uc_phishing.md

Use Case: Phishing

Vendor: Accellion

Product	MITRE ATT&CK® TTP	Content
Kiteworks	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Akamai

Product	MITRE ATT&CK® TTP	Content
Cloud Akamai	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Amazon

Product	MITRE ATT&CK® TTP	Content
AWS CloudWatch	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
AWS Elastic Load Balancer	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
AWS WAF	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Apache

Product	MITRE ATT&CK® TTP	Content
Apache	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Armorblox

Product	MITRE ATT&CK® TTP	Content
Armorblox	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Auth0

Product	MITRE ATT&CK® TTP	Content
Auth0	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Barracuda

Product	MITRE ATT&CK® TTP	Content
Barracuda Cloudgen Firewall	T1566 - Phishing	2 Rules 2 Models
Barracuda Email Security Gateway	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: BeyondTrust

Product	MITRE ATT&CK® TTP	Content
BeyondInsight	T1566 - Phishing T1566.001 - T1566.001	1 Rules
BeyondTrust	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Bitdefender

Product	MITRE ATT&CK® TTP	Content
GravityZone	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Bitglass

Product	MITRE ATT&CK® TTP	Content
Bitglass CASB	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: CatoNetworks

Product	MITRE ATT&CK® TTP	Content
Cato Cloud	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models

Vendor: Check Point

Product	MITRE ATT&CK® TTP	Content
Check Point Avanan	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Check Point Identity Awareness	T1566 - Phishing	2 Rules 2 Models
Check Point NGFW	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	6 Rules 3 Models
Check Point Security Gateway	T1566 - Phishing	2 Rules 2 Models

Vendor: Cisco

Product	MITRE ATT&CK® TTP	Content
AnyConnect	T1566 - Phishing	2 Rules 2 Models
Cisco ACS	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Cisco ADC	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Cisco Adaptive Security Appliance	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	6 Rules 2 Models
Cisco Cloud Web Security	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Cisco Firepower	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	6 Rules 2 Models
Cisco IOS	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Cisco ISE	T1566 - Phishing	2 Rules 2 Models
Cisco Meraki MX appliance	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models
Cisco Secure Email	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Cisco Secure Web Appliance	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Cisco Umbrella	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
IronPort Email	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
IronPort Web Security	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Citrix

Product	MITRE ATT&CK® TTP	Content
Citrix Gateway	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	6 Rules 2 Models
Citrix Virtual Apps	T1566 - Phishing	2 Rules 2 Models

Vendor: Clearswift

Product	MITRE ATT&CK® TTP	Content
Clearswift Secure Email Gateway	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Cloudflare

Product	MITRE ATT&CK® TTP	Content
Cloudflare WAF	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Code42

Product	MITRE ATT&CK® TTP	Content
Code42 Incydr	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: CrowdStrike

Product	MITRE ATT&CK® TTP	Content
Falcon	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Darktrace

Product	MITRE ATT&CK® TTP	Content
Darktrace	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Delinea

Product	MITRE ATT&CK® TTP	Content
Centrify Infrastructure Services	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Dell

Product	MITRE ATT&CK® TTP	Content
Sonicwall	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models

Vendor: Digital Arts

Product	MITRE ATT&CK® TTP	Content
Digital Arts i-FILTER for Business	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Digital Guardian

Product	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1566 - Phishing T1566.001 - T1566.001	2 Rules 1 Models
Digital Guardian Network DLP	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Dropbox

Product	MITRE ATT&CK® TTP	Content
Dropbox	T1566 - Phishing	2 Rules 2 Models

Vendor: Dtex Systems

Product	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules

Vendor: EdgeWave

Product	MITRE ATT&CK® TTP	Content
EdgeWave iPrism	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: F5

Product	MITRE ATT&CK® TTP	Content
F5 Access Policy Manager	T1566 - Phishing	2 Rules 2 Models
F5 Advanced Web Application Firewall	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1566 - Phishing T1566.001 - T1566.001	2 Rules 1 Models
F5 Application Security Manager	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
F5 BIG-IP	T1566 - Phishing	2 Rules 2 Models
F5 WebSafe	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Fidelis

Product	MITRE ATT&CK® TTP	Content
Fidelis XPS	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: FireEye

Product	MITRE ATT&CK® TTP	Content
FireEye CMS	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
FireEye Network Security (NX)	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Forcepoint

