Skip to content

Latest commit

 

History

History
27 lines (25 loc) · 8.51 KB

ds_sunone_sunone.md

File metadata and controls

27 lines (25 loc) · 8.51 KB

Vendor: SunOne

Product: SunOne

Rules Models MITRE ATT&CK® TTPs Activity Types Parsers
67 28 5 3 0
Use-Case Activity Types/Parsers MITRE ATT&CK® TTP Content
Abnormal Authentication & Access app-activity
sunone-s-json-endpoint-authentication-success-message

authentication-failed
sunone-s-kv-endpoint-authentication-bind

authentication-successful
sunone-s-kv-endpoint-authentication-bind
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulation app-activity
sunone-s-json-endpoint-authentication-success-message
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Compromised Credentials app-activity
sunone-s-json-endpoint-authentication-success-message

authentication-successful
sunone-s-kv-endpoint-authentication-bind
T1078 - Valid Accounts
T1133 - External Remote Services
  • 42 Rules
  • 26 Models
Data Access app-activity
sunone-s-json-endpoint-authentication-success-message
T1078 - Valid Accounts
  • 22 Rules
  • 13 Models
Data Leak app-activity
sunone-s-json-endpoint-authentication-success-message
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Lateral Movement app-activity
sunone-s-json-endpoint-authentication-success-message

authentication-failed
sunone-s-kv-endpoint-authentication-bind

authentication-successful
sunone-s-kv-endpoint-authentication-bind
T1078 - Valid Accounts
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Malware app-activity
sunone-s-json-endpoint-authentication-success-message

authentication-failed
sunone-s-kv-endpoint-authentication-bind

authentication-successful
sunone-s-kv-endpoint-authentication-bind
T1078 - Valid Accounts
  • 2 Rules
Privilege Abuse app-activity
sunone-s-json-endpoint-authentication-success-message
T1078 - Valid Accounts
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 7 Rules
  • 3 Models
Privilege Escalation app-activity
sunone-s-json-endpoint-authentication-success-message
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Privileged Activity app-activity
sunone-s-json-endpoint-authentication-success-message
T1078 - Valid Accounts
  • 3 Rules
  • 2 Models
Ransomware app-activity
sunone-s-json-endpoint-authentication-success-message

authentication-failed
sunone-s-kv-endpoint-authentication-bind

authentication-successful
sunone-s-kv-endpoint-authentication-bind
T1078 - Valid Accounts
  • 2 Rules

MITRE ATT&CK® Framework for Enterprise

Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
External Remote Services

Valid Accounts

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy