search Order Hijackig Via Additional Space in Path	Defense Evasion	T1574.002	7
Windows: DLL Sideloading Of ShellChromeAPI.DLL	Defense Evasion	T1574.002	7
Windows: DLL Sideloading by Microsoft Defender	Defense Evasion	T1574.002	7
Windows: DLL Sideloading by VMware Xfer Utility	Defense Evasion	T1574.002	7
Windows: DNS Exfiltration and Tunneling Tools Execution	Command And Control	T1048.001,T1071.004,T1132.001	7
Windows: DNS HybridConnectionManager Service Bus	Persistence	T1554	7
Windows: DNS Query for Anonfiles.com Domain - Sysmon	Exfiltration	T1567.002	7
Windows: DNS Query for MEGA.io Upload Domain	Exfiltration	T1567.002	7
Windows: DNS Query for Ufile.io Upload Domain - Sysmon	Exfiltration	T1567.002	7
Windows: Data Compressed - rar.exe	Collection	T1560.001	3
Windows: Delete All Scheduled Tasks	Impact	T1489	7
Windows: Delete Important Scheduled Task	Impact	T1489	7
Windows: Deleted Data Overwritten Via Cipher.EXE	Impact	T1485	5
Windows: Deletion of Volume Shadow Copies via WMI with PowerShell	Impact	T1490	7
Windows: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE	Persistence	T1543.003	7
Windows: Detect Virtualbox Driver Installation OR Starting Of VMs	Defense Evasion	T1564.006	3
Windows: Detected Windows Software Discovery	Persistence	none	5
Windows: Detecting Fake Instances Of Hxtsr.exe	Persistence	none	5
Windows: Detection of PowerShell Execution via Sqlps.exe	Execution	T1059.001	5
Windows: DeviceCredentialDeployment Execution	Persistence	none	5
Windows: Devtoolslauncher.exe Executes Specified Binary	Persistence	none	7
Windows: DirLister Execution	Discovery	T1083	3
Windows: Direct Autorun Keys Modification	Persistence	T1547.001	5
Windows: Directory Removal Via Rmdir	Defense Evasion	T1070.004	3
Windows: Disable Important Scheduled Task	Impact	T1489	7
Windows: Disable Security Events Logging Adding Reg Key MiniNt	Defense Evasion	T1562.001	7
Windows: Disable Windows Defender AV Security Monitoring	Defense Evasion	T1562.001	7
Windows: Disable Windows IIS HTTP Logging	Defense Evasion	T1562.002	7
Windows: Disable of ETW Trace	Defense Evasion	T1562.006	7
Windows: Disabled IE Security Features	Defense Evasion	T1562.001	7
Windows: Disabled RestrictedAdminMode For RDS - ProcCreation	Defense Evasion	T1112	7
Windows: Disabled Volume Snapshots	Defense Evasion	T1562.001	7
Windows: Discovery of a System Time	Discovery	T1124	3
Windows: Dism Remove Online Package	Defense Evasion	T1562.001	5
Windows: DllUnregisterServer Function Call Via Msiexec.EXE	Defense Evasion	T1218.007	5
Windows: Dllhost.EXE Execution Anomaly	Persistence	none	7
Windows: Domain Trust Discovery Via Dsquery	Discovery	T1482	5
Windows: DotNET Assembly DLL Loaded Via Office Application	Execution	T1204.002	5
Windows: DotNet CLR DLL Loaded By Scripting Applications	Persistence	none	7
Windows: Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN	Persistence	none	5
Windows: Download Arbitrary Files Via MSOHTMED.EXE	Persistence	none	5
Windows: Download Arbitrary Files Via PresentationHost.exe	Persistence	none	5
Windows: Download Files Using Notepad GUP Utility	Command And Control	T1105	7
Windows: Download a File with IMEWDBLD.exe	Command And Control	T1105	7
Windows: DriverQuery.EXE Execution	Persistence	none	5
Windows: Drop Binaries Into Spool Drivers Color Folder	Persistence	none	5
Windows: Dropping Of Password Filter DLL	Credential Access	T1556.002	5
Windows: DumpMinitool Execution	Credential Access	T1003.001	5
Windows: DumpStack.log Defender Evasion	Persistence	none	9
Windows: Dumping Process via Sqldumper.exe	Credential Access	T1003.001	5
Windows: Dumping of Sensitive Hives Via Reg.EXE	Credential Access	T1003.005	7
Windows: Dynamic C Sharp Compile Artefact	Defense Evasion	T1027.004	3
Windows: ETW Logging Tamper In .NET Processes	Persistence	none	7
Windows: EVTX Created In Uncommon Location	Defense Evasion	T1562.002	5
Windows: Email Exifiltration Via Powershell	Persistence	none	7
Windows: Empire PowerShell UAC Bypass	Defense Evasion	T1548.002	9
Windows: Enumeration for 3rd Party Creds From CLI	Credential Access	T1552.002	5
Windows: Enumeration for Credentials in Registry	Credential Access	T1552.002	5
Windows: Equation Editor Network Connection	Execution	T1203	7
Windows: Esentutl Gather Credentials	Credential Access	T1003.003	5
Windows: Esentutl Steals Browser Information	Collection	T1005	5
Windows: Esentutl Volume Shadow Copy Service Keys	Credential Access	T1003.002	7
Windows: Exchange PowerShell Snap-Ins Usage	Execution	T1059.001	7
Windows: Execute Arbitrary Commands Using MSDT.EXE: V1	Defense Evasion	T1202	7
Windows: Execute Code with Pester.bat	Execution	T1059.001	5
Windows: Execute Files with Msdeploy.exe	Persistence	none	5
Windows: Execute From Alternate Data Streams	Defense Evasion	T1564.004	5
Windows: Execute MSDT Via Answer File	Persistence	none	7
Windows: Execute Pcwrun.EXE To Leverage Follina	Persistence	none	7
Windows: Execution Of Non-Existing File	Persistence	none	7
Windows: Execution from Suspicious Folder	Persistence	none	7
Windows: Execution in Outlook Temp Folder	Initial Access	T1566.001	7
Windows: Execution of Powershell Script in Public Folder	Persistence	none	7
Windows: Execution of Suspicious File Type Extension	Persistence	none	7
Windows: Execution via WorkFolders.exe	Persistence	none	7
Windows: Execution via stordiag.exe	Persistence	none	7
Windows: Explorer NOUACCHECK Flag	Defense Evasion	T1548.002	7
Windows: Explorer Process Tree Break	Persistence	none	5
Windows: Exports Critical Registry Keys To a File	Discovery	T1012	7
Windows: Exports Registry Key To a File	Discovery	T1012	3
Windows: F-Secure C3 Load by Rundll32	Defense Evasion	T1218.011	9
Windows: Fax Service DLL Search Order Hijack	Defense Evasion	T1574.002	7
Windows: File Creation In Suspicious Directory By Msdt.EXE	Persistence	T1547.001	7
Windows: File Decoded From Base64/Hex Via Certutil.EXE	Persistence	none	5
Windows: File Deletion Via Del	Defense Evasion	T1070.004	3
Windows: File Download Using ProtocolHandler.exe	Persistence	none	5
Windows: File Download Via Bitsadmin	Defense Evasion	T1197	5
Windows: File Download Via Bitsadmin To A Suspicious Target Folder	Defense Evasion	T1197	7
Windows: File Download Via Bitsadmin To An Uncommon Target Folder	Defense Evasion	T1197	5
Windows: File Download with Headless Browser	Command And Control	T1105	7
Windows: File Encoded To Base64 Via Certutil.EXE	Persistence	none	5
Windows: File With Suspicious Extension Downloaded Via Bitsadmin	Defense Evasion	T1197	7
Windows: Files And Subdirectories Listing Using Dir	Discovery	T1217	3
Windows: Files With System Process Name In Unsuspected Locations	Defense Evasion	T1036.005	7
Windows: Filter Driver Unloaded Via Fltmc.EXE	Defense Evasion	T1562.002	7
Windows: Findstr GPP Passwords	Credential Access	T1552.006	7
Windows: Findstr LSASS	Credential Access	T1552.006	7
Windows: Findstr Launching .lnk File	Defense Evasion	T1202	5
Windows: Finger.exe Suspicious Invocation	Command And Control	T1105	7
Windows: Firewall Disabled via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: Firewall Rule Deleted Via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: Format.com FileSystem LOLBIN	Persistence	none	7
Windows: FromBase64String Command Line	Defense Evasion	T1140	7
Windows: Fsutil Behavior Set SymlinkEvaluation	Persistence	none	5
Windows: Fsutil Drive Enumeration	Discovery	T1120	3
Windows: Fsutil Suspicious Invocation	Persistence	none	7
Windows: GAC DLL Loaded Via Office Applications	Execution	T1204.002	7
Windows: GatherNetworkInfo.VBS Reconnaissance Script Output	Persistence	none	5
Windows: GoToAssist Temporary Installation Artefact	Command And Control	T1219	5
Windows: Gpresult Display Group Policy Information	Persistence	none	5
Windows: Gpscript Execution	Persistence	none	5
Windows: Greedy File Deletion Using Del	Defense Evasion	T1070.004	5
Windows: Group Membership Reconnaissance Via Whoami.EXE	Discovery	T1033	5
Windows: Gzip Archive Decode Via PowerShell	Persistence	none	5
Windows: HH.EXE Execution	Defense Evasion	T1218.001	5
Windows: HTML Help HH.EXE Suspicious Child Process	Initial Access	T1566.001	7
Windows: HackTool - ADCSPwn Execution	Collection	T1557.001	7
Windows: HackTool - Bloodhound/Sharphound Execution	Discovery	T1482	7
Windows: HackTool - Certify Execution	Persistence	none	7
Windows: HackTool - Certipy Execution	Persistence	none	7
Windows: HackTool - Covenant PowerShell Launcher	Defense Evasion	T1564.003	7
Windows: HackTool - CrackMapExec Execution	Persistence	none	7
Windows: HackTool - CrackMapExec Execution Patterns	Execution	T1059.003	7
Windows: HackTool - CrackMapExec PowerShell Obfuscation	Execution	T1059.001	7
Windows: HackTool - CrackMapExec Process Patterns	Credential Access	T1003.001	7
Windows: HackTool - CreateMiniDump Execution	Credential Access	T1003.001	7
Windows: HackTool - DInjector PowerShell Cradle Execution	Persistence	none	9
Windows: HackTool - Default PowerSploit/Empire Scheduled Task Creation	Execution	T1059.001	7
Windows: HackTool - Dumpert Process Dumper Default File	Credential Access	T1003.001	9
Windows: HackTool - Dumpert Process Dumper Execution	Credential Access	T1003.001	9
Windows: HackTool - Empire PowerShell Launch Parameters	Execution	T1059.001	7
Windows: HackTool - GMER Rootkit Detector and Remover Execution	Persistence	none	7
Windows: HackTool - HandleKatz LSASS Dumper Execution	Credential Access	T1003.001	7
Windows: HackTool - Htran/NATBypass Execution	Persistence	none	7
Windows: HackTool - Impersonate Execution	Defense Evasion	T1134.003	5
Windows: HackTool - Inveigh Execution	Credential Access	T1003.001	9
Windows: HackTool - Koadic Execution	Execution	T1059.007	7
Windows: HackTool - KrbRelay Execution	Credential Access	T1558.003	7
Windows: HackTool - KrbRelayUp Execution	Credential Access	T1558.003	7
Windows: HackTool - LocalPotato Execution	Persistence	none	7
Windows: HackTool - Mimikatz Execution	Credential Access	T1003.006	7
Windows: HackTool - PCHunter Execution	Persistence	none	7
Windows: HackTool - PPID Spoofing SelectMyParent Tool Execution	Defense Evasion	T1134.004	7
Windows: HackTool - Potential Impacket Lateral Movement Activity	Execution	T1047	7
Windows: HackTool - PowerTool Execution	Defense Evasion	T1562.001	7
Windows: HackTool - PurpleSharp Execution	Persistence	none	9
Windows: HackTool - Quarks PwDump Execution	Credential Access	T1003.002	7
Windows: HackTool - RedMimicry Winnti Playbook Execution	Defense Evasion	T1218.011	7
Windows: HackTool - Rubeus Execution	Credential Access	T1558.003	9
Windows: HackTool - SILENTTRINITY Stager DLL Load	Persistence	none	7
Windows: HackTool - SILENTTRINITY Stager Execution	Persistence	none	7
Windows: HackTool - SafetyKatz Execution	Credential Access	T1003.001	9
Windows: HackTool - SecurityXploded Execution	Persistence	none	9
Windows: HackTool - SharPersist Execution	Persistence	none	7
Windows: HackTool - SharpChisel Execution	Command And Control	T1090.001	7
Windows: HackTool - SharpEvtMute DLL Load	Defense Evasion	T1562.002	7
Windows: HackTool - SharpEvtMute Execution	Defense Evasion	T1562.002	7
Windows: HackTool - SharpImpersonation Execution	Defense Evasion	T1134.003	7
Windows: HackTool - SharpLDAPmonitor Execution	Persistence	none	5
Windows: HackTool - SharpLdapWhoami Execution	Discovery	T1033	7
Windows: HackTool - SharpUp PrivEsc Tool Execution	Defense Evasion	T1574.005	9
Windows: HackTool - Sliver C2 Implant Activity Pattern	Persistence	none	9
Windows: HackTool - Stracciatella Execution	Defense Evasion	T1562.001	7
Windows: HackTool - SysmonEOP Execution	Privilege Escalation	T1068	9
Windows: HackTool - TruffleSnout Execution	Discovery	T1482	7
Windows: HackTool - Windows Credential Editor WCE Execution	Credential Access	T1003.001	9
Windows: HackTool - Wmiexec Default Powershell Command	Persistence	none	7
Windows: HackTool - winPEAS Execution	Discovery	T1082	7
Windows: HandleKatz Duplicating LSASS Handle	Execution	T1106	7
Windows: Hardware Model Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Harvesting Of Wifi Credentials Via Netsh.EXE	Credential Access	T1040	5
Windows: Hidden Powershell in Link File Pattern	Execution	T1059.001	5
Windows: Hiding Files with Attrib.exe	Defense Evasion	T1564.001	5
Windows: High Integrity Sdclt Process	Defense Evasion	T1548.002	5
Windows: Hijack Legit RDP Session to Move Laterally	Credential Access	T1557.002	7
Windows: HybridConnectionManager Service Installation: Sysmon	Persistence	none	7
Windows: Hydra Password Guessing Hack Tool	Credential Access	T1110.001	7
Windows: IIS Native-Code Module Command Line Installation	Persistence	T1505.003	5
Windows: ISO File Created Within Temp Folders	Initial Access	T1566.001	7
Windows: ISO or Image Mount Indicator in Recent Files	Persistence	none	5
Windows: Ie4uinit Lolbin Use From Invalid Path	Persistence	none	5
Windows: ImagingDevices Unusual Parent/Child Processes	Persistence	none	7
Windows: Impacket Tool Execution	Collection	T1557.001	7
Windows: Import LDAP Data Interchange Format File Via Ldifde.EXE	Command And Control	T1105	5
Windows: Import PowerShell Modules From Suspicious Directories - ProcCreation	Execution	T1059.001	5
Windows: Imports Registry Key From a File	Defense Evasion	T1112	5
Windows: Imports Registry Key From an ADS	Defense Evasion	T1112	7
Windows: Indirect Command Execution By Program Compatibility Wizard	Persistence	none	3
Windows: InfDefaultInstall.exe .inf Execution	Persistence	none	5
Windows: Install New Package Via Winget Local Manifest	Persistence	none	5
Windows: Installation of TeamViewer Desktop	Command And Control	T1219	5
Windows: Interactive AT Job	Execution	T1053.002	7
Windows: Inveigh Execution Artefacts	Command And Control	T1219	9
Windows: Invocation of Active Directory Diagnostic Tool ntdsutil.exe	Credential Access	T1003.003	5
Windows: Invoke-Obfuscation CLIP Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: Sysmon	Execution	T1059.001	5
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Obfuscated IEX Invocation: System Log	Persistence	none	7
Windows: Invoke-Obfuscation STDIN Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR LAUNCHER OBFUSCATION: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation VAR Launcher: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: Sysmon	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: Sysmon	Execution	T1059.001	7
Windows: Java Running with Remote Debugging	Execution	T1203	5
Windows: Jlaive Usage For Assembly Execution In-Memory	Execution	T1059.003	5
Windows: Kavremover Dropped Binary LOLBIN Usage	Persistence	none	7
Windows: LOLBAS Data Exfiltration by DataSvcUtil.exe	Persistence	none	5
Windows: LOLBIN Execution Of The FTP.EXE Binary	Defense Evasion	T1202	5
Windows: LSA PPL Protection Disabled Via Reg.EXE	Persistence	none	7
Windows: LSASS Access from White-Listed Processes	Credential Access	T1003.001	7
Windows: LSASS Memory Access by Tool Named Dump	Credential Access	T1003.001	7
Windows: LSASS Memory Dump	Credential Access	T1003.001	7
Windows: LSASS Process Dump Artefact In CrashDumps Folder	Credential Access	T1003.001	7
