Collection Command and Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation

Registry Persistence via AppCert DLL Modification

Persistence

T1546

Registry Persistence via AppInit DLLs Modification

Persistence

T1546

Remote Desktop Protocol - SharpRDP

Lateral Movement

T1021

Remote Scheduled Task Creation or Update using ATSVC Named Pipe

Persistence

T1053

Rename System Utilities

Defense Evasion

T1036

Request for single resource on domain

Command and Control

T1102 T1071

Response rows stateful anomaly on database

Exfiltration

T1537 T1567

RunningRAT request parameters

Exfiltration Command and Control

T1041 T1071

S3 bucket access point publicly exposed

Exfiltration

T1537

S3 bucket exposed via ACL

Exfiltration

T1537

S3 bucket exposed via policy

Exfiltration

T1537

S3 bucket suspicious ransomware activity

Impact

T1486

S3 object publicly exposed

Exfiltration

T1537

SailPointIdentityNowAlertForTriggers

Initial Access Collection

T1133 T1005

SailPointIdentityNowEventType

Initial Access

T1133

SailPointIdentityNowEventTypeTechnicalName

Initial Access

T1133

SailPointIdentityNowFailedEvents

Initial Access

T1133

SailPointIdentityNowFailedEventsBasedOnTime

Initial Access

T1133

SailPointIdentityNowUserWithFailedEvent

Initial Access

T1133

SAML update identity provider

Persistence

T1078

Scheduled Task Creation or Update from User Writable Directory

Execution

T1053

Scheduled Task Hide

Defense Evasion

T1562

Sdelete deployed via GPO and run recursively

Impact

T1485

Sdelete deployed via GPO and run recursively (ASIM Version)

Impact

T1485

SEABORGIUM C2 Domains August 2022

Initial Access

T1566

Security Event log cleared

Defense Evasion

T1070

Security Service Registry ACL Modification

Defense Evasion

T1562

SecurityBridge: A critical event occured

Initial Access

SecurityEvent - Multiple authentication failures followed by a success

Credential Access

T1110

Semperis DSP Kerberos krbtgt account with old password

Credential Access

Semperis DSP Mimikatz's DCShadow Alert

Defense Evasion

T1207

Semperis DSP Recent sIDHistory changes on AD objects

Privilege Escalation

Semperis DSP Well-known privileged SIDs in sIDHistory

Privilege Escalation Defense Evasion

T1134

Semperis DSP Zerologon vulnerability

Privilege Escalation

SenservaPro AD Applications Not Using Client Credentials

Impact

T1529 T1485

Sensitive Azure Key Vault operations

Impact

T1485

Sensitive Data Discovered in the Last 24 Hours

Discovery

T1087

Sensitive Data Discovered in the Last 24 Hours - Customized

Sentinel One - Rule disabled

Defense Evasion

T1070

Credential Access

T1110

SlackAudit - Public link created for file which can contain sensitive information.

Exfiltration

T1048

SlackAudit - Suspicious file downloaded.

Initial Access

T1189

Impact

T1485

Snowflake - Possible discovery activity

Discovery

Snowflake - Possible privileges discovery activity

Discovery

T1087

Snowflake - Query on sensitive or restricted table

Collection

T1119

Snowflake - Unusual query

Collection

T1119

Snowflake - User granted admin privileges

Privilege Escalation

T1078

Solorigate Defender Detections

Initial Access

T1195

Solorigate Domains Found in VM Insights

Command and Control

T1102

Solorigate Named Pipe

Defense Evasion Privilege Escalation

T1055

Solorigate Network Beacon

Command and Control

T1102

Sonrai Ticket Assigned

Sonrai Ticket Closed

Sonrai Ticket Escalation Executed

Sonrai Ticket Reopened

Sonrai Ticket Risk Accepted

Sonrai Ticket Snoozed

Sonrai Ticket Updated

SOURGUM Actor IOC - July 2021

Persistence

T1546

SOURGUM Actor IOC - July 2021

Persistence

T1546

Squid proxy events for ToR proxies

Command and Control

T1090 T1008

Squid proxy events related to mining pools

Command and Control

T1102

SSH - Potential Brute Force

Credential Access

T1110

SSM document is publicly exposed

Discovery

T1526

Stale last password change

Initial Access

T1566

Starting or Stopping HealthService to Avoid Detection

Defense Evasion

T1562

Successful API executed from a Tor exit node

Execution

T1204

Successful brute force attack on S3 Bucket.

