Skip to content

Latest commit

 

History

History
15 lines (13 loc) · 926 Bytes

r_m_securelink_securelink_Privileged_Activity.md

File metadata and controls

15 lines (13 loc) · 926 Bytes

Rules by Product and UseCase

Vendor: SecureLink

Product: SecureLink

Rules Models MITRE ATT&CK® TTPs Activity Types Parsers
2 1 1 2 1
Event Type Rules Models
app-activity T1078 - Valid Accounts
APP-Account-deactivated: Activity from a de-activated user account
APP-AT-PRIV: Non-privileged user performing privileged application activity
APP-AT-PRIV: Privileged application activities
app-login T1078 - Valid Accounts
APP-Account-deactivated: Activity from a de-activated user account