Windows: LSASS Process Memory Dump Files	Credential Access	T1003.001	7
Windows: Launch-VsDevShell.PS1 Proxy Execution	Defense Evasion	T1216.001	5
Windows: Legitimate Application Dropped Archive	Persistence	none	7
Windows: Legitimate Application Dropped Executable	Persistence	none	7
Windows: Legitimate Application Dropped Script	Persistence	none	7
Windows: LittleCorporal Generated Maldoc Injection	Execution	T1204.002	7
Windows: Load Undocumented Autoelevated COM Interface	Defense Evasion	T1548.002	7
Windows: Local Accounts Discovery	Discovery	T1087.001	3
Windows: Local Groups Reconnaissance Via Wmic.EXE	Discovery	T1069.001	3
Windows: Logged-On User Password Change Via Ksetup.EXE	Persistence	none	5
Windows: Lolbin Defaultpack.exe Use As Proxy	Persistence	none	5
Windows: Lolbin Runexehelper Use As Proxy	Persistence	none	5
Windows: Lolbin Ssh.exe Use As Proxy	Defense Evasion	T1202	5
Windows: Lolbin Unregmp2.exe Use As Proxy	Persistence	none	5
Windows: Lsass Memory Dump via Comsvcs DLL	Credential Access	T1003.001	9
Windows: MMC Spawning Windows Shell	Lateral Movement	T1021.003	7
Windows: MMC20 Lateral Movement	Lateral Movement	T1021.003	7
Windows: MSDT.exe Loading Diagnostic Library	Defense Evasion	T1202	7
Windows: MSExchange Transport Agent Installation	Persistence	T1505.002	5
Windows: MSHTA Suspicious Execution 01	Defense Evasion	T1218.005	7
Windows: Malicious Base64 Encoded PowerShell Keywords in Command Lines	Execution	T1059.001	7
Windows: Malicious DLL File Dropped in the Teams or OneDrive Folder	Defense Evasion	T1574.002	7
Windows: Malicious PE Execution by Microsoft Visual Studio Debugger	Persistence	none	5
Windows: Malicious Windows Script Components File Execution by TAEF Detection	Persistence	none	3
Windows: Manage Engine Java Suspicious Sub Process	Persistence	none	7
Windows: Mavinject Inject DLL Into Running Process	Defense Evasion	T1055.001	7
Windows: Microsoft Binary Suspicious Communication Endpoint	Command And Control	T1105	7
Windows: Microsoft Defender Loading DLL from Nondefault Path	Defense Evasion	T1574.002	7
Windows: Microsoft Excel Add-In Loaded From Uncommon Location	Execution	T1204.002	5
Windows: Microsoft IIS Connection Strings Decryption	Persistence	none	7
Windows: Microsoft IIS Service Account Password Dumped	Persistence	none	7
Windows: Microsoft Office DLL Sideload	Defense Evasion	T1574.002	7
Windows: Microsoft Sync Center Suspicious Network Connections	Persistence	none	5
Windows: Microsoft VBA For Outlook Addin Loaded Via Outlook	Execution	T1204.002	7
Windows: Mimikatz Kirbi File Creation	Persistence	none	9
Windows: Mimikatz through Windows Remote Management	Execution	T1059.001	7
Windows: Modify Group Policy Settings	Defense Evasion	T1484.001	5
Windows: Monitoring For Persistence Via BITS	Defense Evasion	T1197	5
Windows: MpiExec Lolbin	Persistence	none	7
Windows: Mshtml DLL RunHTMLApplication Abuse	Persistence	none	7
Windows: MsiExec Web Install	Defense Evasion	T1218.007	5
Windows: Msiexec Quiet Installation	Defense Evasion	T1218.007	5
Windows: Mstsc.EXE Execution From Uncommon Parent	Persistence	none	7
Windows: Mstsc.EXE Execution With Local RDP File	Command And Control	T1219	3
Windows: NPPSpy Hacktool Usage	Persistence	none	7
Windows: NTDS.DIT Created	Credential Access	T1003.003	3
Windows: NTDS.DIT Creation By Uncommon Parent Process	Credential Access	T1003.003	7
Windows: NTDS.DIT Creation By Uncommon Process	Credential Access	T1003.003	7
Windows: Narrator s Feedback-Hub Persistence	Persistence	T1547.001	7
Windows: NetNTLM Downgrade Attack	Defense Evasion	T1562.001	7
Windows: NetNTLM Downgrade Attack - Registry	Defense Evasion	T1562.001	7
Windows: Netsh Allow Group Policy on Microsoft Defender Firewall	Defense Evasion	T1562.004	5
Windows: Network Communication With Crypto Mining Pool	Impact	T1496	7
Windows: Network Reconnaissance Activity	Discovery	T1082	7
Windows: New ActiveScriptEventConsumer Created Via Wmic.EXE	Persistence	T1546.003	7
Windows: New DLL Added to AppCertDlls Registry Key	Persistence	T1546.009	5
Windows: New DLL Added to AppInit-DLLs Registry Key	Persistence	T1546.010	5
Windows: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE	Defense Evasion	T1574.002	7
Windows: New Firewall Rule Added Via Netsh.EXE	Defense Evasion	T1562.004	5
Windows: New Generic Credentials Added Via Cmdkey.EXE	Credential Access	T1003.005	5
Windows: New Kernel Driver Via SC.EXE	Persistence	T1543.003	5
Windows: New Network Trace Capture Started Via Netsh.EXE	Credential Access	T1040	5
Windows: New Outlook Macro Created	Command And Control	T1008	5
Windows: New Port Forwarding Rule Added Via Netsh.EXX	Persistence	none	5
Windows: New Process Created Via Wmic.EXE	Execution	T1047	5
Windows: New Remote Desktop Connection Initiated Via Mstsc.EXE	Lateral Movement	T1021.001	5
Windows: New Root Certificate Installed Via CertMgr.EXE	Defense Evasion	T1553.004	5
Windows: New Root Certificate Installed Via Certutil.EXE	Defense Evasion	T1553.004	5
Windows: New Service Creation Using PowerShell	Persistence	T1543.003	3
Windows: New Service Creation Using Sc.EXE	Persistence	T1543.003	3
Windows: New Shim Database Created in the Default Directory	Persistence	T1547.009	5
Windows: New User Created Via Net.EXE	Persistence	T1136.001	5
Windows: New User Created Via Net.EXE With Never Expire Option	Persistence	T1136.001	7
Windows: Node Process Executions	Execution	T1059.007	5
Windows: Non Interactive PowerShell Process Spawned	Execution	T1059.001	3
Windows: Non-privileged Usage of Reg or Powershell	Defense Evasion	T1112	7
Windows: Nslookup PowerShell Download Cradle - ProcessCreation	Persistence	none	5
Windows: Obfuscated IP Download	Persistence	none	5
Windows: Obfuscated IP Via CLI	Persistence	none	5
Windows: Octopus Scanner Malware Detected	Initial Access	T1195.001	7
Windows: Office Application Startup - Office Test	Persistence	T1137.002	5
Windows: Office Macro File Creation	Initial Access	T1566.001	3
Windows: Office Macro File Creation From Suspicious Process	Initial Access	T1566.001	7
Windows: Office Macro File Download	Initial Access	T1566.001	5
Windows: OneNote Attachment File Dropped In Suspicious Location	Persistence	none	5
Windows: OpenWith.exe Executes Specified Binary	Persistence	none	7
Windows: Operator Bloopers Cobalt Strike Commands	Execution	T1059.003	7
Windows: Operator Bloopers Cobalt Strike Modules	Execution	T1059.003	7
Windows: Outbound Network Connection To Public IP Via Winlogon	Defense Evasion	T1218.011	5
Windows: Outlook EnableUnsafeClientMailRules Setting Enabled	Defense Evasion	T1202	7
Windows: PCRE.NET Package Image Load	Persistence	none	7
Windows: PCRE.NET Package Temp Files	Persistence	none	7
Windows: PDQ Deploy Remote Adminstartion Tool Execution	Execution	T1072	5
Windows: PSEXEC Remote Execution File Artefact	Lateral Movement	T1570	7
Windows: PUA - 3Proxy Execution	Command And Control	T1572	7
Windows: PUA - AdFind Suspicious Execution	Discovery	T1482	7
Windows: PUA - Advanced IP Scanner Execution	Discovery	T1135	5
Windows: PUA - Advanced Port Scanner Execution	Discovery	T1135	5
Windows: PUA - AdvancedRun Execution	Persistence	none	5
Windows: PUA - AdvancedRun Suspicious Execution	Persistence	none	7
Windows: PUA - Chisel Tunneling Tool Execution	Command And Control	T1090.001	7
Windows: PUA - Crassus Execution	Reconnaissance	T1590.001	7
Windows: PUA - CsExec Execution	Resource Development	T1587.001	7
Windows: PUA - DIT Snapshot Viewer	Credential Access	T1003.003	7
Windows: PUA - DefenderCheck Execution	Defense Evasion	T1027.005	7
Windows: PUA - Fast Reverse Proxy FRP Execution	Persistence	none	7
Windows: PUA - Mouse Lock Execution	Collection	T1056.002	5
Windows: PUA - NPS Tunneling Tool Execution	Persistence	none	7
Windows: PUA - NSudo Execution	Execution	T1569.002	7
Windows: PUA - Netcat Suspicious Execution	Command And Control	T1095	7
Windows: PUA - Ngrok Execution	Command And Control	T1572	7
Windows: PUA - Nimgrab Execution	Command And Control	T1105	7
Windows: PUA - NirCmd Execution	Execution	T1569.002	5
Windows: PUA - NirCmd Execution As LOCAL SYSTEM	Execution	T1569.002	7
Windows: PUA - Nmap/Zenmap Execution	Discovery	T1046	7
Windows: PUA - Potential PE Metadata Tamper Using Rcedit	Defense Evasion	T1036.003	5
Windows: PUA - Process Hacker Driver Load	Persistence	none	7
Windows: PUA - Process Hacker Execution	Persistence	none	7
Windows: PUA - Rclone Execution	Exfiltration	T1567.002	7
Windows: PUA - RunXCmd Execution	Execution	T1569.002	7
Windows: PUA - Seatbelt Execution	Discovery	T1526	7
Windows: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE	Discovery	T1087.002	7
Windows: PUA - System Informer Driver Load	Persistence	none	5
Windows: PUA - System Informer Execution	Persistence	none	5
Windows: PUA - WebBrowserPassView Execution	Credential Access	T1555.003	5
Windows: PUA - Wsudo Suspicious Execution	Persistence	none	7
Windows: PUA- IOX Tunneling Tool Execution	Persistence	none	7
Windows: Pandemic Registry Key	Command And Control	T1105	9
Windows: Parent in Public Folder Suspicious Process	Persistence	none	7
Windows: Password Cracking with Hashcat	Credential Access	T1110.002	7
Windows: Password Provided In Command Line Of Net.EXE	Persistence	none	5
Windows: Path To Screensaver Binary Modified	Persistence	T1546.002	5
Windows: Perl Inline Command Execution	Persistence	none	5
Windows: Permission Check Via Accesschk.EXE	Discovery	T1069.001	5
Windows: Permission Misconfiguration Reconnaissance Via Findstr.EXE	Credential Access	T1552.006	5
Windows: Persistence Via Sticky Key Backdoor	Persistence	T1546.008	9
Windows: Persistence Via TypedPaths - CommandLine	Persistence	none	5
Windows: Phishing Pattern ISO in Archive	Persistence	none	7
Windows: Php Inline Command Execution	Persistence	none	5
Windows: Ping Hex IP	Defense Evasion	T1140	7
Windows: Port Forwarding Attempt Via SSH	Command And Control	T1572	7
Windows: PortProxy Registry Key	Persistence	none	5
Windows: Possible Privilege Escalation via Weak Service Permissions	Defense Evasion	T1574.011	7
Windows: Possible Shim Database Persistence via sdbinst.exe	Persistence	T1546.011	7
Windows: Potential AMSI Bypass Using NULL Bits	Defense Evasion	T1562.001	5
Windows: Potential AMSI Bypass Via .NET Reflection	Defense Evasion	T1562.001	7
Windows: Potential Active Directory Enumeration Using AD Module - ProcCreation	Persistence	none	5
Windows: Potential Antivirus Software DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Arbitrary Code Execution Via Node.EXE	Persistence	none	7
Windows: Potential Arbitrary DLL Load Using Winword	Defense Evasion	T1202	5
Windows: Potential Arbitrary File Download Using Office Application	Defense Evasion	T1202	5
Windows: Potential Azure Browser SSO Abuse	Defense Evasion	T1574.002	3
Windows: Potential Binary Or Script Dropper Via PowerShell	Persistence	none	5
Windows: Potential Browser Data Stealing	Credential Access	T1555.003	5
Windows: Potential COM Objects Download Cradles Usage - Process Creation	Persistence	none	5
Windows: Potential Chrome Frame Helper DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Cobalt Strike Process Patterns	Persistence	none	7
Windows: Potential Command Line Path Traversal Evasion Attempt	Persistence	none	5
Windows: Potential CommandLine Path Traversal Via Cmd.EXE	Execution	T1059.003	7
Windows: Potential Configuration And Service Reconnaissance Via Reg.EXE	Discovery	T1012	5
Windows: Potential Credential Dumping Attempt Using New NetworkProvider - CLI	Persistence	none	7
Windows: Potential Credential Dumping Via WER	Credential Access	T1003.001	7
Windows: Potential Crypto Mining Activity	Impact	T1496	7
Windows: Potential DCOM InternetExplorer.Application DLL Hijack	Lateral Movement	T1021.003	9
Windows: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load	Lateral Movement	T1021.003	9
Windows: Potential DLL File Download Via PowerShell Invoke-WebRequest	Persistence	none	5
Windows: Potential DLL Injection Or Execution Using Tracker.exe	Defense Evasion	T1055.001	5
Windows: Potential DLL Sideloading Of DBGCORE.DLL	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of DBGHELP.DLL	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Of Non-Existent DLLs From System Folders	Defense Evasion	T1574.002	7
Windows: Potential DLL Sideloading Using Coregen.exe	Persistence	none	5
Windows: Potential DLL Sideloading Via ClassicExplorer32.dll	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via DeviceEnroller.EXE	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via JsSchHlp	Defense Evasion	T1574.002	5
Windows: Potential DLL Sideloading Via VMware Xfer	Defense Evasion	T1574.002	7
Windows: Potential DLL Sideloading Via comctl32.dll	Defense Evasion	T1574.002	7
Windows: Potential Data Exfiltration Activity Via CommandLine Tools	Execution	T1059.001	7
Windows: Potential Data Stealing Via Chromium Headless Debugging	Collection	T1185	7
Windows: Potential Defense Evasion Via Binary Rename	Defense Evasion	T1036.003	5
Windows: Potential Defense Evasion Via Rename Of Highly Relevant Binaries	Defense Evasion	T1036.003	7
Windows: Potential Defense Evasion Via Right-to-Left Override	Defense Evasion	T1036.002	7
Windows: Potential Discovery Activity Via Dnscmd.EXE	Persistence	T1543.003	5
Windows: Potential Dosfuscation Activity	Persistence	none	5
Windows: Potential Download/Upload Activity Using Type Command	Command And Control	T1105	5
Windows: Potential Encoded PowerShell Patterns In CommandLine	Execution	T1059.001	3
Windows: Potential Execution of Sysinternals Tools	Resource Development	T1588.002	3
Windows: Potential File Overwrite Via Sysinternals SDelete	Impact	T1485	7
Windows: Potential Goopdate.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Homoglyph Attack Using Lookalike Characters	Defense Evasion	T1036.003	5
Windows: Potential Homoglyph Attack Using Lookalike Characters in Filename	Defense Evasion	T1036.003	5
Windows: Potential Initial Access via DLL Search Order Hijacking	Defense Evasion	T1574.001	5
Windows: Potential Iviewers.DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Potential LSASS Process Dump Via Procdump	Credential Access	T1003.001	7
Windows: Potential LethalHTA Technique Execution	Defense Evasion	T1218.005	7
Windows: Potential Libvlc.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential MSTSC Shadowing Activity	Lateral Movement	T1563.002	7
Windows: Potential Manage-bde.wsf Abuse To Proxy Execution	Persistence	none	7
Windows: Potential Meterpreter/CobaltStrike Activity	Defense Evasion	T1134.002	7
Windows: Potential MsiExec Masquerading	Defense Evasion	T1036.005	7
Windows: Potential NTLM Coercion Via Certutil.EXE	Persistence	none	7
Windows: Potential Network Sniffing Activity Using Network Tools	Credential Access	T1040	5
Windows: Potential Password Spraying Attempt Using Dsacls.EXE	Persistence	none	5
Windows: Potential Persistence Attempt Via ErrorHandler.Cmd	Persistence	none	5
Windows: Potential Persistence Attempt Via Existing Service Tampering	Defense Evasion	T1574.011	5
Windows: Potential Persistence Via Microsoft Compatibility Appraiser	Execution	T1053.005	5
Windows: Potential Persistence Via Microsoft Office Add-In	Persistence	T1137.006	7
Windows: Potential Persistence Via Netsh Helper DLL	Persistence	T1546.007	7
Windows: Potential Persistence Via Notepad Plugins	Persistence	none	5
Windows: Potential Persistence Via Outlook Form	Persistence	T1137.003	7
Windows: Potential Persistence Via Powershell Search Order Hijacking - Task	Execution	T1059.001	7
Windows: Potential PowerShell Command Line Obfuscation	Execution	T1059.001	7
Windows: Potential PowerShell Downgrade Attack	Execution	T1059.001	5
Windows: Potential PowerShell Execution Policy Tampering - ProcCreation	Persistence	none	7
Windows: Potential PowerShell Execution Via DLL	Defense Evasion	T1218.011	7
Windows: Potential PowerShell Obfuscation Via Reversed Commands	Execution	T1059.001	7
Windows: Potential Powershell ReverseShell Connection	Execution	T1059.001	7
Windows: Potential Privilege Escalation Attempt Via .Exe.Local Technique	Persistence	none	7
Windows: Potential Privilege Escalation To LOCAL SYSTEM	Resource Development	T1587.001	7
Windows: Potential Privilege Escalation Using Symlink Between Osk and Cmd	Persistence	T1546.008	7
Windows: Potential Privilege Escalation via Service Permissions Weakness	Defense Evasion	T1574.011	7
Windows: Potential Process Injection Via Msra.EXE	Persistence	none	7
Windows: Potential Product Class Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Potential Product Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Potential PsExec Remote Execution	Resource Development	T1587.001	7
Windows: Potential Qakbot Registry Activity	Defense Evasion	T1112	7
Windows: Potential RDP Session Hijacking Activity	Persistence	none	5
Windows: Potential RDP Tunneling Via SSH	Command And Control	T1572	7
Windows: Potential RDP Tunneling Via SSH Plink	Command And Control	T1572	7
Windows: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE	Defense Evasion	T1542.003	5
Windows: Potential Rcdll.DLL Sideloading	Defense Evasion	T1574.002	7
Windows: Potential Recon Activity Using DriverQuery.EXE	Persistence	none	7
Windows: Potential Recon Activity Via Nltest.EXE	Discovery	T1482	7
Windows: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS	Execution	T1059.005	5
Windows: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE	Credential Access	T1003.005	7
Windows: Potential Remote Credential Dumping Activity	Persistence	none	7
Windows: Potential Remote Desktop Tunneling	Persistence	none	5
Windows: Potential Renamed Rundll32 Execution	Persistence	none	7
Windows: Potential RipZip Attack on Startup Folder	Persistence	none	7
Windows: Potential RoboForm.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential Rundll32 Execution With DLL Stored In ADS	Defense Evasion	T1564.004	7
Windows: Potential SAM Database Dump	Credential Access	T1003.002	7
Windows: Potential SMB Relay Attack Tool Execution	Collection	T1557.001	9
Windows: Potential SPN Enumeration Via Setspn.EXE	Credential Access	T1558.003	5
Windows: Potential Signing Bypass Via Windows Developer Features	Persistence	none	7
Windows: Potential SolidPDFCreator.DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential SquiblyTwo Technique Execution	Defense Evasion	T1220	5
Windows: Potential Suspicious Activity Using SeCEdit	Defense Evasion	T1574.007	5
Windows: Potential Suspicious Mofcomp Execution	Persistence	none	7
Windows: Potential Suspicious PowerShell Module File Created	Persistence	none	5
Windows: Potential Suspicious Registry File Imported Via Reg.EXE	Defense Evasion	T1112	5
Windows: Potential Suspicious Windows Feature Enabled - ProcCreation	Persistence	none	5
Windows: Potential Svchost Memory Access	Defense Evasion	T1562.002	7
Windows: Potential System Information Discovery Via Wmic.EXE	Discovery	T1082	5
Windows: Potential Tampering With RDP Related Registry Keys Via Reg.EXE	Defense Evasion	T1112	7
Windows: Potential Tampering With Security Products Via WMIC	Defense Evasion	T1562.001	7
Windows: Potential Unquoted Service Path Reconnaissance Via Wmic.EXE	Execution	T1047	7
Windows: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell	Execution	T1059.001	5
Windows: Potential Wazuh Security Platform DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Potential WinAPI Calls Via CommandLine	Execution	T1106	7
Windows: Potential Windows Defender Tampering Via Wmic.EXE	Persistence	T1546.008	7
Windows: Potential Winnti Dropper Activity	Persistence	none	7
Windows: Potentially Over Permissive Permissions Granted Using Dsacls.EXE	Persistence	none	5
Windows: Potentially Suspicious GoogleUpdate Child Process	Persistence	none	7
Windows: Potentially Suspicious Network Connection To Notion API	Persistence	none	3
Windows: PowerShell Base64 Encoded FromBase64String Cmdlet	Defense Evasion	T1140	7
Windows: PowerShell Base64 Encoded IEX Cmdlet	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded Invoke Keyword	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded Reflective Assembly Load	Execution	T1059.001	7
Windows: PowerShell Base64 Encoded WMI Classes	Execution	T1059.001	7
Windows: PowerShell Core DLL Loaded By Non PowerShell Process	Execution	T1059.001	5
Windows: PowerShell Download and Execution Cradles	Persistence	none	7
Windows: PowerShell DownloadFile	Command And Control	T1059.001,T1104,T1105	7
Windows: PowerShell Encoded Character Syntax	Defense Evasion	T1027.003,T1132.001	7
Windows: PowerShell Get-Clipboard Cmdlet Via CLI	Collection	T1115	5
Windows: PowerShell Get-Process LSASS	Credential Access	T1552.004	7
Windows: PowerShell Module File Created	Persistence	none	3
Windows: PowerShell Module File Created By Non-PowerShell Process	Persistence	none	5
Windows: PowerShell Profile Modification	Persistence	T1546.013	7
Windows: PowerShell SAM Copy	Credential Access	T1003.002	7
Windows: PowerShell Script Dropped Via PowerShell.EXE	Persistence	none	3
Windows: PowerShell Script Run in AppData	Execution	T1059.001	5
Windows: PowerShell Web Download	Persistence	none	5
Windows: PowerShell Writing Startup Shortcuts	Persistence	T1547.001	7
Windows: Powershell Base64 Encoded MpPreference Cmdlet	Defense Evasion	T1562.001	7
Windows: Powershell Defender Disable Scan Feature	Defense Evasion	T1562.001	7
Windows: Powershell Defender Exclusion	Defense Evasion	T1562.001	5
Windows: Powershell Inline Execution From A File	Persistence	none	5
Windows: Powershell Token Obfuscation - Process Creation	Persistence	none	7
Windows: Powerup Write Hijack DLL	Defense Evasion	T1574.001	7
Windows: PrintBrm ZIP Creation of Extraction	Defense Evasion	T1564.004	7
Windows: PrinterNightmare Mimimkatz Driver Name	Persistence	none	9
Windows: Private Keys Reconnaissance Via CommandLine Tools	Credential Access	T1552.004	5
Windows: Privilege Escalation via Named Pipe Impersonation	Persistence	none	7
Windows: Procdump Evasion	Credential Access	T1003.001	7
Windows: Procdump Execution	Credential Access	T1003.001	5
Windows: Process Access via TrolleyExpress Exclusion	Defense Evasion	T1218.011	7
Windows: Process Creation Using Sysnative Folder	Persistence	none	5
Windows: Process Dumping Via Comsvcs.DLL	Credential Access	T1003.001	7
Windows: Process Explorer Driver Creation By Non-Sysinternals Binary	Privilege Escalation	T1068	7
Windows: Process Memory Dump Via Dotnet-Dump	Persistence	none	5
Windows: Process Memory Dump via RdrLeakDiag.EXE	Credential Access	T1003.001	7
Windows: Process Monitor Driver Creation By Non-Sysinternals Binary	Privilege Escalation	T1068	5
Windows: Process Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Proxy Execution via Wuauclt	Persistence	none	7
Windows: PsExec Service Child Process Execution as LOCAL SYSTEM	Persistence	none	7
Windows: PsExec Service Execution	Persistence	none	5
Windows: PsExec Service File Creation	Execution	T1569.002	3
Windows: PsExec/PAExec Escalation to LOCAL SYSTEM	Resource Development	T1587.001	7
Windows: Psexec Execution	Persistence	none	5
Windows: Psr.exe Capture Screenshots	Collection	T1113	5
Windows: Publisher Attachment File Dropped In Suspicious Location	Persistence	none	5
Windows: Pubprn.vbs Proxy Execution	Defense Evasion	T1216.001	5
Windows: Python Initiated Connection	Discovery	T1046	5
Windows: Python Inline Command Execution	Persistence	none	5
Windows: Python Py2Exe Image Load	Defense Evasion	T1027.002	5
Windows: Python Spawning Pretty TTY on Windows	Persistence	none	7
Windows: QuarksPwDump Dump File	Credential Access	T1003.002	9
Windows: Query Tor Onion Address	Command And Control	T1090.003	7
Windows: Query Usage To Exfil Data	Persistence	none	5
Windows: RDP Connection Allowed Via Netsh.EXE	Defense Evasion	T1562.004	7
Windows: RDP File Creation From Suspicious Application	Persistence	none	7
Windows: RDP Over Reverse SSH Tunnel	Command And Control	T1572	7
Windows: RDP Port Forwarding Rule Added Via Netsh.EXE	Persistence	none	7
Windows: RDP to HTTP or HTTPS Target Ports	Command And Control	T1572	7
Windows: REGISTER-APP.VBS Proxy Execution	Persistence	none	5
Windows: Raccine Uninstall	Defense Evasion	T1562.001	7
Windows: Rar Usage with Password and Compression Level	Collection	T1560.001	7
Windows: Read Contents From Stdin Via Cmd.EXE	Execution	T1059.003	5
Windows: Recon Information for Export with Command Prompt	Collection	T1119	5
Windows: RedMimicry Winnti Playbook Registry Manipulation	Defense Evasion	T1112	7
Windows: Reg Add RUN Key	Persistence	T1547.001	5
Windows: Reg Add Suspicious Paths	Defense Evasion	T1562.001	7
Windows: Reg Disable Security Service	Defense Evasion	T1562.001	7
Windows: Regasm/Regsvcs Suspicious Execution	Defense Evasion	T1218.009	7
Windows: Regedit as Trusted Installer	Persistence	none	7
Windows: Registry Entries For Azorult Malware	Defense Evasion	T1112	9
Windows: Registry Modification Via Regini.EXE	Defense Evasion	T1112	3
Windows: Registry Parse with Pypykatz	Credential Access	T1003.002	7
Windows: Registry Persistence Mechanisms in Recycle Bin	Persistence	none	7
Windows: Regsvr32 DNS Activity	Execution	T1559.001	7
Windows: Regsvr32 Flags Anomaly	Defense Evasion	T1218.010	7
Windows: Regsvr32 Network Activity	Execution	T1559.001	7
Windows: Remote Access Tool - AnyDesk Execution	Command And Control	T1219	5
Windows: Remote Access Tool - AnyDesk Piped Password Via CLI	Command And Control	T1219	5
Windows: Remote Access Tool - AnyDesk Silent Installation	Command And Control	T1219	7
Windows: Remote Access Tool - NetSupport Execution From Unusual Location	Persistence	none	5
Windows: Remote Access Tool - RURAT Execution From Unusual Location	Persistence	none	5
Windows: Remote Access Tool - ScreenConnect Suspicious Execution	Initial Access	T1133	7
Windows: Remote CHM File Download/Execution Via HH.EXE	Defense Evasion	T1218.001	7
Windows: Remote Code Execute via Winrm.vbs	Persistence	none	5
Windows: Remote File Download via Desktopimgdownldr Utility	Command And Control	T1105	5
Windows: Remote PowerShell Session Host Process WinRM	Execution	T1059.001	5
Windows: Remote PowerShell Session Network	Execution	T1059.001	7
Windows: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses	Persistence	none	7
Windows: Remotely Hosted HTA File Executed Via Mshta.EXE	Defense Evasion	T1218.005	7
Windows: Renamed AdFind Execution	Discovery	T1482	7
Windows: Renamed AutoHotkey.EXE Execution	Persistence	none	5
Windows: Renamed BrowserCore.EXE Execution	Credential Access	T1528	7
Windows: Renamed CreateDump Utility Execution	Credential Access	T1003.001	7
Windows: Renamed FTP.EXE Execution	Defense Evasion	T1202	5
Windows: Renamed Jusched.EXE Execution	Defense Evasion	T1036.003	7
Windows: Renamed Mavinject.EXE Execution	Defense Evasion	T1055.001	7
Windows: Renamed MegaSync Execution	Persistence	none	7
Windows: Renamed Msdt.EXE Execution	Defense Evasion	T1036.003	7
Windows: Renamed NetSupport RAT Execution	Persistence	none	7
Windows: Renamed Office Binary Execution	Persistence	none	7
Windows: Renamed PAExec Execution	Defense Evasion	T1202	7
Windows: Renamed Plink Execution	Persistence	none	7
Windows: Renamed ProcDump Execution	Defense Evasion	T1036.003	7
Windows: Renamed PsExec Service Execution	Persistence	none	7
Windows: Renamed Remote Utilities RAT RURAT Execution	Persistence	none	5
Windows: Renamed SysInternals DebugView Execution	Resource Development	T1588.002	7
Windows: Renamed Sysinternals Sdelete Execution	Impact	T1485	7
Windows: Renamed Vmnat.exe Execution	Defense Evasion	T1574.002	7
Windows: Renamed Whoami Execution	Discovery	T1033	9
Windows: Renamed ZOHO Dctask64 Execution	Defense Evasion	T1202	7
Windows: Replace.exe Usage	Command And Control	T1105	5
Windows: Root Certificate Installed From Susp Locations	Defense Evasion	T1553.004	7
Windows: Ruby Inline Command Execution	Persistence	none	5
Windows: Run Once Task Configuration in Registry	Defense Evasion	T1112	5
Windows: Run Once Task Execution as Configured in Registry	Defense Evasion	T1112	3
Windows: Run PowerShell Script from ADS	Defense Evasion	T1564.004	7
Windows: Run PowerShell Script from Redirected Input Stream	Persistence	none	7
Windows: RunDLL32 Spawning Explorer	Defense Evasion	T1218.011	7
Windows: Rundll32 Execution Without Parameters	Lateral Movement	T1570	7
Windows: Rundll32 InstallScreenSaver Execution	Defense Evasion	T1218.011	5
Windows: Rundll32 Internet Connection	Defense Evasion	T1218.011	5
Windows: Rundll32 Registered COM Objects	Persistence	T1546.015	7
Windows: Rundll32 UNC Path Execution	Defense Evasion	T1218.011	7
Windows: Rundll32 With Suspicious Parent Process	Persistence	none	5
Windows: SCR File Write Event	Defense Evasion	T1218.011	5
Windows: SQL Client Tools PowerShell Session Detection	Execution	T1059.001	5
Windows: SQLite Chromium Profile Data DB Access	Credential Access	T1555.003	7
Windows: SQLite Firefox Profile Data DB Access	Credential Access	T1539	7
Windows: SafeBoot Registry Key Deleted Via Reg.EXE	Defense Evasion	T1562.001	7
Windows: SafetyKatz Default Dump Filename	Credential Access	T1003.001	7
Windows: Scheduled Task Creation	Execution	T1053.005	3
Windows: Scheduled Task Executing Powershell Encoded Payload from Registry	Execution	T1059.001	7
Windows: Schtasks Creation Or Modification With SYSTEM Privileges	Execution	T1053.005	7
Windows: Schtasks From Suspicious Folders	Execution	T1053.005	7
Windows: ScreenConnect Temporary Installation Artefact	Command And Control	T1219	5
Windows: Script Event Consumer Spawning Process	Execution	T1047	7
Windows: Script Initiated Connection to Non-Local Network	Command And Control	T1105	7
Windows: Script Interpreter Execution From Suspicious Folder	Persistence	none	7
Windows: Sdclt Child Processes	Defense Evasion	T1548.002	5
Windows: Sdiagnhost Calling Suspicious Child Process	Persistence	none	7
Windows: Security Privileges Enumeration Via Whoami.EXE	Discovery	T1033	7
Windows: Security Support Provider SSP Added to LSA Configuration	Persistence	T1547.005	9
Windows: Sensitive Registry Access via Volume Shadow Copy	Impact	T1490	7
Windows: Service DACL Abuse To Hide Services Via Sc.EXE	Defense Evasion	T1574.011	7
Windows: Service ImagePath Change with Reg.exe	Defense Evasion	T1574.011	5
Windows: Service Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Service Registry Key Deleted Via Reg.EXE	Defense Evasion	T1562.001	7
Windows: Service Security Descriptor Tampering Via Sc.EXE	Defense Evasion	T1574.011	5
Windows: Service Started/Stopped Via Wmic.EXE	Execution	T1047	5
Windows: Service StartupType Change Via PowerShell Set-Service	Defense Evasion	T1562.001	5
Windows: Service StartupType Change Via Sc.EXE	Defense Evasion	T1562.001	5
Windows: Set Suspicious Files as System Files Using Attrib.EXE	Defense Evasion	T1564.001	7
Windows: Shadow Copies Creation Using Operating Systems Utilities	Credential Access	T1003.003	5
Windows: Shadow Copies Deletion Using Operating Systems Utilities	Impact	T1490	7
Windows: Share And Session Enumeration Using Net.EXE	Discovery	T1018	3
Windows: Shell Open Registry Keys Manipulation	Defense Evasion	T1548.002	7
Windows: Shell32 DLL Execution in Suspicious Directory	Defense Evasion	T1218.011	7
Windows: Shells Spawned by Java	Persistence	none	5
Windows: Shells Spawned by Web Servers	Persistence	T1505.003	7
Windows: ShimCache Flush	Defense Evasion	T1112	7
Windows: SilentProcessExit Monitor Registration for LSASS	Credential Access	T1003.007	9
Windows: Silenttrinity Stager Msbuild Activity	Defense Evasion	T1127.001	7
Windows: Start Windows Service Via Net.EXE	Execution	T1569.002	3
Windows: Start of NT Virtual DOS Machine	Persistence	none	5
Windows: Startup Folder File Write	Persistence	T1547.001	5
Windows: Sticky Key Like Backdoor Execution	Persistence	T1546.008	9
Windows: Sticky Key Like Backdoor Usage - Registry	Persistence	T1546.008	9
Windows: Stop Windows Service Via Net.EXE	Impact	T1489	3
Windows: Stop Windows Service Via PowerShell Stop-Service	Impact	T1489	3
Windows: Stop Windows Service Via Sc.EXE	Impact	T1489	3
Windows: Suspect Svchost Activity	Persistence	none	7
Windows: Suspicious ASPX File Drop by Exchange	Persistence	T1505.003	7
Windows: Suspicious Active Directory Database Snapshot Via ADExplorer	Credential Access	T1552.001	7
Windows: Suspicious Add Scheduled Command Pattern	Execution	T1053.005	7
Windows: Suspicious Add User to Remote Desktop Users Group	Persistence	T1136.001	7
Windows: Suspicious AgentExecutor PowerShell Execution	Persistence	none	7
Windows: Suspicious Binary In User Directory Spawned From Office Application	Execution	T1204.002	7
Windows: Suspicious Binary Writes Via AnyDesk	Command And Control	T1219	7
Windows: Suspicious CMD Shell Output Redirect	Persistence	none	5
Windows: Suspicious Cabinet File Execution Via Msdt.EXE	Defense Evasion	T1202	5
Windows: Suspicious Cabinet File Expansion	Persistence	none	5
Windows: Suspicious Calculator Usage	Persistence	none	7
Windows: Suspicious Camera and Microphone Access	Collection	T1125	7
Windows: Suspicious Certreq Command to Download	Command And Control	T1105	7
Windows: Suspicious Child Process Created as System	Defense Evasion	T1134.002	7
Windows: Suspicious Child Process Of SQL Server	Persistence	T1505.003	7
Windows: Suspicious Child Process Of Veeam Dabatase	Persistence	none	9
Windows: Suspicious Chromium Browser Instance Executed With Custom Extensions	Persistence	T1176	7
Windows: Suspicious Cobalt Strike DNS Beaconing	Command And Control	T1071.004	9
Windows: Suspicious CodePage Switch Via CHCP	Persistence	none	5
Windows: Suspicious Command With Teams Objects Paths	Credential Access	T1528	7
Windows: Suspicious Commandline Escape	Defense Evasion	T1140	3
Windows: Suspicious ConfigSecurityPolicy Execution	Persistence	none	5
Windows: Suspicious Control Panel DLL Load	Defense Evasion	T1218.011	7
Windows: Suspicious Copy From or To System32	Defense Evasion	T1036.003	5
Windows: Suspicious Creation TXT File in User Desktop	Impact	T1486	7
Windows: Suspicious Creation with Colorcpl	Persistence	none	7
Windows: Suspicious Csi.exe Usage	Execution	T1072	5
Windows: Suspicious Curl.EXE Download	Command And Control	T1105	7
Windows: Suspicious CustomShellHost Execution	Persistence	none	5
Windows: Suspicious DLL Loaded via CertOC.EXE	Persistence	none	7
Windows: Suspicious DNS Query for IP Lookup Service APIs	Persistence	none	5
Windows: Suspicious Debugger Registration Cmdline	Persistence	T1546.008	7
Windows: Suspicious Desktopimgdownldr Command	Command And Control	T1105	7
Windows: Suspicious Desktopimgdownldr Target File	Command And Control	T1105	7
Windows: Suspicious Diantz Alternate Data Stream Execution	Defense Evasion	T1564.004	5
Windows: Suspicious Diantz Download and Compress Into a CAB File	Command And Control	T1105	5
Windows: Suspicious DotNET CLR Usage Log Artifact	Persistence	none	7
Windows: Suspicious Double Extension File Execution	Initial Access	T1566.001	9
Windows: Suspicious Double Extension Files	Persistence	none	7
Windows: Suspicious Download From Direct IP Via Bitsadmin	Defense Evasion	T1197	7
Windows: Suspicious Download From File-Sharing Website Via Bitsadmin	Defense Evasion	T1197	7
Windows: Suspicious Download Via Certutil.EXE	Persistence	none	5
Windows: Suspicious Download from Office Domain	Persistence	none	7
Windows: Suspicious Driver Install by pnputil.exe	Persistence	none	5
Windows: Suspicious Driver Load from Temp	Persistence	T1543.003	5
Windows: Suspicious Dropbox API Usage	Persistence	none	7
Windows: Suspicious Electron Application Child Processes	Persistence	none	5
Windows: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call	Execution	T1059.001	7
Windows: Suspicious Encoded PowerShell Command Line	Execution	T1059.001	7
Windows: Suspicious Eventlog Clear or Configuration Change	Defense Evasion	T1562.002	7
Windows: Suspicious Executable File Creation	Persistence	none	7
Windows: Suspicious Execution Of PDQDeployRunner	Persistence	none	5
Windows: Suspicious Execution of Adidnsdump	Discovery	T1018	3
Windows: Suspicious Execution of Hostname	Discovery	T1082	3
Windows: Suspicious Execution of InstallUtil To Download	Persistence	none	5
Windows: Suspicious Execution of InstallUtil Without Log	Persistence	none	5
Windows: Suspicious Execution of Powershell with Base64	Execution	T1059.001	5
Windows: Suspicious Execution of Shutdown	Impact	T1529	5
Windows: Suspicious Execution of Shutdown to Log Out	Impact	T1529	5
Windows: Suspicious Execution of Systeminfo	Discovery	T1082	3
Windows: Suspicious Extrac32 Alternate Data Stream Execution	Defense Evasion	T1564.004	5
Windows: Suspicious Extrac32 Execution	Command And Control	T1105	5
Windows: Suspicious File Characteristics Due to Missing Fields	Execution	T1059.006	5
Windows: Suspicious File Created In PerfLogs	Persistence	none	5
Windows: Suspicious File Created Via OneNote Application	Persistence	none	7
Windows: Suspicious File Creation In Uncommon AppData Folder	Persistence	none	7
Windows: Suspicious File Download From File Sharing Domain Via Curl.EXE	Persistence	none	7
Windows: Suspicious File Download via CertOC.exe	Command And Control	T1105	7
Windows: Suspicious File Downloaded From Direct IP Via Certutil.EXE	Persistence	none	7
Windows: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE	Persistence	none	7
Windows: Suspicious File Drop by Exchange	Persistence	T1505.003	5
Windows: Suspicious File Execution From Internet Hosted WebDav Share	Execution	T1059.001	7
Windows: Suspicious Files in Default GPO Folder	Defense Evasion	T1036.005	5
Windows: Suspicious FromBase64String Usage On Gzip Archive - Process Creation	Persistence	none	5
Windows: Suspicious GUP Usage	Defense Evasion	T1574.002	7
Windows: Suspicious Get-Variable.exe Creation	Persistence	none	7
Windows: Suspicious Git Clone	Persistence	none	5
Windows: Suspicious Greedy Compression Using Rar.EXE	Persistence	none	7
Windows: Suspicious GrpConv Execution	Persistence	none	7
Windows: Suspicious HH.EXE Execution	Initial Access	T1566.001	7
Windows: Suspicious HWP Sub Processes	Initial Access	T1566.001	7
Windows: Suspicious Hacktool Execution - PE Metadata	Persistence	none	7
Windows: Suspicious High IntegrityLevel Conhost Legacy Option	Defense Evasion	T1202	1
Windows: Suspicious IIS Module Registration	Persistence	none	7
Windows: Suspicious IIS URL GlobalRules Rewrite Via AppCmd	Persistence	none	5
Windows: Suspicious Interactive PowerShell as SYSTEM	Persistence	none	7
Windows: Suspicious Invoke-WebRequest Execution	Command And Control	T1105	7
Windows: Suspicious Invoke-WebRequest Execution With DirectIP	Command And Control	T1105	5
Windows: Suspicious JavaScript Execution Via Mshta.EXE	Defense Evasion	T1218.005	7
Windows: Suspicious Kernel Dump Using Dtrace	Persistence	none	7
Windows: Suspicious Key Manager Access	Credential Access	T1555.004	7
Windows: Suspicious LNK Double Extension File	Persistence	none	5
Windows: Suspicious LSASS Access Via MalSecLogon	Credential Access	T1003.001	7
Windows: Suspicious LSASS Process Clone	Credential Access	T1003.001	9
Windows: Suspicious MSDT Parent Process	Persistence	none	7
Windows: Suspicious MSExchangeMailboxReplication ASPX Write	Persistence	T1505.003	7
Windows: Suspicious MSHTA Child Process	Defense Evasion	T1218.005	7
Windows: Suspicious Manipulation Of Default Accounts Via Net.EXE	Collection	T1560.001	7
Windows: Suspicious Microsoft Office Child Process	Defense Evasion	T1218.010	7
Windows: Suspicious Microsoft OneNote Child Process	Initial Access	T1566.001	7
Windows: Suspicious Modification Of Scheduled Tasks	Execution	T1053.005	7
Windows: Suspicious Msbuild Execution By Uncommon Parent Process	Persistence	none	5
Windows: Suspicious Mshta.EXE Execution Patterns	Execution	T1106	7
Windows: Suspicious MsiExec Embedding Parent	Defense Evasion	T1218.007	5
Windows: Suspicious Msiexec Execute Arbitrary DLL	Defense Evasion	T1218.007	5
Windows: Suspicious Msiexec Quiet Install From Remote Location	Defense Evasion	T1218.007	5
Windows: Suspicious Mstsc.EXE Execution With Local RDP File	Command And Control	T1219	7
Windows: Suspicious NTDS Exfil Filename Patterns	Credential Access	T1003.003	7
Windows: Suspicious NTLM Authentication on the Printer Spooler Service	Credential Access	T1212	7
Windows: Suspicious Network Command	Persistence	none	3
Windows: Suspicious Network Connection Binary No CommandLine	Persistence	none	7
Windows: Suspicious Network Connection to IP Lookup Service APIs	Persistence	none	5
Windows: Suspicious New Service Creation	Persistence	T1543.003	7
Windows: Suspicious Non-Browser Network Communication With Google API	Persistence	none	5
Windows: Suspicious Ntdll Pipe Redirection	Persistence	none	7
Windows: Suspicious Obfuscated PowerShell Code	Persistence	none	7
Windows: Suspicious Office Token Search Via CLI	Credential Access	T1528	5
Windows: Suspicious Outbound Kerberos Connection	Defense Evasion	T1550.003	7
Windows: Suspicious Outbound SMTP Connections	Exfiltration	T1048.003	5
Windows: Suspicious Outlook Child Process	Execution	T1204.002	7
Windows: Suspicious Outlook Macro Created	Command And Control	T1008	7
Windows: Suspicious PFX File Creation	Credential Access	T1552.004	5
Windows: Suspicious PROCEXP152.sys File Created In TMP	Defense Evasion	T1562.001	5
Windows: Suspicious Parent Double Extension File Execution	Persistence	none	7
Windows: Suspicious Parent of Csc.exe	Defense Evasion	T1218.005	7
Windows: Suspicious Ping/Del Command Combination	Defense Evasion	T1070.004	7
Windows: Suspicious Plink Port Forwarding	Command And Control	T1572	7
Windows: Suspicious PowerShell Download and Execute Pattern	Execution	T1059.001	7
Windows: Suspicious PowerShell Encoded Command Patterns	Execution	T1059.001	7
Windows: Suspicious PowerShell IEX Execution Patterns	Persistence	none	7
Windows: Suspicious PowerShell Invocation From Script Engines	Execution	T1059.001	5
Windows: Suspicious PowerShell Invocations - Specific - ProcessCreation	Persistence	none	5
Windows: Suspicious PowerShell Mailbox Export to Share	Persistence	none	9
Windows: Suspicious PowerShell Parameter Substring	Execution	T1059.001	7
Windows: Suspicious PowerShell Parent Process	Execution	T1059.001	7
Windows: Suspicious Powercfg Execution To Change Lock Screen Timeout	Persistence	none	5
Windows: Suspicious Process Created Via Wmic.EXE	Execution	T1047	7
Windows: Suspicious Process Parents	Persistence	none	7
Windows: Suspicious Process Patterns NTDS.DIT Exfil	Credential Access	T1003.003	7
Windows: Suspicious Process Start Locations	Persistence	none	5
Windows: Suspicious Processes Spawned by WinRM	Initial Access	T1190	7
Windows: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE	Defense Evasion	T1562.004	7
Windows: Suspicious Program Names	Persistence	none	7
Windows: Suspicious Query of MachineGUID	Discovery	T1082	3
Windows: Suspicious RASdial Activity	Persistence	none	5
Windows: Suspicious RDP Redirect Using TSCON	Lateral Movement	T1563.002	7
Windows: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet	Discovery	T1087.001	5
Windows: Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	Execution	T1059.005	7
Windows: Suspicious Recursif Takeown	Defense Evasion	T1222.001	5
Windows: Suspicious Reg Add BitLocker	Impact	T1486	7
Windows: Suspicious Reg Add Open Command	Persistence	none	5
Windows: Suspicious Registry Modification From ADS Via Regini.EXE	Defense Evasion	T1112	7
Windows: Suspicious Regsvr32 Execution From Remote Share	Defense Evasion	T1218.010	7
Windows: Suspicious Regsvr32 Execution With Image Extension	Defense Evasion	T1218.010	7
Windows: Suspicious Remote Child Process From Outlook	Defense Evasion	T1202	7
Windows: Suspicious Renamed Comsvcs DLL Loaded By Rundll32	Credential Access	T1003.001	7
Windows: Suspicious Run Key from Download	Persistence	T1547.001	7
Windows: Suspicious RunAs-Like Flag Combination	Persistence	none	5
Windows: Suspicious Rundll32 Activity	Defense Evasion	T1218.011	5
Windows: Suspicious Rundll32 Activity Invoking Sys File	Defense Evasion	T1218.011	7
Windows: Suspicious Rundll32 Execution With Image Extension	Defense Evasion	T1218.011	7
Windows: Suspicious Rundll32 Invoking Inline VBScript	Persistence	none	7
Windows: Suspicious Rundll32 Setupapi.dll Activity	Defense Evasion	T1218.011	5
Windows: Suspicious Rundll32 Without Any CommandLine Params	Defense Evasion	T1202	7
Windows: Suspicious Runscripthelper.exe	Defense Evasion	T1202	5
Windows: Suspicious SYSTEM User Process Creation	Persistence	none	7
Windows: Suspicious SYSVOL Domain Group Policy Access	Credential Access	T1552.006	5
Windows: Suspicious Scan Loop Network	Discovery	T1018	5
Windows: Suspicious Scheduled Task Creation Involving Temp Folder	Execution	T1053.005	7
Windows: Suspicious Scheduled Task Creation via Masqueraded XML File	Execution	T1053.005	5
Windows: Suspicious Scheduled Task Name As GUID	Execution	T1053.005	5
Windows: Suspicious Scheduled Task Write to System32 Tasks	Persistence	none	7
Windows: Suspicious Schtasks Execution AppData Folder	Execution	T1059.001	7
Windows: Suspicious Schtasks From Env Var Folder	Execution	T1053.005	7
Windows: Suspicious Schtasks Schedule Type With High Privileges	Execution	T1053.005	5
Windows: Suspicious Schtasks Schedule Types	Execution	T1053.005	7
Windows: Suspicious ScreenSave Change by Reg.exe	Persistence	T1546.002	5
Windows: Suspicious Screensaver Binary File Creation	Persistence	T1546.002	5
Windows: Suspicious Script Execution From Temp Folder	Persistence	none	7
Windows: Suspicious Serv-U Process Pattern	Persistence	none	7
Windows: Suspicious Service Binary Directory	Persistence	none	7
Windows: Suspicious Service DACL Modification Via Set-Service Cmdlet	Persistence	T1543.003	7
Windows: Suspicious Service Path Modification	Persistence	T1543.003	7
Windows: Suspicious Shells Spawn by Java Utility Keytool	Persistence	none	7
Windows: Suspicious Shells Spawned by Java	Persistence	none	7
Windows: Suspicious Splwow64 Without Params	Persistence	none	7
Windows: Suspicious Startup Folder Persistence	Persistence	T1547.001	7
Windows: Suspicious Svchost Process	Defense Evasion	T1036.005	7
Windows: Suspicious SysAidServer Child	Persistence	none	5
Windows: Suspicious TSCON Start as SYSTEM	Command And Control	T1219	7
Windows: Suspicious TeamViewer Domain Access	Command And Control	T1219	5
Windows: Suspicious Typical Malware Back Connect Ports	Command And Control	T1571	5
Windows: Suspicious UltraVNC Execution	Lateral Movement	T1021.005	7
Windows: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded	Credential Access	T1003.001	7
Windows: Suspicious Usage Of Active Directory Diagnostic Tool ntdsutil.exe	Credential Access	T1003.003	5
Windows: Suspicious Usage Of ShellExec-RunDLL	Persistence	none	7
Windows: Suspicious Use of CSharp Interactive Console	Persistence	none	7
Windows: Suspicious Use of PsLogList	Discovery	T1087.002	5
Windows: Suspicious Userinit Child Process	Persistence	none	5
Windows: Suspicious VBoxDrvInst.exe Parameters	Defense Evasion	T1112	5
Windows: Suspicious Volume Shadow Copy VSS-PS.dll Load	Impact	T1490	7
Windows: Suspicious Volume Shadow Copy Vssapi.dll Load	Impact	T1490	7
Windows: Suspicious Volume Shadow Copy Vsstrace.dll Load	Impact	T1490	7
Windows: Suspicious Vsls-Agent Command With AgentExtensionPath Load	Persistence	none	5
Windows: Suspicious WERMGR Process Patterns	Persistence	none	7
Windows: Suspicious WMIC Execution Via Office Process	Defense Evasion	T1218.010	7
Windows: Suspicious WSMAN Provider Image Loads	Execution	T1059.001	5
Windows: Suspicious WebDav Client Execution	Exfiltration	T1048.003	7
Windows: Suspicious WebDav Client Execution: Sysmon V2	Exfiltration	T1048.003	5
Windows: Suspicious Where Execution	Discovery	T1217	3
Windows: Suspicious Whoami.EXE Execution	Discovery	T1033	7
Windows: Suspicious Whoami.EXE Execution From Privileged Process	Discovery	T1033	7
Windows: Suspicious Windows App Activity	Persistence	none	7
Windows: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE	Defense Evasion	T1562.001	5
Windows: Suspicious Windows Trace ETW Session Tamper Via Logman.EXE	Defense Evasion	T1562.001	7
Windows: Suspicious Windows Update Agent Empty Cmdline	Persistence	none	7
Windows: Suspicious WindowsTerminal Child Processes	Persistence	none	5
Windows: Suspicious WmiPrvSE Child Process	Defense Evasion	T1218.010	7
Windows: Suspicious Workstation Locking via Rundll32	Persistence	none	5
Windows: Suspicious X509Enrollment - Process Creation	Persistence	none	5
Windows: Suspicious XOR Encoded PowerShell Command	Defense Evasion	T1140	5
Windows: Suspicious ZipExec Execution	Defense Evasion	T1202	5
Windows: Suspicious desktop.ini Action	Persistence	T1547.009	5
Windows: SyncAppvPublishingServer Execute Arbitrary PowerShell Code	Persistence	none	5
Windows: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code	Persistence	none	5
Windows: Sysinternals PsSuspend Execution	Persistence	T1543.003	5
Windows: Sysinternals PsSuspend Suspicious Execution	Defense Evasion	T1562.001	7
Windows: Sysmon Blocked Executable	Persistence	none	7
Windows: Sysmon Configuration Change	Persistence	none	5
Windows: Sysmon Configuration Update	Defense Evasion	T1562.001	5
Windows: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE	Discovery	T1518.001	7
Windows: Sysmon Driver Unloaded Via Fltmc.EXE	Defense Evasion	T1562.002	7
Windows: SysmonEnte Usage	Defense Evasion	T1562.002	7
Windows: Sysprep on AppData Folder	Persistence	none	5
Windows: System File Execution Location Anomaly	Persistence	none	7
Windows: System Network Connections Discovery Via Net.EXE	Discovery	T1049	3
Windows: Tamper Windows Defender Remove-MpPreference	Defense Evasion	T1562.001	7
Windows: Tap Installer Execution	Persistence	none	5
Windows: Taskkill Symantec Endpoint Protection	Defense Evasion	T1562.001	7
Windows: Taskmgr as LOCAL-SYSTEM	Persistence	none	7
Windows: Taskmgr as Parent	Persistence	none	3
Windows: Tasks Folder Evasion	Defense Evasion	T1574.002	7
Windows: TeamViewer Remote Session	Command And Control	T1219	5
Windows: Terminal Service Process Spawn	Lateral Movement	T1210	7
Windows: Third Party Software DLL Sideloading	Defense Evasion	T1574.002	5
Windows: Time Travel Debugging Utility Usage: Sysmon V1	Credential Access	T1003.001	7
Windows: Time Travel Debugging Utility Usage: Sysmon V2	Credential Access	T1003.001	7
Windows: Tor Client or Tor Browser Use	Command And Control	T1090.003	7
Windows: TrustedPath UAC Bypass Pattern	Defense Evasion	T1548.002	9
Windows: Typical HiveNightmare SAM File Export	Credential Access	T1552.001	7
Windows: UAC Bypass Abusing Winsat Path Parsing - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Tool UACMe Akagi	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using .NET Code Profiler on MMC	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using ChangePK and SLUI	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using ComputerDefaults	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Consent and Comctl32 - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Consent and Comctl32 - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Disk Cleanup	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using DismHost	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Event Viewer RecentViews	Persistence	none	7
Windows: UAC Bypass Using EventVwr	Persistence	none	7
Windows: UAC Bypass Using IDiagnostic Profile	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IDiagnostic Profile - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IEInstal - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using IEInstal - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Iscsicpl - ImageLoad	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using MSConfig Token Modification - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using MSConfig Token Modification - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using NTFS Reparse Point - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using NTFS Reparse Point - Process	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using PkgMgr and DISM	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using WOW64 Logger DLL Hijack	Defense Evasion	T1548.002	7
Windows: UAC Bypass Using Windows Media Player - File	Defense Evasion	T1548.002	7
Windows: UAC Bypass Via Wsreset	Defense Evasion	T1548.002	7
Windows: UAC Bypass WSReset	Defense Evasion	T1548.002	7
Windows: UAC Bypass With Fake DLL	Defense Evasion	T1574.002	7
Windows: UAC Bypass via Event Viewer	Defense Evasion	T1548.002	7
Windows: UAC Bypass via ICMLuaUtil	Defense Evasion	T1548.002	7
Windows: UAC Bypass via Windows Firewall Snap-In Hijack	Persistence	none	5
Windows: UEFI Persistence Via Wpbbin - FileCreation	Defense Evasion	T1542.001	7
Windows: UEFI Persistence Via Wpbbin - ProcessCreation	Defense Evasion	T1542.001	7
Windows: UIPromptForCredentials DLLs	Collection	T1056.002	5
Windows: Uncommon One Time Only Scheduled Task At 00:00	Persistence	none	7
Windows: Uninstall Crowdstrike Falcon	Defense Evasion	T1562.001	5
Windows: Uninstall Sysinternals Sysmon	Defense Evasion	T1562.001	7
Windows: Unmount Share Via Net.EXE	Defense Evasion	T1070.005	3
Windows: Unsigned AppX Installation Attempt Using Add-AppxPackage	Persistence	none	5
Windows: Unsigned Image Loaded Into LSASS Process	Credential Access	T1003.001	5
Windows: Unusual Child Process of dns.exe	Initial Access	T1133	7
Windows: Unusual Parent Process For Cmd.EXE	Persistence	none	5
Windows: Usage Of Web Request Commands And Cmdlets	Execution	T1059.001	5
Windows: Use Icacls to Hide File to Everyone	Defense Evasion	T1564.001	5
Windows: Use NTFS Short Name in Command Line	Defense Evasion	T1564.004	5
Windows: Use NTFS Short Name in Image	Defense Evasion	T1564.004	7
Windows: Use Of The SFTP.EXE Binary As A LOLBIN	Persistence	none	5
Windows: Use Radmin Viewer Utility	Execution	T1072	7
Windows: Use Short Name Path in Command Line	Defense Evasion	T1564.004	5
Windows: Use Short Name Path in Image	Defense Evasion	T1564.004	5
Windows: Use of Adplus.exe	Credential Access	T1003.001	5
Windows: Use of CLIP	Collection	T1115	3
Windows: Use of Forfiles For Execution	Persistence	none	5
Windows: Use of GoToAssist Remote Access Software	Command And Control	T1219	5
Windows: Use of LogMeIn Remote Access Software	Command And Control	T1219	5
Windows: Use of OpenConsole	Persistence	none	5
Windows: Use of Pcalua For Execution	Persistence	none	5
Windows: Use of PktMon.exe	Credential Access	T1040	5
Windows: Use of Remote.exe	Persistence	none	5
Windows: Use of ScreenConnect Remote Access Software	Command And Control	T1219	5
Windows: Use of Scriptrunner.exe	Persistence	none	5
Windows: Use of Squirrel.exe	Persistence	none	5
Windows: Use of Sysinternals PsService	Persistence	T1543.003	5
Windows: Use of TTDInject.exe	Persistence	none	5
Windows: Use of UltraVNC Remote Access Software	Command And Control	T1219	5
Windows: Use of UltraViewer Remote Access Software	Command And Control	T1219	5
Windows: Use of VSIISExeLauncher.exe	Persistence	none	5
Windows: Use of VisualUiaVerifyNative.exe	Persistence	none	5
Windows: Use of W32tm as Timer	Discovery	T1124	7
Windows: Use of Wfc.exe	Persistence	none	5
Windows: User Discovery And Export Via Get-ADUser Cmdlet	Discovery	T1033	5
Windows: Using SettingSyncHost.exe as LOLBin	Defense Evasion	T1574.008	7
Windows: UtilityFunctions.ps1 Proxy Dll	Persistence	none	5
Windows: VBA DLL Loaded Via Office Application	Execution	T1204.002	7
Windows: VHD Image Download Via Browser	Resource Development	T1587.001	5
Windows: VMGuestLib DLL Sideload	Defense Evasion	T1574.002	5
Windows: VMToolsd Suspicious Child Process	Persistence	none	7
Windows: Veeam Backup Database Suspicious Query	Collection	T1005	5
Windows: VeeamBackup Database Credentials Dump	Collection	T1005	7
Windows: Verclsid.exe Runs COM Object	Persistence	none	5
Windows: Visual Basic Command Line Compiler Usage	Defense Evasion	T1027.004	7
Windows: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution	Persistence	none	5
Windows: Visual Studio NodejsTools PressAnyKey Renamed Execution	Persistence	none	5
Windows: VolumeShadowCopy Symlink Creation Via Mklink	Credential Access	T1003.003	7
Windows: VsCode Child Process Anomaly	Defense Evasion	T1202	5
Windows: VsCode Powershell Profile Modification	Persistence	T1546.013	5
Windows: Vulnerable HackSys Extreme Vulnerable Driver Load	Persistence	T1543.003	7
Windows: Vulnerable WinRing0 Driver Load	Persistence	T1543.003	7
Windows: WINEKEY Registry Modification	Persistence	none	7
Windows: WMI Backdoor Exchange Transport Agent	Persistence	T1546.003	9
Windows: WMI Event Subscription	Persistence	T1546.003	7
Windows: WMI Persistence - Command Line Event Consumer	Persistence	T1546.003	7
Windows: WMI Persistence - Script Event Consumer	Persistence	T1546.003	5
Windows: WMI Persistence - Script Event Consumer File Write	Persistence	T1546.003	7
Windows: WMI Script Host Process Image Loaded	Persistence	T1546.003	7
Windows: WMIC Loading Scripting Libraries	Defense Evasion	T1220	7
Windows: WMIC Remote Command Execution	Execution	T1047	5
Windows: WSL Child Process Anomaly	Defense Evasion	T1202	5
Windows: WScript or CScript Dropper: Sysmon V1	Persistence	none	7
Windows: Wab Execution From Non Default Location	Persistence	none	7
Windows: Wab/Wabmig Unusual Parent Or Child Processes	Persistence	none	7
Windows: Wdigest CredGuard Registry Modification	Defense Evasion	T1112	7
Windows: Weak or Abused Passwords In CLI	Persistence	none	5
Windows: Webshell Detection With Command Line Keywords	Persistence	T1505.003	7
Windows: Webshell Hacking Activity Patterns	Persistence	T1505.003	7
Windows: Webshell Recon Detection Via CommandLine Processes	Persistence	T1505.003	7
Windows: WerFault Accessing LSASS	Credential Access	T1003.001	7
Windows: WerFault LSASS Process Memory Dump	Credential Access	T1003.001	7
Windows: WhoAmI as Parameter	Discovery	T1033	7
Windows: Whoami Utility Execution	Discovery	T1033	5
Windows: Whoami.EXE Execution Anomaly	Discovery	T1033	7
Windows: WinDbg/CDB LOLBIN Usage	Execution	T1106	5
Windows: WinDivert Driver Load	Defense Evasion	T1599.001	7
Windows: WinRM Access with Evil-WinRM	Lateral Movement	T1021.006	5
Windows: WinSxS Executable File Creation By Non-System Process	Persistence	none	5
Windows: Windows Admin Share Mount Via Net.EXE	Lateral Movement	T1021.002	5
Windows: Windows Binaries Write Suspicious Extensions	Persistence	none	7
Windows: Windows Binary Executed From WSL	Defense Evasion	T1202	5
Windows: Windows Credential Editor Install Via Registry	Credential Access	T1003.001	9
Windows: Windows Credential Manager Access via VaultCmd	Credential Access	T1555.004	5
Windows: Windows Defender Definition Files Removed	Defense Evasion	T1562.001	5
Windows: Windows Defender Download Activity	Defense Evasion	T1218.010	7
Windows: Windows Firewall Disabled via PowerShell	Persistence	none	5
Windows: Windows Hotfix Updates Reconnaissance Via Wmic.EXE	Execution	T1047	5
Windows: Windows Internet Hosted WebDav Share Mount Via Net.EXE	Lateral Movement	T1021.002	7
Windows: Windows Processes Suspicious Parent Directory	Defense Evasion	T1036.005	3
Windows: Windows Registry Trust Record Modification	Initial Access	T1566.001	5
Windows: Windows Share Mount Via Net.EXE	Lateral Movement	T1021.002	3
Windows: Windows Shell/Scripting Application File Write to Suspicious Folder	Persistence	none	7
Windows: Windows Shell/Scripting Processes Spawning Suspicious Programs	Execution	T1059.005	7
Windows: Windows Spooler Service Suspicious Binary Load	Persistence	none	1
Windows: Winrar Compressing Dump Files	Collection	T1560.001	7
Windows: Winrar Execution in Non-Standard Folder	Collection	T1560.001	7
Windows: Wlrmdr Lolbin Use as Launcher	Persistence	none	5
Windows: WmiPrvSE Spawned A Process	Execution	T1047	5
Windows: Wmiexec Default Output File	Execution	T1047	9
Windows: Wmiprvse Wbemcomn DLL Hijack: Sysmon	Execution	T1047	9
Windows: Wmiprvse Wbemcomn DLL Hijack: Sysmon V2	Execution	T1047	7
Windows: Write Protect For Storage Disabled	Persistence	none	5
Windows: Writing Local Admin Share	Persistence	T1546.002	5
Windows: Writing Of Malicious Files To The Fonts Folder	Defense Evasion	T1211	5
Windows: Wscript Shell Run In CommandLine	Persistence	none	7
Windows: Wuauclt Network Connection	Persistence	none	5
Windows: Wusa Extracting Cab Files From Suspicious Paths	Persistence	none	7
Windows: XORDump Use	Credential Access	T1003.001	7
Windows: XSL Script Processing	Defense Evasion	T1220	5
Windows: Zip A Folder With PowerShell For Staging In Temp	Collection	T1074.001	5

Microsoft Windows System Log via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Virtual Machine SCSI Bus Reset	Impact	T1499.001	9
Windows Disk controller problem	Storage	none	9
Windows Server Shutting Down	Impact	T1489	6
Windows: Anydesk Remote Access Software Service Installation	Persistence	none	5
Windows: CobaltStrike Service Installations: System Log	Execution	T1569.002	9
Windows: Credential Dumping Tools Service Execution - System	Execution	T1569.002	7
Windows: DHCP Server Error Failed Loading the CallOut DLL	Defense Evasion	T1574.002	7
Windows: DHCP Server Loaded the CallOut DLL	Defense Evasion	T1574.002	9
Windows: Eventlog Cleared	Defense Evasion	T1070.001	5
Windows: Important Windows Service Terminated Unexpectedly	Persistence	none	7
Windows: Important Windows Service Terminated With Error	Persistence	none	7
Windows: Invoke-Obfuscation COMPRESS OBFUSCATION: System Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation RUNDLL LAUNCHER: System Log	Execution	T1059.001	5
Windows: Invoke-Obfuscation STDIN Launcher: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Stdin: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Clip: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use MSHTA: System Log	Execution	T1059.001	7
Windows: Invoke-Obfuscation Via Use Rundll32: System Log	Execution	T1059.001	7
Windows: KDC RC4-HMAC Downgrade CVE-2022-37966	Persistence	none	7
Windows: KrbRelayUp Service Installation	Persistence	none	7
Windows: Local Privilege Escalation Indicator TabTip	Collection	T1557.001	7
Windows: Mesh Agent Service Installation	Command And Control	T1219	5
Windows: Meterpreter or Cobalt Strike Getsystem Service Installation - System	Defense Evasion	T1134.002	9
Windows: Moriya Rootkit: System Log	Persistence	T1543.003	9
Windows: NTFS Vulnerability Exploitation	Impact	T1499.001	7
Windows: NTLMv1 Logon Between Client and Server	Defense Evasion	T1550.002	3
Windows: NetSupport Manager Service Install	Persistence	none	5
Windows: New PDQDeploy Service - Client Side	Persistence	T1543.003	5
Windows: New PDQDeploy Service - Server Side	Persistence	T1543.003	5
Windows: PAExec Service Installation	Execution	T1569.002	5
Windows: Potential CVE-2021-42287 Exploitation Attempt	Credential Access	T1558.003	5
Windows: Potential RDP Exploit CVE-2019-0708	Lateral Movement	T1210	5
Windows: PowerShell Scripts Installed as Services	Execution	T1569.002	7
Windows: ProcessHacker Privilege Elevation	Execution	T1569.002	7
Windows: RTCore Suspicious Service Installation	Persistence	none	7
Windows: Remote Access Tool Services Have Been Installed - System	Execution	T1569.002	5
Windows: Remote Utilities Host Service Install	Persistence	none	5
Windows: Service Installation in Suspicious Folder	Persistence	T1543.003	5
Windows: Service Installation with Suspicious Folder Pattern	Persistence	T1543.003	7
Windows: Service Installed By Unusual Client - System	Persistence	none	7
Windows: Sliver C2 Default Service Installation	Execution	T1569.002	7
Windows: Suspicious Service Installation	Persistence	T1543.003	7
Windows: Suspicious Service Installation Script	Persistence	T1543.003	7
Windows: System Eventlog Cleared	Defense Evasion	T1070.001	7
Windows: TacticalRMM Service Installation	Command And Control	T1219	5
Windows: Volume Shadow Copy Mount	Credential Access	T1003.002	3
Windows: Vulnerable Netlogon Secure Channel Connection Allowed	Persistence	none	7
Windows: Windows Defender Threat Detection Disabled - Service	Defense Evasion	T1562.001	3
Windows: Windows Service Terminated With Error	Persistence	none	3
Windows: Windows Update Error	Persistence	none	3
Windows: smbexec.py Service Installation	Lateral Movement	T1021.002,T1569.002,T1021.002	9

Microsoft Windows Task Scheduler Operational Logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows Task Scheduler: Task Registered	Execution	T1053.002	6

Microsoft Windows Terminal Services LocalSessionManager/Operational logs via FortiSIEM Agent

Name	Tactic	Technique	Severity
Windows: Ngrok Usage with Remote Desktop Service	Persistence	none	7

Microsoft Windows via Active Directory Discovery

Name	Tactic	Technique	Severity
Successful Windows Dormant Account Logon	Credential Access	T1110.001	9
Windows Dormant Account Detected	Credential Access	T1110.001	4

Microsoft Windows via FortiSIEM Agent

Name	Tactic	Technique	Severity
Server Installed Software Change	Defense Evasion	T1218.001	6

Microsoft Windows via FortiSIEM Agent with UEBA turned on

Name	Tactic	Technique	Severity
UEBA AI detects unusual drive unmounted	UEBA	none	7
UEBA AI detects unusual file creation	UEBA	T1074.001	7
UEBA AI detects unusual file deletion	UEBA	none	7
UEBA AI detects unusual file download	UEBA	none	7
UEBA AI detects unusual file movement	UEBA	none	7
UEBA AI detects unusual file printed	UEBA	none	7
UEBA AI detects unusual file reading	UEBA	none	7
UEBA AI detects unusual file renamed	UEBA	none	7
UEBA AI detects unusual file upload	UEBA	none	7
UEBA AI detects unusual file writing	UEBA	none	7
UEBA AI detects unusual host logon	UEBA	T1078.003	7
UEBA AI detects unusual machine off	UEBA	none	7
UEBA AI detects unusual machine on	UEBA	none	7
UEBA AI detects unusual new drive mounted	UEBA	none	7
UEBA AI detects unusual process created	UEBA	none	7
UEBA AI detects unusual process not restarted	UEBA	none	7
UEBA AI detects unusual process started	UEBA	none	7
UEBA AI detects unusual process stopped	UEBA	none	7
UEBA AI detects unusual user logoff	UEBA	none	7
UEBA Policy detects MTP read	UEBA	none	7
UEBA Policy detects MTP write	UEBA	none	7
UEBA Policy detects NFS read	UEBA	none	7
UEBA Policy detects Tor client usage	Command And Control	T1090.002	7
UEBA Policy detects antivirus not started	UEBA	none	7
UEBA Policy detects antivirus stopped	UEBA	none	7
UEBA Policy detects backup applications	UEBA	none	7
UEBA Policy detects browser download	UEBA	none	7
UEBA Policy detects browser upload	UEBA	none	7
UEBA Policy detects cloud upload	UEBA	T1537	7
UEBA Policy detects email download	Collection	T1114.001	7
UEBA Policy detects email upload	Collection	T1114.001	7
UEBA Policy detects encryption tools	UEBA	none	7
UEBA Policy detects file archiver application	Collection	T1560.001	7
UEBA Policy detects file printed	UEBA	none	7
UEBA Policy detects files copied over remote desktop	UEBA	T1014	7
UEBA Policy detects gaming application	UEBA	none	7
UEBA Policy detects hacking tool and footprints	UEBA	none	7
UEBA Policy detects hacking tool usage	UEBA	none	7
UEBA Policy detects malicious powershell execution	UEBA	none	7
UEBA Policy detects nfs write	UEBA	none	7
UEBA Policy detects potential leaver editing a CV at work	UEBA	none	7
UEBA Policy detects potential pirated media	UEBA	none	7
UEBA Policy detects ransomware file types	UEBA	none	7
UEBA Policy detects ransomware note	UEBA	none	9
UEBA Policy detects removable media read	UEBA	T1025	7
UEBA Policy detects removable media write	UEBA	T1025	7
UEBA Policy detects snipping tool	UEBA	none	7
UEBA Policy detects software installation	UEBA	none	7
UEBA Policy detects suspicious applications	UEBA	none	7
UEBA Policy detects uncommon VPN client	UEBA	none	7
Windows Removable Media Inserts	Collection	T1025	7
Windows Torrent Client	Command And Control	T1090.002	7

Microsoft Windows via OMI

Name	Tactic	Technique	Severity
Sudden Increase in WMI or OMI Response Times	Impact	T1499.002	7
WMI or OMI Service Unavailable	Impact	T1489	9

Microsoft Windows via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Account Locked: Domain	Credential Access	T1110.001	6
Account Locked: Server	Credential Access	T1110.001	8
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Logon Failures: Domain	Credential Access	T1110.001	4
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Domain	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8

Mimecast via MIMECAST_API

Name	Tactic	Technique	Severity
Malware found in mail	Collection	T1114.001	9
Mimecast: User clicked malicious link in email	Reconnaissance	T1598.003	9

Motorola AirDefense via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9

Motorola WiNG WLAN AP via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9

NetApp via DataONTAP

Name	Tactic	Technique	Severity
NetApp Back to Back Consistency Point	Impact	T1499.001	9
NetApp CIFS Latency Critical	Impact	T1499.001	9
NetApp CIFS Read/Write Latency Warning	Impact	T1499.001	5
NetApp FCP Read/Write Latency Critical	Impact	T1499.001	9
NetApp FCP Read/Write Latency Warning	Impact	T1499.001	5
NetApp ISCSI Read/Write Latency Critical	Impact	T1499.001	9
NetApp ISCSI Read/Write Latency Warning	Impact	T1499.001	5
NetApp NFS Read/Write Latency Critical	Impact	T1499.001	9
NetApp NFS Read/Write Latency Warning	Impact	T1499.001	5
NetApp Volume Read/Write Latency Critical	Impact	T1499.001	9
NetApp Volume Read/Write Latency Warning	Impact	T1499.001	5

NetApp via SNMP Trap

Name	Tactic	Technique	Severity
Critical NetApp Trap	Storage	none	9
Critical NetApp Trap: can be auto cleared	Storage	none	9
Warning NetApp Trap	Storage	none	7
Warning NetApp Trap: can be auto cleared	Storage	none	7

NetScaler via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

Network devices via Syslog

Name	Tactic	Technique	Severity
Multiple Login Failures: Net Device: No Source IP	Credential Access	T1110.001	9

Network Traffic

Name	Tactic	Technique	Severity
Excessive Repeated DNS Queries To Same Domain	Command And Control	T1568.001	6
Suspicious Botnet like End host DNS Behavior	Command and Control	none	6
Executable file posting from external source	Execution	none	9
Unapproved File Execution	Execution	none	8

Nginx via Syslog

Name	Tactic	Technique	Severity
Excessive Web Request Failures	Application	none	7
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

Office 365 via Management Activity API

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Oracle Database Server via JDBC

Name	Tactic	Technique	Severity
Database DDL changes	Audit	none	7
Database user or group changes	Persistence	T1098.001	7
Multiple Logon Failures: Database	Credential Access	T1110.001	9
Multiple Logon Failures: Misc App	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: Database	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Misc App	Credential Access	T1110.001	9
Suspicious Database Logon	Initial Access	T1078.003	7

Oracle DB Server via JDBC

Name	Tactic	Technique	Severity
Excessively Slow Oracle DB Query	Database	none	7
High Oracle Non-System Table Space Usage	Database	none	7
High Oracle System Table Space Usage	Database	none	7
Oracle DB Alert Log Error	Database	none	8
Oracle DB Low Buffer Cache Hit Ratio	Database	none	7
Oracle DB Low Library Cache Hit Ratio	Database	none	7
Oracle DB Low Row Cache Hit Ratio	Database	none	7
Oracle DB Low Row Memory Sorts Ratio	Memory	none	7
Oracle Database Instance Down	Impact	T1489	9
Oracle Database Listener Down	Impact	T1489	9
Oracle Database not backed up for 1 day	Database	none	9

Oracle OCI via OCI_Streaming_SDK

Name	Tactic	Technique	Severity
Oracle OCI: Customer Secret Key Created	Persistence	T1098.001	9
Oracle OCI: Group Created	Persistence	T1098.001	7
Oracle OCI: Policy Created	Defense Evasion	T1562.007	7
Oracle OCI: Policy Deleted	Defense Evasion	T1562.007	7
Oracle OCI: User API Key Created and Uploaded	Persistence	T1098.001	7
Oracle OCI: User Activated MFA	Audit	none	4
Oracle OCI: User Added to a Group	Persistence	T1098.001	9
Oracle OCI: User Auth Token Created	Persistence	T1098.001	7
Oracle OCI: User Created	Persistence	T1136.003	9
Oracle OCI: User Deleted	Impact	T1531	9
Oracle OCI: User Disabled MFA	Persistence	T1098.001	9
Oracle OCI: User OAuth Client Credential Created	Persistence	T1098.001	9
Oracle OCI: User SMTP Credentials Created	Resource Development	T1585.002	7

Otorio RAM2 via Syslog

Name	Tactic	Technique	Severity
Otorio RAM2 Alert has Triggered	Policy Violation	none	9
Otorio RAM2 Vulnerability Discovered	Policy Violation	none	9

Palo Alto Cortex XDR via Syslog

Name	Tactic	Technique	Severity
Cortex XDR Alert Detected	Behavioral Anomaly	none	9
Cortex XDR Alert Prevented	Behavioral Anomaly	none	7

Palo Alto PAN-OS via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
ARP Exploit	Credential Access	T1557.002	7
Adware process found	Persistence	none	7
Backdoor Found by Network IPS	Execution	T1204.001	9
Brute Force App Login Success	Credential Access	T1110.001	9
Code Injection Attack detected by NIPS	Execution	none	9
Compromised Host Detected by Network IPS	Persistence	none	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Default password usage	Initial Access	none	7
Distributed DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack detected by NIPS	Impact	T1498.001	9
DoS Attack on Network Devices by Network IPS	Impact	T1498.001	9
DoS Attack on WLAN Infrastructure by Network IPS	Impact	T1498.001	9
Excessive WLAN Exploits: Same Source	Execution	none	9
High Risk Rating Cisco IPS Exploit	Execution	none	9
High Severity Inbound Denied Security Exploit	Execution	none	5
High Severity Inbound Permitted IPS Exploit	Execution	none	9
High Severity Outbound Denied IPS Exploit	Execution	none	9
High Severity Outbound Permitted IPS Exploit	Execution	none	9
High Severity WLAN Attack	Execution	none	9
IPS/AV Evasion attempts	Defense Evasion	T1211	7
IRC traffic detected	Policy Violation	none	7
Identity Spoofing Exploit	Credential Access	T1557.002	7
Info Leak Exploits	Discovery	none	5
Malware found by firewall but not remediated	Persistence	none	9
Multiple Distinct IPS Events From Same Src	Execution	none	9
Multiple IPS Detected Scans From Same Src	Discovery	T1046	7
P2P traffic detected	Policy Violation	none	7
Palo Alto Config Change Failed	Audit	none	6
Palo Alto Config Change Succeeded	Audit	none	4
Phishing attack found but not remediated	Reconnaissance	T1598.002,T1598.003	9
Privilege Escalation Exploits	Privilege Escalation	T1548.004	7
Replay Exploit	Credential Access	T1557.002	7
Rootkit found	Persistence	T1014,T1554,T1601.001	9
Session Hijacking Exploit	Credential Access	T1557.002	7
Spyware Found by Network IPS	Execution	T1204.001	9
Stealth Scan using a tool	Discovery	T1046	9
System Exploit Detected by Network IPS	Execution	none	7
System Exploit Detected by Network IPS: Likely Success	Execution	none	9
Targeted System/Application Scan	Discovery	T1046	7
Tunneled traffic detected	Command And Control	T1572	7
Unauthorized Palo Alto Firewall Config Change	Audit	none	8
WLAN Scan	Discovery	T1046	7
Website defacement attack	Impact	T1491.001,T1491.002	9
Wireless MITM attack detected by Network IPS	Credential Access	T1557.002	9

Palo Alto Traps Endpoint Security Manager via Syslog

Name	Tactic	Technique	Severity
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

Palo Alto via Syslog or Netflow

Name	Tactic	Technique	Severity
End User DNS Queries to Unauthorized DNS Servers	Command And Control	T1568.001	7
Excessive Denied Connections From An External Country	Impact	T1498.001	7
Excessive Denied Connections From Same Src	Impact	T1498.001	8
Excessive Denied Connections To A Port	Impact	T1498.001	7
Excessive Denied Connections To Same Destination	Impact	T1498.001	8
Excessive Denied DNS Queries	Command And Control	T1568.001	6
Excessive End User DNS Queries	Command And Control	T1568.001	7
Excessive End User Mail To Unauthorized Mail Gateways	Exfiltration	T1020.001	8
Excessive SNMP Port 161 Traffic from a Source to the same Destination	Collection	T1602.001	5
Half Open TCP DDOS Attack	Impact	T1498.001	7
Heavy Half Open TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy Half Open TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy ICMP Ping sweep	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy TCP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	8
Heavy UDP Host Scan	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	7
Heavy UDP Host Scan On Fixed Port	Discovery	T1018,T1590.003,T1590.004,T1590.005,T1595.001	9
Invalid TCP/UDP Port Traffic	Command And Control	T1571	9
Large Inbound Transfer From Outside My Country	Command And Control	T1071.001	8
Large Outbound Transfer To Outside My Country	Exfiltration	T1048.001	8
Sudden Change In DNS Data Transfer Pattern From A Specific Host	Command And Control	T1568.001	7
Sudden Increase In DNS Requests From A Specific Host	Command And Control	T1568.001	7
TCP DDOS Attack	Impact	T1498.001	8
Traffic to bogon networks	Command and Control	none	8
Unusual ICMP Traffic	Defense Evasion	none	7
Unusually Large ICMP Echo Packets	Command And Control	T1095	9
Blocked File Execution	Execution	none	8
Blocklist User Agent Match	Exfiltration	T1041	9
Dynamically generated host name: malware likely	Command And Control	T1568.002	7
Excessive End User Mail	Collection	T1114.001	8
Excessive ICMP Unreachables	Network	none	6
Heavy Half Open TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy Half Open TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy TCP Port Scan: Multiple Destinations	Discovery	T1046	8
Heavy TCP Port Scan: Single Destination	Discovery	T1046	7
Heavy UDP Port Scan: Multiple Hosts	Discovery	T1046	9
Heavy UDP Port Scan: Single Host	Discovery	T1046	7
ICMP Flood From Same Source	Impact	T1498.001	7
Inbound Traffic from Open Proxies	Command And Control	T1090.002	9
Inbound Traffic from Tor Network	Command And Control	T1090.002	9
Inbound insecure protocol traffic detected	Credential Access	T1552.001	7
Invalid TCP Flags: High Intensity	Discovery	none	9
Invalid TCP Flags: Medium Intensity	Discovery	none	7
Large Outbound Transfer	Exfiltration	T1048.001	8
Log4J Exploit Request Detected By Regex	Lateral Movement	T1210	7
Malware hash match	Exfiltration	T1041	9
OT Permited Traffic not from Purdue Level 3 to Level 2		none	7
OT Permited Traffic not from Purdue Level 3.5 to Level 3		none	7
OT Permited Traffic not from Purdue Level 4 to Level 3.5		none	7
OT Permited Traffic not from Purdue Level 5 to Level 4		none	7
Outbound Traffic to Open Proxies	Command And Control	T1090.002	9
Outbound Traffic to Tor Network	Command And Control	T1090.002	9
Outbound Traffic to Unapproved Public DNS Servers	Policy Violation	none	7
Outbound insecure protocol traffic from non guest network detected	Credential Access	T1552.001	7
Outbreak: DARKSIDE Domain Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Inbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: DARKSIDE Ransomware Outbound Network Traffic Detected	Exfiltration	T1041	9
Outbreak: FortiGate detected CISA Top 20 Vulnerability on Network	Lateral Movement	T1210	9
Outbreak: HAFNIUM Inbound Network Traffic	Command And Control	T1095	9
Outbreak: HAFNIUM Outbound Network Traffic	Command And Control	T1095	9
Outbreak: SUNBURST Outbound Network Traffic	Command And Control	T1095	9
P2P traffic consuming high network bandwidth	Policy Violation	none	7
Permitted Traffic from AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Blocklist DE Malware IP List	Exfiltration	T1041	9
Permitted Traffic from C2 Tracker Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CINS Score Malware IP List	Exfiltration	T1041	9
Permitted Traffic from CertPL Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Cisco Talos Malware IP List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from DigitalSide Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Permitted Traffic from Emerging Threat IP List	Command and Control	none	7
Permitted Traffic from FireHol Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiGuard Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiRecon Malware IP List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from FortiSOAR Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Greensnow Malware IP List	Exfiltration	T1041	9
Permitted Traffic from IPSum Malware IP List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from MISP Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from Mandiant Malware IP List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from OpenCTI Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Proofpoint Malware IP List	Exfiltration	T1041	9
Permitted Traffic from Snort Malware IP List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware Domain List	Exfiltration	T1041	9
Permitted Traffic from TweetFeed Malware IP List	Exfiltration	T1041	9
Remote Desktop traffic from Internet	Lateral Movement	T1021.001,T1133,T1219	9
Sudden Increase In Firewall Denied Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Denied Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Firewall Permitted Outbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase In Permitted Traffic From Host	Impact	T1498.001	7
Sudden Increase In Permitted Traffic To Host	Impact	T1498.001	7
Sudden Increase in Firewall Permitted Inbound Traffic To A Specific TCP/UDP port	Impact	T1498.001	7
Sudden Increase in ICMP Requests From A Host	Impact	T1498.001	7
Sudden Increase in Inbound Firewall Aggregate Denies	Impact	T1498.001	7
Sudden Increase in Outbound Firewall Aggregate Denies	Impact	T1498.001	7
Traffic to AbuseCH Botnet C2 Malware IP List	Exfiltration	T1041	9
Traffic to Anomali ThreatStream Malware IP List	Exfiltration	T1041	9
Traffic to Blocklist DE Malware IP List	Exfiltration	T1041	9
Traffic to C2 Tracker Malware IP List	Exfiltration	T1041	9
Traffic to CINS Score Malware IP List	Exfiltration	T1041	9
Traffic to CertPL Malware Domain List	Exfiltration	T1041	9
Traffic to Cisco Talos Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware Domain List	Exfiltration	T1041	9
Traffic to DigitalSide Malware IP List	Exfiltration	T1041	9
Traffic to DigitalSide Malware URL List	Exfiltration	T1041	9
Traffic to Dragos Worldview Malware IP List	Lateral Movement	T1210	9
Traffic to Emerging Threat IP List	Exfiltration	T1048.001	7
Traffic to FireHol Malware IP List	Exfiltration	T1041	9
Traffic to FortiGuard Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware Domain List	Exfiltration	T1041	9
Traffic to FortiRecon Malware IP List	Exfiltration	T1041	9
Traffic to FortiRecon Malware URL List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware Domain List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware IP List	Exfiltration	T1041	9
Traffic to FortiSOAR Malware URL List	Exfiltration	T1041	9
Traffic to Greensnow Malware IP List	Exfiltration	T1041	9
Traffic to IPSum Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware Domain List	Exfiltration	T1041	9
Traffic to MISP Malware IP List	Exfiltration	T1041	9
Traffic to MISP Malware URL List	Exfiltration	T1041	9
Traffic to Mandiant Malware Domain List	Exfiltration	T1041	9
Traffic to Mandiant Malware IP List	Exfiltration	T1041	9
Traffic to Mandiant Malware URL List	Exfiltration	T1041	9
Traffic to OpenCTI Malware Domain List	Exfiltration	T1041	9
Traffic to OpenCTI Malware IP List	Exfiltration	T1041	9
Traffic to OpenCTI Malware URL List	Exfiltration	T1041	9
Traffic to OpenPhish Malware URL List	Exfiltration	T1041	9
Traffic to Proofpoint Malware IP List	Exfiltration	T1041	9
Traffic to Snort Malware IP List	Exfiltration	T1041	9
Traffic to ThreatFox Malware URL List	Exfiltration	T1041	9
Traffic to TweetFeed Malware Domain List	Exfiltration	T1041	9
Traffic to TweetFeed Malware IP List	Exfiltration	T1041	9
Traffic to TweetFeed Malware URL List	Exfiltration	T1041	9
VNC traffic from Internet	Lateral Movement	T1021.005,T1133,T1219	9

Postfix Mail Server via Syslog

Name	Tactic	Technique	Severity
Excessive Postfix gateway connection failures	Impact	T1499.002	8
Excessive Postfix mail send error	Impact	T1499.002	8
Excessive Postfix mail send latency	Collection	T1114.001	6

Pulse Secure via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Qualys via QualysAPI

Name	Tactic	Technique	Severity
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9

Radvision via SNMP Trap

Name	Tactic	Technique	Severity
Radvision Corrupt video packets	Video Conferencing	none	7
Radvision Ethernet Loss	Impact	T1489	7
Radvision Gateway Down	Impact	T1489	9
Radvision Hardware Removed/Swapped	Video Conferencing	none	7
Radvision ISDN Loss	Impact	T1489	7
Radvision call setup issues	Video Conferencing	none	7

Rapid7 via NexPose API or InsightVM_API

Name	Tactic	Technique	Severity
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9

Riverbed via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
License Issue	License	none	7
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Riverbed Steelhead Service Health Critical	WAN	none	9
Riverbed Steelhead System Health Critical	WAN	none	9
Riverbed Steelhead System Health Degraded	WAN	none	7
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Routers via SNMP

Name	Tactic	Technique	Severity
BGP Neighbor Down	Impact	T1529	9
OSPF Neighbor Down	Impact	T1529	9

SentinelOne via Syslog

Name	Tactic	Technique	Severity
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

SonicOS via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

SonicWall Firewall via Syslog

Name	Tactic	Technique	Severity
Rogue or Unsecure AP Detected	Initial Access	none	7

Sophos Firewall via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Sophos Web Filter via Syslog

Name	Tactic	Technique	Severity
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9
Website access policy violation	Policy Violation	none	5
Website access policy violation: High volume	Policy Violation	none	9
Website access policy violation: Multiple categories	Policy Violation	none	9

Squid log via Syslog

Name	Tactic	Technique	Severity
Excessive HTTP Client Side Errors	Impact	T1498.001	7

Storage Device via SNMP

Name	Tactic	Technique	Severity
NFS Disk space Warning	Impact	T1499.001	5
Storage CPU Warning	Impact	T1499.001	5
Storage Device CPU Critical	Impact	T1499.001	9
Storage Device Disk Space Critical	Impact	T1499.001	9

Symantec CIDS

Name	Tactic	Technique	Severity
High Severity Symantec Host IPS Exploit	Execution	none	9

Symantec Endpoint Protection Service via Syslog

Name	Tactic	Technique	Severity
Malware found but not remediated	Exfiltration	T1041	9
Malware outbreak	Lateral Movement	none	9
Spyware found but not remediated	Execution	T1204.001	9

Tenable or Nessus via NessusAPI

Name	Tactic	Technique	Severity
Scanner found medium vulnerability	Impact	T1499.004	7
Scanner found severe vulnerability	Impact	T1499.004	9

Threatdown Nebula via Syslog

Name	Tactic	Technique	Severity
ThreatDown Nebula: Malware Blocked	Initial Access	T1189	8
ThreatDown Nebula: Malware Found	Initial Access	T1189	10
ThreatDown Nebula: PUP Blocked	Defense Evasion	T1562.001	7
ThreatDown Nebula: PUP Found	Defense Evasion	T1562.001	6
ThreatDown Nebula: Suspicious Activity Blocked	Initial Access	T1189	8
ThreatDown Nebula: Suspicious Activity Found	Initial Access	T1189	9
ThreatDown Nebula: Website Blocked	Initial Access	T1189	7

Trend Micro Vision One API

Name	Tactic	Technique	Severity
Trend Vision One: Critical or High Alert Triggered	Execution	none	9

TrendMicro Interscan Web Security via Syslog

Name	Tactic	Technique	Severity
Website access policy violation	Policy Violation	none	5
Website access policy violation: High volume	Policy Violation	none	9
Website access policy violation: Multiple categories	Policy Violation	none	9

UserGate UTM Firewall via Syslog

Name	Tactic	Technique	Severity
UserGate UTM IDPS Alert Detected	Behavioral Anomaly	none	8
Web Traffic to Anomali ThreatStream Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiGuard Malicious URLs	Exfiltration	T1041	9
Web Traffic to FortiSandbox Malicious URLs	Exfiltration	T1041	9

VCenter or ESX via VMSDK

Name	Tactic	Technique	Severity
ESX Server Health: Critical	Impact	T1499.001	9
ESX Server Health: Warning	Impact	T1499.001	7
Virtual Machine CPU Critical	Impact	T1499.001	9
Virtual Machine CPU Warning	Impact	T1499.001	5
Virtual Machine Health: Critical	Impact	T1499.001	9
Virtual Machine Health: Warning	Impact	T1499.001	5
Virtual Machine Memory Swapping Critical	Impact	T1499.001	9
Virtual Machine Memory Swapping Warning	Impact	T1499.001	5

VCenter Performance Monitoring via VMSDK

Name	Tactic	Technique	Severity
Database Server Disk Latency Critical	Storage I/O	none	8
Datastore Space Warning	Impact	T1499.001	7
ESX CPU Critical	Impact	T1499.001	9
ESX CPU Warning	Impact	T1499.001	5
ESX Disk I/O Critical	Impact	T1499.001	9
ESX Disk I/O Warning	Impact	T1499.001	5
ESX Memory Critical	Impact	T1499.001	9
ESX Memory Warning	Impact	T1499.001	5
ESX Network I/O Critical	Impact	T1499.001	9
ESX Network I/O Warning	Impact	T1499.001	5
Sudden Increase in Disk I/O	Impact	T1499.001	7
VCenter Datastore Space Critical	Impact	T1499.001	9

VMware NSX via Syslog

Name	Tactic	Technique	Severity
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Logon Failures: Server	Credential Access	T1110.001	7
Multiple Logon Failures: Web Server	Credential Access	T1110.001	7
Multiple Privileged Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Server	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: Web Server	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

WatchGuard via Syslog

Name	Tactic	Technique	Severity
Failed VPN Logon From Outside My Country	Credential Access	T1110.001	7
Multiple Logon Failures: Same Src and Dest and Multiple Accounts	Credential Access	T1110.001	9
Multiple Logon Failures: Same Src and Multiple Dest	Credential Access	T1110.001	9
Multiple Logon Failures: VPN	Credential Access	T1110.001	6
Repeated Multiple Logon Failures: VPN	Credential Access	T1110.001	9
Successful VPN Logon From Outside My Country	Credential Access	T1110.001	7
Brute Force App Login Success	Credential Access	T1110.001	9
Brute Force Host Login Success	Credential Access	T1110.001	9
Concurrent Failed Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Failed Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful Authentications To Same Account From Multiple Cities of the same Country	Credential Access	T1110.001	7
Concurrent Successful Authentications To Same Account From Multiple Countries	Credential Access	T1110.001	9
Concurrent Successful VPN Authentications To Same Account From Different Countries	Credential Access	T1110.001	9
Lateral Movement Detected	Lateral Movement	none	9
Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Multiple Logon Failures: WLAN	Credential Access	T1110.001	6
Repeated Multiple Login Failures: Net Device	Credential Access	T1110.001	9
Repeated Multiple Logon Failures: WLAN	Credential Access	T1110.001	9
Sudden Increase in User Login Volume	Behavioral Anomaly	none	7
Sudden User Location Change	Credential Access	none	9
Sudden User Login Pattern Change	Behavioral Anomaly	none	7
Suspicious Logon Failure without following successful login	Credential Access	T1110.001	8
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

Windows Security Log via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Attack Kill Chain Completion	Suspicious Activity	none	9
Transient Windows Account Usage - Scheduled	Persistence	T1098.001	9

Windows via OMI or FortiSIEM Agent

Name	Tactic	Technique	Severity
Suspicious Logon Failure without successful login - Scheduled	Credential Access	T1110.001	8

FortiSIEM Rules

Tactics

Use Cases

Data Sources

Rules by MITRE Tactic

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Rules by Use Case

Application Performance Issue

Botnet Detected

Brute Force Logon

Cloud Performance Issue

Command and Control

Correlated IPS Alert

Credential Harvesting

Credential Theft

Data Deletion

Data Exfiltration

Defense Evasion

Denial Of Service

Environmental Performance Issue

FortiSIEM Cluster Health

FortiSIEM Operational Issue

Generic 3rd party Alerts

Hacking Tool Usage

Honeypot match

Host Discovery

Initial Access

IOC Match

Lateral Movement

Log or History Cleared

Logging Disabled

Malware Detected

Network Discovery

Network Performance Issue

Notable Activity

Notable File Change

OT Exploit

Outbreak Alert

Phishing Detected

Policy Violation

Privilege Escalation

Ransomware Detected

Remote Access Software

Server Performance Issue

Services Stopped

Storage Performance Issue

Suspicious Collection Activity

Suspicious Execution

Suspicious Logon

Suspicious Logon Attempt

Suspicious Persistence Activity

Suspicious Service

Systems Config Change

Traffic Anomaly

Tunneling Activity

UEBA Anomaly

Uncommon Activity

Unused Accounts Monitoring

User Account Change

Vulnerability found

Weakening Security

Rules by Data Source

AlertLogic logs via ALERTLOGIC_API_v3 or ALERTLOGIC_IRIS_API

Any Device Agentless FIM via SSH

Any Device Config Monitoring via SSH

Any Device via FortiSIEM Discovery

Any Device via Ping Monitoring