Defense Evasion

T1562

Successful logon from IP and failure from a different IP

Credential Access Initial Access

T1110 T1078

SUNBURST and SUPERNOVA backdoor hashes

Execution Persistence Initial Access

T1195 T1059 T1546

SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)

Execution Persistence Initial Access

T1195 T1059 T1546

SUNBURST network beacons

Execution Persistence Initial Access

T1195 T1059 T1546

SUNBURST suspicious SolarWinds child processes

Execution Persistence

SUNBURST suspicious SolarWinds child processes (Normalized Process Events)

Execution Persistence

SUNSPOT log file creation

Persistence

T1554

SUNSPOT malware hashes

Persistence

T1554

SUPERNOVA webshell

Persistence Commandand Control

T1505 T1071

Suspicious AAD Joined Device Update

Credential Access

T1649

Suspicious application consent for offline access

Credential Access

T1528

Suspicious application consent similar to O365 Attack Toolkit

Credential Access Defense Evasion

T1528 T1550

Suspicious application consent similar to PwnAuth

Credential Access Defense Evasion

T1528 T1550

Suspicious command sent to EC2

Execution

T1204

Suspicious granting of permissions to an account

Persistence Privilege Escalation

T1098 T1548

Initial Access

Command and Control Credential Access

Theom - Critical data in API headers or body

Theom - Dark Data with large fin value

Theom - Dev secrets exposed

Theom - Dev secrets unencrypted

Theom - Financial data exposed

Theom - Financial data unencrypted

Theom - Healthcare data exposed

Theom - Healthcare data unencrypted

Theom - Least priv large value shadow DB

Theom - National IDs exposed

Theom - National IDs unencrypted

Theom - Overprovisioned Roles Shadow DB

Theom - Shadow DB large datastore value

Theom - Shadow DB with atypical accesses

Theom - Unencrypted public data stores

Theom Critical Risks

Theom High Risks

Theom Insights

Theom Low Risks

Theom Medium Risks

Third party integrated apps

Exfiltration

T1020

Threat Essentials - Mail redirect via ExO transport rule

Collection Exfiltration

T1114 T1020

Threat Essentials - Mass Cloud resource deletions Time Series Anomaly

Impact

T1485

Threat Essentials - Multiple admin membership removals from newly created admin.

Impact

T1531

Threat Essentials - NRT User added to Azure Active Directory Privileged Groups

Persistence Privilege Escalation

T1098 T1078

Threat Essentials - Time series anomaly for data size transferred to public internet

Exfiltration

T1030

Threat Essentials - User Assigned Privileged Role

Persistence

T1078

Threats detected by Eset

Execution Credential Access Privilege Escalation

Threats detected by ESET

Execution

Defense Evasion

T1562

Trend Micro CAS - Unexpected file on file share

Initial Access

T1566

Trend Micro CAS - Unexpected file via mail

Initial Access

T1566

Command and Control

T1090 T1572

Ubiquiti - Unusual FTP connection to external server

Exfiltration

Ubiquiti - Unusual traffic

Initial Access

Unauthorized device in the network (Microsoft Defender for IoT)

Discovery

T0842

Unauthorized DHCP configuration in the network (Microsoft Defender for IoT)

Discovery

T0842

Unauthorized PLC changes (Microsoft Defender for IoT)

Persistence

T0839

Unauthorized remote access to the network (Microsoft Defender for IoT)

Initial Access

T0886

Unusual Anomaly

Unusual identity creation using exchange powershell

Persistence

T1136

Unusual Volume of Password Updated or Removed

Impact

T1485

URL Added to Application from Unknown Domain

Persistence Privilege Escalation

T1078

Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Vectra AI Detect - New Campaign Detected

Lateral Movement Command and Control

Vectra AI Detect - Suspected Compromised Account

Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Vectra AI Detect - Suspected Compromised Host

Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Initial Access Execution

T1190 T1203

Wazuh - Large Number of Web errors from an IP

Persistence

WDigest downgrade attack

Credential Access

T1003

Initial Access

T1190 T1133

Zscaler - ZPA connections from new IP

Initial Access

T1078 T1133

Zscaler - ZPA connections outside operational hours

Initial Access

T1190 T1133

Tactics

Techniques

Analytic Rules