Product	MITRE ATT&CK® TTP	Content
Forcepoint CASB	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Forcepoint DLP	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Forcepoint Email Security	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Forcepoint Email Security Gateway	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Websense Security Gateway	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Fortinet

Product	MITRE ATT&CK® TTP	Content
FortiGate	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models
FortiSIEM	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Fortinet Enterprise Firewall	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Fortinet UTM	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules 1 Models
Fortiweb Web Application Firewall	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: GitHub

Product	MITRE ATT&CK® TTP	Content
GitHub	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Google

Product	MITRE ATT&CK® TTP	Content
GCP CloudAudit	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Google Cloud Platform	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Google Workspace	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: HP

Product	MITRE ATT&CK® TTP	Content
HPE Comware	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: HashiCorp

Product	MITRE ATT&CK® TTP	Content
Terraform	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: HelpSystems

Product	MITRE ATT&CK® TTP	Content
Powertech Identity and Access Manager	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Hornet

Product	MITRE ATT&CK® TTP	Content
Hornetsecurity Cloud Email Security Services	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Huawei

Product	MITRE ATT&CK® TTP	Content
Huawei Unified Security Gateway	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: IBM

Product	MITRE ATT&CK® TTP	Content
Security Access Manager	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: IMSVA

Product	MITRE ATT&CK® TTP	Content
IMSVA	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Imperva

Product	MITRE ATT&CK® TTP	Content
Imperva Incapsula	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: InfoWatch

Product	MITRE ATT&CK® TTP	Content
InfoWatch DLP	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules 1 Models

Vendor: Infoblox

Product	MITRE ATT&CK® TTP	Content
BloxOne DDI	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Ivanti

Product	MITRE ATT&CK® TTP	Content
Ivanti Pulse Secure	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models

Vendor: Juniper Networks

Product	MITRE ATT&CK® TTP	Content
Juniper SRX Series	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Junos OS	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Kasada

Product	MITRE ATT&CK® TTP	Content
Kasada	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Kaspersky

Product	MITRE ATT&CK® TTP	Content
Kaspersky Secure Mail Gateway	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: LanScope

Product	MITRE ATT&CK® TTP	Content
LanScope Cat	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules

Vendor: LogRhythm

Product	MITRE ATT&CK® TTP	Content
LogRhythm	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Malwarebytes

Product	MITRE ATT&CK® TTP	Content
Malwarebytes Endpoint Detection and Response	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: McAfee

Product	MITRE ATT&CK® TTP	Content
McAfee DLP Endpoint	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
McAfee DLP Prevent	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
McAfee Email Protection	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
McAfee Web Gateway	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Menlo Security

Product	MITRE ATT&CK® TTP	Content
Menlo Security	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Microsoft

Product	MITRE ATT&CK® TTP	Content
Azure Monitor	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Azure Monitor - VM Insights	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Event Viewer - PowerShell	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Event Viewer - Security	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Event Viewer - WinNat	T1566 - Phishing	2 Rules 2 Models
Microsoft 365	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1566 - Phishing T1566.001 - T1566.001	2 Rules 1 Models
Microsoft CAS	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Microsoft Defender for Endpoint	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 1 Models
Microsoft Exchange	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Microsoft IIS	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Microsoft RRAS	T1566 - Phishing	2 Rules 2 Models
Microsoft Sentinel	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Microsoft WMI Log	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Microsoft Web Application Proxy	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Sysmon	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Web Application Proxy-TLS Gateway	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Mimecast

Product	MITRE ATT&CK® TTP	Content
Mimecast Secure Email Gateway	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Mimecast Targeted Threat Protection - URL	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: NCP

Product	MITRE ATT&CK® TTP	Content
NCP	T1566 - Phishing	2 Rules 2 Models

Vendor: NetMotion Wireless

Product	MITRE ATT&CK® TTP	Content
NetMotion Wireless	T1566 - Phishing	2 Rules 2 Models

Vendor: Netskope

Product	MITRE ATT&CK® TTP	Content
Netskope Security Cloud	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules 1 Models
Netskope Webtx	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: NextDLP

Product	MITRE ATT&CK® TTP	Content
Reveal	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Nortel Contivity

