r_m_clearsense_clearsense_Malware.md

Rules by Product and UseCase

Vendor: Clearsense

Product: Clearsense

Use-Case: Malware

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
1	0	1	2	1

Event Type	Rules	Models
app-login	T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP
authentication-successful	T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP