| Rules | Models | MITRE ATT&CK® TTPs | Activity Types | Parsers |
|---|---|---|---|---|
| 115 | 50 | 15 | 8 | 4 |
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| External Remote Services Valid Accounts Exploit Public Fasing Application |
External Remote Services Valid Accounts Hijack Execution Flow Account Manipulation Boot or Logon Autostart Execution Account Manipulation: Exchange Email Delegate Permissions |
Valid Accounts Hijack Execution Flow Boot or Logon Autostart Execution |
Indicator Removal on Host: File Deletion Valid Accounts Modify Registry Indicator Removal on Host Hijack Execution Flow |
OS Credential Dumping |
File and Directory Discovery |
Email Collection Email Collection: Email Forwarding Rule |
Proxy: Multi-hop Proxy Proxy |
Data Destruction |