Product	MITRE ATT&CK® TTP	Content
Nortel Contivity VPN	T1566 - Phishing	2 Rules 2 Models

Vendor: Open VPN

Product	MITRE ATT&CK® TTP	Content
Open VPN	T1566 - Phishing	2 Rules 2 Models

Vendor: Oracle

Product	MITRE ATT&CK® TTP	Content
Solaris	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Palo Alto Networks

Product	MITRE ATT&CK® TTP	Content
GlobalProtect	T1566 - Phishing	2 Rules 2 Models
Palo Alto NGFW	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Prisma Access	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Prisma Cloud	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Phantom

Product	MITRE ATT&CK® TTP	Content
Phantom	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Ping Identity

Product	MITRE ATT&CK® TTP	Content
Ping Access	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Postfix

Product	MITRE ATT&CK® TTP	Content
Postfix	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Proofpoint

Product	MITRE ATT&CK® TTP	Content
ObserveIT	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1566 - Phishing T1566.001 - T1566.001	2 Rules 1 Models
Proofpoint Email Protection	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Targeted Attack Platform	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: RSA

Product	MITRE ATT&CK® TTP	Content
RSA DLP	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
SecurID	T1566 - Phishing	2 Rules 2 Models

Vendor: SIGSCI

Product	MITRE ATT&CK® TTP	Content
SIGSCI	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: SafeSend

Product	MITRE ATT&CK® TTP	Content
SafeSend	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Salesforce

Product	MITRE ATT&CK® TTP	Content
Salesforce	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Sangfor

Product	MITRE ATT&CK® TTP	Content
Sangfor NGAF	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: SecureNet

Product	MITRE ATT&CK® TTP	Content
SecureNet	T1566 - Phishing	2 Rules 2 Models

Vendor: SentinelOne

Product	MITRE ATT&CK® TTP	Content
Singularity Platform	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules

Vendor: SkySea

Product	MITRE ATT&CK® TTP	Content
SkySea ClientView	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 1 Models

Vendor: Skyhigh Security

Product	MITRE ATT&CK® TTP	Content
Skyhigh Security Cloud	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Sophos

Product	MITRE ATT&CK® TTP	Content
Sophos Endpoint Protection	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Sophos UTM	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Sophos XG Firewall	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models

Vendor: Squid

Product	MITRE ATT&CK® TTP	Content
Squid	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Symantec

Product	MITRE ATT&CK® TTP	Content
Symantec Advanced Threat Protection	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Symantec DLP	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Symantec Email Security	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models
Symantec Fireglass	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Symantec Web Security Service	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Tanium

Product	MITRE ATT&CK® TTP	Content
Tanium Core Platform	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Tanium Integrity Monitor	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Tessian

Product	MITRE ATT&CK® TTP	Content
Tessian Cloud Email Security	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Trend Micro

Product	MITRE ATT&CK® TTP	Content
Deep Security	T1566 - Phishing T1566.001 - T1566.001	1 Rules
OfficeScan	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules 1 Models
Trend Micro Email Security	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: Unix

Product	MITRE ATT&CK® TTP	Content
Auditbeat	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Unix	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1566 - Phishing T1566.001 - T1566.001	2 Rules 1 Models
Unix Auditd	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Unix Sendmail	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	1 Rules 1 Models

Vendor: VMware

Product	MITRE ATT&CK® TTP	Content
Carbon Black App Control	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Carbon Black CES	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Carbon Black EDR	T1566 - Phishing T1566.001 - T1566.001	1 Rules

Vendor: Vectra

Product	MITRE ATT&CK® TTP	Content
Vectra Cognito Stream	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules 1 Models

Vendor: Watchguard

Product	MITRE ATT&CK® TTP	Content
Watchguard	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Weblogin

Product	MITRE ATT&CK® TTP	Content
Weblogin	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules

Vendor: Zeek

Product	MITRE ATT&CK® TTP	Content
Zeek	T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	4 Rules 1 Models

Vendor: Zscaler

Product	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules
Zscaler Private Access	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	5 Rules 2 Models

Vendor:

Vendor: iBoss

Product	MITRE ATT&CK® TTP	Content
Iboss Cloud	T1189 - Drive-by Compromise T1204 - User Execution T1204.001 - T1204.001 T1534 - Internal Spearphishing T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1598 - T1598 T1598.003 - T1598.003	3 Rules