Skip to content

Latest commit

 

History

History
22 lines (20 loc) · 7.93 KB

ds_epic_epic_siem.md

File metadata and controls

22 lines (20 loc) · 7.93 KB

Vendor: Epic

Product: Epic SIEM

Rules Models MITRE ATT&CK® TTPs Activity Types Parsers
68 26 9 5 6
Use-Case Activity Types (Legacy Event Type)/Parsers MITRE ATT&CK® TTP Content
Abnormal Authentication & Access user-password-modify:success (account-password-change)
epic-siem-leef-app-activity-securitysiem

scheduled_task-trigger:success (app-activity)
epic-siem-cef-app-activity-success-maskeddataprinting
epic-siem-cef-app-activity-success-contextchange
epic-siem-leef-app-activity-securitysiem

app-login:success (app-login)
epic-siem-cef-app-login-success-login
epic-siem-leef-app-activity-securitysiem

endpoint-login:success (authentication-successful)
epic-siem-cef-endpoint-login-success-security
epic-siem-leef-app-activity-securitysiem

app-login:fail (failed-app-login)
epic-siem-cef-app-login-fail-failedlogin
epic-siem-leef-app-activity-securitysiem
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulation user-password-modify:success (account-password-change)
epic-siem-leef-app-activity-securitysiem

scheduled_task-trigger:success (app-activity)
epic-siem-cef-app-activity-success-maskeddataprinting
epic-siem-cef-app-activity-success-contextchange
epic-siem-leef-app-activity-securitysiem
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 4 Rules
  • 1 Models
Data Leak scheduled_task-trigger:success (app-activity)
epic-siem-cef-app-activity-success-maskeddataprinting
epic-siem-cef-app-activity-success-contextchange
epic-siem-leef-app-activity-securitysiem
T1114 - Email Collection
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Malware app-login:success (app-login)
epic-siem-cef-app-login-success-login
epic-siem-leef-app-activity-securitysiem

endpoint-login:success (authentication-successful)
epic-siem-cef-endpoint-login-success-security
epic-siem-leef-app-activity-securitysiem
T1078 - Valid Accounts
  • 1 Rules
Privilege Escalation scheduled_task-trigger:success (app-activity)
epic-siem-cef-app-activity-success-maskeddataprinting
epic-siem-cef-app-activity-success-contextchange
epic-siem-leef-app-activity-securitysiem
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy