Product: Falcon
Use-Case: Account Manipulation
| Rules | Models | MITRE ATT&CK® TTPs | Activity Types | Parsers |
|---|---|---|---|---|
| 17 | 8 | 13 | 2 | 10 |
| Event Type | Rules | Models |
|---|---|---|
| app-activity | T1098.002 - Account Manipulation: Exchange Email Delegate Permissions ↳ EM-InB-Ex: A user has been given mailbox permissions for an executive user ↳ EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own ↳ EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions |
• EM-InB-Perm-N: Models users who give mailbox permissions |
| process-created | T1021.003 - T1021.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1059.001 - Command and Scripting Interperter: PowerShell ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1059.003 - T1059.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1218.010 - Signed Binary Proxy Execution: Regsvr32 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1559.002 - T1559.002 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. T1003 - OS Credential Dumping ↳ A-ShadowCP-SymLink: Shadow Copies Access via Symlink on this asset T1003.003 - T1003.003 ↳ A-AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) on this asset T1136.001 - Create Account: Create: Local Account ↳ NET-EXE-ADD-ORG-F: First time net.exe has been used to create a user account by this user. ↳ NET-EXE-ADD-ORG-A: Abnormal usage of net.exe to create a user account by this user. ↳ AC-OZ-CLI-F: First zone on which account was created using CLI command ↳ AC-OH-CLI-F: First host on which account was created using CLI command ↳ AC-OU-CLI-F: First user on which account was created using CLI command T1531 - Account Access Removal ↳ NET-EXE-DELETE-ORG-F: First time net.exe has been used to delete a user account by this user. ↳ NET-EXE-DELETE-ORG-A: Abnormal usage of net.exe to delete a user account by this user. T1078 - Valid Accounts ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1098 - Account Manipulation ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1136 - Create Account ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. |
• AC-OU-CLI: Users on which account was created using CLI command • AC-OH-CLI: Hosts on which account was created using CLI command • AC-OZ-CLI: Zones on which account was created using CLI command • NET-EXE-DELETE-ORG: Using net.exe to delete a user account • NET-EXE-ACTIVE-ORG: Using net.exe to disable/enable a user account • NET-EXE-ADD-GRP-ORG: Using net.exe to add a group account • NET-EXE-ADD-ORG: Using net.exe to add a user account |