Product: BeyondInsight
Use-Case: Account Manipulation
| Rules | Models | MITRE ATT&CK® TTPs | Activity Types | Parsers |
|---|---|---|---|---|
| 47 | 21 | 14 | 4 | 19 |
| Event Type | Rules | Models |
|---|---|---|
| account-creation | T1098 - Account Manipulation ↳ AM-OLocU-A: Abnormal account management activity by local user ↳ AM-OLocU-F-new: First account management activity by a new local user ↳ AM-UH-F: First account management activity from asset for user ↳ AM-UH-A: Abnormal account management activity from asset for user ↳ AM-OZ-F: First account management activity from network zone ↳ AM-OZ-A: Abnormal account management activity from zone ↳ AM-OH-F: First account management activity from asset ↳ AM-UT-TOW-A: Abnormal day for user to perform account management activity ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user ↳ A-AM-DhU-system-F: First account management by system account on asset T1136.001 - Create Account: Create: Local Account ↳ AC-LocUA-F-new: First account creation activity by a new local user ↳ AC-LocUA-A: Abnormal account creation activity by local user ↳ A-AC-DhU-system-F: First account creation by system account on asset ↳ A-AC-DhU-system-A: Abnormal account creation by system account on asset T1136 - Create Account ↳ AC-UH-F: First account creation activity from asset for user ↳ AC-UH-A: Abnormal account creation activity from asset for user ↳ AC-OZ-F: First account creation activity from network zone ↳ AC-OZ-A: Abnormal account creation activity from network zone ↳ AC-OH-F: First account creation activity from asset in the organization ↳ AC-OH-A: Abnormal account creation activity from asset in the organization ↳ AC-UT-TOW-A: Abnormal day for user to perform account creation activity ↳ AM-UA-AC-F: First account creation activity for user ↳ AM-UA-AC-A: Abnormal account creation activity for user ↳ AM-GA-AC-F: First account creation activity for peer group ↳ AM-GA-AC-A: Abnormal account creation activity for peer group ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user ↳ A-ACCT-CR-DEL: Account created and deleted on asset T1136.002 - T1136.002 ↳ AM-UD-F: First account creation on domain for user ↳ AM-UD-A: Abnormal account creation on domain for user |
• A-AM-DhU-system: System accounts performing account management activities • A-AC-DhU-system: System accounts performing account creation activities • AE-GA: All activity for peer groups • AE-UA: All activity for users • AM-UT-TOW: Account management activity time for user • AC-UT-TOW: Account creation activity time for user • AM-UD: Account creation on domain by user • AM-OH: Account management hosts in organization • AC-OH: Account creation hosts in organization • AM-OZ: Account management activity from zone • AC-OZ: Account creation activity from zone • AM-UH: Account management activity on host for user • AC-UH: Account creation activity on host for user |
| account-deleted | T1136 - Create Account ↳ A-ACCT-CR-DEL: Account created and deleted on asset T1531 - Account Access Removal ↳ AM-UA-AD-F: First account deletion activity for user |
• AE-UA: All activity for users |
| app-activity | T1098.002 - Account Manipulation: Exchange Email Delegate Permissions ↳ EM-InB-Ex: A user has been given mailbox permissions for an executive user ↳ EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own ↳ EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions |
• EM-InB-Perm-N: Models users who give mailbox permissions |
| process-created | T1021.003 - T1021.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1059.001 - Command and Scripting Interperter: PowerShell ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1059.003 - T1059.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1218.010 - Signed Binary Proxy Execution: Regsvr32 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1559.002 - T1559.002 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1003 - OS Credential Dumping ↳ A-ShadowCP-SymLink: Shadow Copies Access via Symlink on this asset T1003.003 - T1003.003 ↳ A-AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) on this asset T1136.001 - Create Account: Create: Local Account ↳ NET-EXE-ADD-ORG-F: First time net.exe has been used to create a user account by this user. ↳ NET-EXE-ADD-ORG-A: Abnormal usage of net.exe to create a user account by this user. ↳ AC-OZ-CLI-F: First zone on which account was created using CLI command ↳ AC-OH-CLI-F: First host on which account was created using CLI command ↳ AC-OU-CLI-F: First user on which account was created using CLI command T1531 - Account Access Removal ↳ NET-EXE-DELETE-ORG-F: First time net.exe has been used to delete a user account by this user. ↳ NET-EXE-DELETE-ORG-A: Abnormal usage of net.exe to delete a user account by this user. T1078 - Valid Accounts ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1098 - Account Manipulation ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1136 - Create Account ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. |
• AC-OU-CLI: Users on which account was created using CLI command • AC-OH-CLI: Hosts on which account was created using CLI command • AC-OZ-CLI: Zones on which account was created using CLI command • NET-EXE-DELETE-ORG: Using net.exe to delete a user account • NET-EXE-ACTIVE-ORG: Using net.exe to disable/enable a user account • NET-EXE-ADD-GRP-ORG: Using net.exe to add a group account • NET-EXE-ADD-ORG: Using net.exe to add a user account |