ds_cisco_cisco_firepower.md

Vendor: Cisco

Product: Cisco Firepower

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
652	183	138	16	55

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Abnormal Authentication & Access	app-activity ↳cisco-fp-str-ssl-start-725001 ↳cisco-fp-kv-vpn-authentication-success-713120 ↳cisco-fp-str-vpn-authentication-113008 ↳cisco-fp-kv-app-authentication-113008 ↳cisco-fp-kv-app-authentication-602101 ↳cisco-fp-str-app-authentication-113009 ↳cisco-fp-kv-app-authentication-success-original ↳cisco-asa-str-app-authentication-113009-1 app-login ↳cisco-fp-str-network-session-302020 audit-log-clear ↳cisco-fp-str-ssl-close-725007 ↳cisco-fp-str-network-notification-302010 ↳cisco-fp-str-app-notification-failover ↳cisco-fp-str-app-notification-737003 ↳cisco-fp-str-app-notification-210007 ↳cisco-fp-str-ssl-traffic-725016 ↳cisco-fp-str-ssl-traffic-725003 ↳cisco-fp-str-app-time-modify-771002 ↳cisco-fp-str-network-notification-success-713257 ↳cisco-fp-str-network-traffic-fail-106023 authentication-failed ↳cisco-fp-str-user-modify-113003 ↳cisco-fp-kv-user-modify-success-109207 ↳cisco-fp-kv-user-delete-success-109210 ↳cisco-fp-kv-vpn-authentication-success-713049 ↳cisco-fp-str-vpn-authentication-success-113011 authentication-successful ↳cisco-fp-str-ip-assign-737034 ↳cisco-fp-str-network-start-success-710002 ↳cisco-fp-kv-network-traffic-fail-313005 ↳cisco-asa-kv-network-session-fail-106010 ↳cisco-fp-str-network-traffic-fail-106015 nac-logon ↳cisco-fp-kv-radius-traffic-success-113004 ↳cisco-firepower-csv-app-activity-30501 ↳cisco-fp-str-app-activity-305011 ↳cisco-firepower-json-app-activity-appactivity ↳cisco-fp-str-app-activity-success-609001 ↳cisco-fp-str-app-activity-ids ↳cisco-fp-str-app-activity-success-609002 vpn-logout ↳cisco-fp-str-vpn-logout-success-602304 web-activity-allowed ↳cisco-fp-kv-http-session-policy ↳cisco-fp-kv-user-create-success-109201 ↳cisco-fp-str-app-authentication-success-750006 ↳cisco-fp-str-app-authentication-success-750007 ↳cisco-fp-kv-app-authentication-success-750001 web-activity-denied ↳cisco-fp-kv-http-session-policy	T1021 - Remote Services T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	41 Rules 16 Models
Account Manipulation	app-activity ↳cisco-fp-str-ssl-start-725001 ↳cisco-fp-kv-vpn-authentication-success-713120 ↳cisco-fp-str-vpn-authentication-113008 ↳cisco-fp-kv-app-authentication-113008 ↳cisco-fp-kv-app-authentication-602101 ↳cisco-fp-str-app-authentication-113009 ↳cisco-fp-kv-app-authentication-success-original ↳cisco-asa-str-app-authentication-113009-1 process-created ↳cisco-fp-str-process-create-success-111010 ↳cisco-asa-str-process-create-success-111009 ↳cisco-fp-str-process-create-success-111008 vpn-logout ↳cisco-fp-str-vpn-logout-success-602304	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021.003 - T1021.003 T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1484 - Group Policy Modification T1531 - Account Access Removal T1559.002 - T1559.002	24 Rules 14 Models
Brute Force Attack	vpn-logout ↳cisco-fp-str-vpn-logout-success-602304	T1110 - Brute Force	1 Rules 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Phishing: Spearphishing Link External Remote Services Valid Accounts Drive-by Compromise Exploit Public Fasing Application Phishing	Windows Management Instrumentation Command and Scripting Interperter Scheduled Task/Job Inter-Process Communication System Services Exploitation for Client Execution User Execution Scheduled Task/Job: Scheduled Task Command and Scripting Interperter: PowerShell Scheduled Task/Job: At (Windows)	Pre-OS Boot Create Account Create or Modify System Process External Remote Services Valid Accounts Hijack Execution Flow Server Software Component: Web Shell Account Manipulation BITS Jobs Create or Modify System Process: Windows Service Scheduled Task/Job Server Software Component Event Triggered Execution Boot or Logon Autostart Execution Create Account: Create: Local Account Account Manipulation: Exchange Email Delegate Permissions	Access Token Manipulation: Token Impersonation/Theft Create or Modify System Process Valid Accounts Access Token Manipulation Exploitation for Privilege Escalation Hijack Execution Flow Group Policy Modification Process Injection Scheduled Task/Job Abuse Elevation Control Mechanism Event Triggered Execution Boot or Logon Autostart Execution Process Injection: Dynamic-link Library Injection Abuse Elevation Control Mechanism: Bypass User Account Control	Hide Artifacts Indirect Command Execution Impair Defenses Indicator Removal on Host: Clear Windows Event Logs Group Policy Modification Trusted Developer Utilities Proxy Execution Masquerading: Match Legitimate Name or Location Masquerading: Rename System Utilities File and Directory Permissions Modification: Windows File and Directory Permissions Modification Obfuscated Files or Information: Compile After Delivery Obfuscated Files or Information: Indicator Removal from Tools Hijack Execution Flow: DLL Side-Loading Masquerading Valid Accounts Modify Registry BITS Jobs Use Alternate Authentication Material Hide Artifacts: NTFS File Attributes Indicator Removal on Host Use Alternate Authentication Material: Pass the Ticket Pre-OS Boot File and Directory Permissions Modification Deobfuscate/Decode Files or Information Abuse Elevation Control Mechanism Impair Defenses: Disable or Modify System Firewall Obfuscated Files or Information Signed Binary Proxy Execution: Compiled HTML File Access Token Manipulation Hijack Execution Flow Process Injection Signed Binary Proxy Execution: Msiexec Signed Binary Proxy Execution Signed Binary Proxy Execution: Regsvcs/Regasm Signed Binary Proxy Execution: CMSTP Signed Binary Proxy Execution: Control Panel Signed Binary Proxy Execution: InstallUtil Signed Binary Proxy Execution: Regsvr32 Trusted Developer Utilities Proxy Execution: MSBuild Signed Binary Proxy Execution: Rundll32	OS Credential Dumping Unsecured Credentials Brute Force Steal or Forge Kerberos Tickets Credentials from Password Stores Steal or Forge Kerberos Tickets: Kerberoasting Network Sniffing	Account Discovery Domain Trust Discovery System Service Discovery System Network Connections Discovery Account Discovery: Local Account Account Discovery: Domain Account File and Directory Discovery Network Sniffing System Information Discovery Network Share Discovery Query Registry Process Discovery System Owner/User Discovery Software Discovery Remote System Discovery System Network Configuration Discovery	Exploitation of Remote Services Remote Service Session Hijacking Remote Services Remote Services: SMB/Windows Admin Shares Use Alternate Authentication Material Remote Services: Remote Desktop Protocol Internal Spearphishing	Screen Capture Email Collection Audio Capture Archive Collected Data Email Collection: Email Forwarding Rule	Web Service Protocol Tunneling Application Layer Protocol: DNS Application Layer Protocol: File Transfer Protocols Application Layer Protocol: Web Protocols Remote Access Software Dynamic Resolution Ingress Tool Transfer Dynamic Resolution: Domain Generation Algorithms Proxy: Multi-hop Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Over Physical Medium: Exfiltration over USB Exfiltration Over C2 Channel Exfiltration Over Physical Medium Exfiltration Over Web Service: Exfiltration to Cloud Storage Exfiltration Over Web Service	Account Access Removal Resource Hijacking Data Encrypted for Impact Inhibit System Recovery