Rules by Product and UseCase Vendor: SecureNet Product: SecureNet Use-Case: Malware Rules Models MITRE ATT&CK® TTPs Activity Types Parsers 1 0 1 1 0 Event Type Rules Models vpn-login T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP