ds_fileauditor_fileauditor.md

Vendor: FileAuditor

Product: FileAuditor

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
46	19	17	3	3

Use-Case	Activity Types (Legacy Event Type)/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	file-delete:success (file-delete) ↳fileauditor-fa-kv-file-delete-success-delete file-read:success (file-read) ↳fileauditor-fa-kv-file-read-success-read file-write:success (file-write) ↳fileauditor-fa-kv-file-write-success-modify ↳fileauditor-fa-kv-file-write-success-rename ↳fileauditor-fa-kv-file-write-success-overwrite ↳fileauditor-fa-kv-file-write-success-create	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1083 - File and Directory Discovery	32 Rules 14 Models
Data Access	file-delete:success (file-delete) ↳fileauditor-fa-kv-file-delete-success-delete file-read:success (file-read) ↳fileauditor-fa-kv-file-read-success-read file-write:success (file-write) ↳fileauditor-fa-kv-file-write-success-modify ↳fileauditor-fa-kv-file-write-success-rename ↳fileauditor-fa-kv-file-write-success-overwrite ↳fileauditor-fa-kv-file-write-success-create	T1083 - File and Directory Discovery	24 Rules 13 Models
Data Exfiltration	file-write:success (file-write) ↳fileauditor-fa-kv-file-write-success-modify ↳fileauditor-fa-kv-file-write-success-rename ↳fileauditor-fa-kv-file-write-success-overwrite ↳fileauditor-fa-kv-file-write-success-create	TA0002 - TA0002	2 Rules 1 Models
Data Leak	file-write:success (file-write) ↳fileauditor-fa-kv-file-write-success-modify ↳fileauditor-fa-kv-file-write-success-rename ↳fileauditor-fa-kv-file-write-success-overwrite ↳fileauditor-fa-kv-file-write-success-create	T1114 - Email Collection T1114.001 - T1114.001	1 Rules
Destruction of Data	file-delete:success (file-delete) ↳fileauditor-fa-kv-file-delete-success-delete	T1070 - Indicator Removal on Host T1070.004 - Indicator Removal on Host: File Deletion T1485 - Data Destruction	1 Rules
Malware	file-write:success (file-write) ↳fileauditor-fa-kv-file-write-success-modify ↳fileauditor-fa-kv-file-write-success-rename ↳fileauditor-fa-kv-file-write-success-overwrite ↳fileauditor-fa-kv-file-write-success-create	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1505 - Server Software Component T1505.003 - Server Software Component: Web Shell T1547 - Boot or Logon Autostart Execution T1547.001 - T1547.001 TA0002 - TA0002	10 Rules 4 Models
Ransomware	file-write:success (file-write) ↳fileauditor-fa-kv-file-write-success-modify ↳fileauditor-fa-kv-file-write-success-rename ↳fileauditor-fa-kv-file-write-success-overwrite ↳fileauditor-fa-kv-file-write-success-create	T1486 - Data Encrypted for Impact	1 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Valid Accounts		Valid Accounts Server Software Component: Web Shell Server Software Component Boot or Logon Autostart Execution	Valid Accounts Boot or Logon Autostart Execution	Indicator Removal on Host: File Deletion Valid Accounts Indicator Removal on Host	OS Credential Dumping	File and Directory Discovery		Email Collection			Data Destruction Data Encrypted for Impact