Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

Registry Persistence via AppCert DLL Modification

Persistence

T1546

Registry Persistence via AppInit DLLs Modification

Persistence

T1546

Remote Desktop Protocol - SharpRDP

Lateral Movement

T1021

Remote Scheduled Task Creation or Update using ATSVC Named Pipe

Persistence

T1053

Rename System Utilities

Defense Evasion

T1036

Request for single resource on domain

Command and Control

T1102 T1071

Response rows stateful anomaly on database

Exfiltration

T1537 T1567

RunningRAT request parameters

T1566

Security Event log cleared

Defense Evasion

T1070

Security Service Registry ACL Modification

Security Others

Defense Evasion

T1562

SecurityBridge: A critical event occured

Initial Access

SecurityEvent - Multiple authentication failures followed by a success

Credential Access

T1110

Semperis DSP Kerberos krbtgt account with old password

Credential Access

Semperis DSP Mimikatz's DCShadow Alert

Defense Evasion

T1207

Semperis DSP Recent sIDHistory changes on AD objects

Privilege Escalation

Semperis DSP Well-known privileged SIDs in sIDHistory

Privilege Escalation Defense Evasion

T1134

Semperis DSP Zerologon vulnerability

Privilege Escalation

SenservaPro AD Applications Not Using Client Credentials

Impact

T1529 T1485

Sensitive Azure Key Vault operations

Impact

T1485

Sensitive Data Discovered in the Last 24 Hours

Discovery

T1087

Sensitive Data Discovered in the Last 24 Hours - Customized

Sentinel One - Rule disabled

Defense Evasion

T1070

Sentinel One - Same custom rule triggered on different hosts

Initial Access

Sentinel One - User viewed agent's passphrase

Credential Access

T1555

Server Oriented Cmdlet And User Oriented Cmdlet used

Exfiltration Persistence Collection

T1020 T1098 T1114

Service installation from user writable directory

Execution

T1569

Service Principal Assigned App Role With Sensitive Access

Security Others Identity

Privilege Escalation

T1078

Service Principal Assigned Privileged Role

Security Others Identity

Privilege Escalation

T1078

Service Principal Authentication Attempt from New Country

Security Others Identity

Initial Access

T1078

Service Principal Name (SPN) Assigned to User Account

Impact

T1485

Snowflake - Possible discovery activity

Discovery

Snowflake - Possible privileges discovery activity

Discovery

T1087

Snowflake - Query on sensitive or restricted table

Collection

T1119

Snowflake - Unusual query

Collection

T1119

Snowflake - User granted admin privileges

Privilege Escalation

T1078

Solorigate Defender Detections

Security 0 Day Vulnerability

Initial Access

T1195

Solorigate Domains Found in VM Insights

Command and Control

T1102

Solorigate Named Pipe

Security 0 Day Vulnerability

Defense Evasion Privilege Escalation

T1055

Solorigate Network Beacon

Command and Control

T1102

Sonrai Ticket Assigned

Sonrai Ticket Closed

Sonrai Ticket Escalation Executed

Sonrai Ticket Reopened

Sonrai Ticket Risk Accepted

Sonrai Ticket Snoozed

Sonrai Ticket Updated

SOURGUM Actor IOC - July 2021

Persistence

T1546

SOURGUM Actor IOC - July 2021

Persistence

T1546

Squid proxy events for ToR proxies

Command and Control

T1090 T1008

Squid proxy events related to mining pools

Command and Control

T1102

SSH - Potential Brute Force

Credential Access

T1110

SSM document is publicly exposed

Discovery

T1526

Stale last password change

Initial Access

T1566

Starting or Stopping HealthService to Avoid Detection

Defense Evasion

T1562

Successful API executed from a Tor exit node

Execution

T1204

Successful brute force attack on S3 Bucket.

Defense Evasion

T1562

Successful logon from IP and failure from a different IP

Credential Access Initial Access

T1110 T1078

SUNBURST and SUPERNOVA backdoor hashes

Execution Persistence Initial Access

T1195 T1059 T1546

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)

Security Threat Intelligence

Execution Persistence Initial Access

T1195 T1059 T1546

SUNBURST network beacons

Execution Persistence Initial Access

T1195 T1059 T1546

SUNBURST suspicious SolarWinds child processes

Execution Persistence

SUNBURST suspicious SolarWinds child processes (Normalized Process Events)

