Skip to content

Latest commit

 

History

History
25 lines (23 loc) · 6.21 KB

ds_wiz_wiz.md

File metadata and controls

25 lines (23 loc) · 6.21 KB

Vendor: Wiz

Product: Wiz

Rules Models MITRE ATT&CK® TTPs Activity Types Parsers
42 17 6 2 0
Use-Case Activity Types/Parsers MITRE ATT&CK® TTP Content
Abnormal Authentication & Access account-deleted
wiz-w-csv-user-delete-success-deleteuser

app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
T1133 - External Remote Services
  • 12 Rules
  • 4 Models
Account Manipulation account-deleted
wiz-w-csv-user-delete-success-deleteuser
T1136 - Create Account
T1531 - Account Access Removal
  • 2 Rules
  • 1 Models
Compromised Credentials app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
  • 27 Rules
  • 16 Models
Data Access app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
  • 5 Rules
  • 4 Models
Lateral Movement app-login
wiz-w-json-app-login-success-federatedauth
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Malware app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
  • 1 Rules
Privilege Abuse account-deleted
wiz-w-csv-user-delete-success-deleteuser

app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
T1531 - Account Access Removal
  • 3 Rules
  • 1 Models
Privileged Activity app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
  • 1 Rules
Ransomware app-login
wiz-w-json-app-login-success-federatedauth
T1078 - Valid Accounts
  • 1 Rules

MITRE ATT&CK® Framework for Enterprise

Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

Create Account

External Remote Services

Valid Accounts

Valid Accounts

Valid Accounts

Proxy: Multi-hop Proxy

Proxy

Account Access Removal