Skip to content

Latest commit

 

History

History
20 lines (18 loc) · 5.04 KB

ds_ibm_ibm_mainframe.md

File metadata and controls

20 lines (18 loc) · 5.04 KB

Vendor: IBM

Product: IBM Mainframe

Rules Models MITRE ATT&CK® TTPs Activity Types Parsers
46 17 5 3 3
Use-Case Activity Types (Legacy Event Type)/Parsers MITRE ATT&CK® TTP Content
Abnormal Authentication & Access user-disable:success (account-disabled)
ibm-mainframe-json-user-disable-success-suspendedon

app-login:success (app-login)
ibm-mainframe-json-app-login-success-loggedon

app-login:fail (failed-app-login)
ibm-mainframe-json-app-login-fail-notauthorized
ibm-mainframe-json-app-login-fail-invalidsource
ibm-mainframe-json-app-login-fail-passwordmissing
ibm-mainframe-json-app-login-fail-incorrectpassword
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Compromised Credentials app-login:success (app-login)
ibm-mainframe-json-app-login-success-loggedon

app-login:fail (failed-app-login)
ibm-mainframe-json-app-login-fail-notauthorized
ibm-mainframe-json-app-login-fail-invalidsource
ibm-mainframe-json-app-login-fail-passwordmissing
ibm-mainframe-json-app-login-fail-incorrectpassword
T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
  • 28 Rules
  • 16 Models
Malware app-login:success (app-login)
ibm-mainframe-json-app-login-success-loggedon
T1078 - Valid Accounts
  • 1 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Valid Accounts

Valid Accounts

Proxy: Multi-hop Proxy

Proxy