Security 0 Day Vulnerability

Execution Persistence

SUNSPOT log file creation

Persistence

T1554

SUNSPOT malware hashes

Persistence

T1554

SUPERNOVA webshell

Security Others

Persistence Commandand Control

T1505 T1071

Suspicious AAD Joined Device Update

Credential Access

T1649

Suspicious application consent for offline access

Credential Access

T1528

Suspicious application consent similar to O365 Attack Toolkit

Credential Access Defense Evasion

T1528 T1550

Suspicious application consent similar to PwnAuth

Credential Access Defense Evasion

T1528 T1550

Suspicious command sent to EC2

Execution

T1204

Suspicious granting of permissions to an account

Persistence Privilege Escalation

T1098 T1548

Suspicious link sharing pattern

Security Others

Credential Access Persistence

Suspicious linking of existing user to external User

Security Others Identity

Privilege Escalation

T1078

Suspicious Login from deleted guest account

Security Others Identity

Privilege Escalation

T1078

Suspicious malware found in the network (Microsoft Defender for IoT)

Impact

T0882

Suspicious modification of Global Administrator user properties

Command and Control Credential Access

Theom - Critical data in API headers or body

Theom - Dark Data with large fin value

Theom - Dev secrets exposed

Theom - Dev secrets unencrypted

Theom - Financial data exposed

Theom - Financial data unencrypted

Theom - Healthcare data exposed

Theom - Healthcare data unencrypted

Theom - Least priv large value shadow DB

Theom - National IDs exposed

Theom - National IDs unencrypted

Theom - Overprovisioned Roles Shadow DB

Theom - Shadow DB large datastore value

Theom - Shadow DB with atypical accesses

Theom - Unencrypted public data stores

Theom Critical Risks

Theom High Risks

Theom Insights

Theom Low Risks

Theom Medium Risks

Third party integrated apps

Exfiltration

T1020

Threat Essentials - Mail redirect via ExO transport rule

Collection Exfiltration

T1114 T1020

Threat Essentials - Mass Cloud resource deletions Time Series Anomaly

Impact

T1485

Threat Essentials - Multiple admin membership removals from newly created admin.

Impact

T1531

Threat Essentials - NRT User added to Azure Active Directory Privileged Groups

Persistence Privilege Escalation

T1098 T1078

Threat Essentials - Time series anomaly for data size transferred to public internet

Exfiltration

T1030

Threat Essentials - User Assigned Privileged Role

Persistence

T1078

Threats detected by Eset

Execution Credential Access Privilege Escalation

Threats detected by ESET

Execution

Ubiquiti - SSH from external source

Initial Access

T1133

Ubiquiti - Unknown MAC Joined AP

Initial Access

T1133

Ubiquiti - Unusual DNS connection

Command and Control

T1090 T1572

Ubiquiti - Unusual FTP connection to external server

Exfiltration

Ubiquiti - Unusual traffic

Initial Access

Unauthorized device in the network (Microsoft Defender for IoT)

Discovery

T0842

Unauthorized DHCP configuration in the network (Microsoft Defender for IoT)

Discovery

T0842

Unauthorized PLC changes (Microsoft Defender for IoT)

Persistence

T0839

Unauthorized remote access to the network (Microsoft Defender for IoT)

Initial Access

T0886

Unusual Anomaly

Security Others

Unusual identity creation using exchange powershell

Security Threat Protection Identity

Persistence

T1136

Unusual Volume of Password Updated or Removed

Impact

T1485

URL Added to Application from Unknown Domain

Security Others

Persistence Privilege Escalation

Initial Access

T1078

User Added to Admin Role

Security Others Identity

Privilege Escalation

T1078

User added to Azure Active Directory Privileged Groups

Persistence Privilege Escalation

T1098 T1078

Privilege Escalation

T1078

Vectra AI Detect - Detections with High Severity

Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Vectra AI Detect - New Campaign Detected

Lateral Movement Command and Control

Vectra AI Detect - Suspected Compromised Account

Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Vectra AI Detect - Suspected Compromised Host

Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Security Threat Protection

Initial Access Execution

T1190 T1203

Wazuh - Large Number of Web errors from an IP

Security Others Networking

Persistence

WDigest downgrade attack

Credential Access

T1003

Web sites blocked by Eset

Exfiltration Command and Control Initial Access

Website blocked by ESET

Exfiltration Command and Control Initial Access

T1041 T1071 T1189 T1566

Windows Binaries Executed from Non-Default Directory

Execution

T1059

Windows Binaries Lolbins Renamed

Execution

T1059

Windows host username encoded in base64 web request

Security Others

Exfiltration Command and Control

T1041 T1071

Workspace deletion activity from an infected device

Security Threat Protection Platform

Initial Access Impact

T1078 T1489

Zero Networks Segement - Machine Removed from protection

Defense Evasion

T1562

Zero Networks Segment - New API Token created

Credential Access

T1528

Zero Networks Segment - Rare JIT Rule Creation

Lateral Movement

T1021

ZeroTrust(TIC3.0) Control Assessment Posture Change

Discovery

T1082

Zinc Actor IOCs domains hashes IPs and useragent - October 2022

Persistence

T1546

Zinc Actor IOCs files - October 2022

Persistence

T1546

Zoom E2E Encryption Disabled

Security Others

Initial Access

T1190 T1133

Categories

Analytic Rules