r_m_imanage_imanage_Privileged_Activity.md

Rules by Product and UseCase

Vendor: iManage

Product: iManage

Use-Case: Privileged Activity

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
2	1	1	1	2

Event Type	Rules	Models
app-activity	T1078 - Valid Accounts ↳ APP-Account-deactivated: Activity from a de-activated user account ↳ APP-AT-PRIV: Non-privileged user performing privileged application activity	• APP-AT-PRIV: Privileged application activities