Vendor: BeyondTrust

June 14, 2023 · View on GitHub

Product: BeyondTrust Privileged Identity

RulesModelsMITRE ATT&CK® TTPsEvent TypesParsers
9746977
Use-CaseEvent Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessaccount-password-change
beyondtrust-pi-account-password-change-1
beyondtrust-pi-account-password-change

account-switch
syslog-liebsoft-account-switch
beyondtrust-pi-account-switch

app-activity
cef-liebsoft-app-activity-4
cef-liebsoft-app-activity-5
cef-liebsoft-app-activity-2
cef-liebsoft-app-activity-3
cef-liebsoft-app-activity-1
beyondtrust-pi-app-activity
beyondtrust-pi-password-access
beyondtrust-pi-app-activity-10
beyondtrust-pi-app-activity-5
beyondtrust-pi-app-activity-4
beyondtrust-pi-app-activity-9
beyondtrust-pi-app-activity-8
beyondtrust-pi-app-activity-6

app-login
s-liebsoft-app-login
beyondtrust-pi-app-login

failed-app-login
beyondtrust-pi-app-login

privileged-access
lieberman-erpm
beyondtrust-pi-privilege-access
beyondtrust-pi-privileged-access-1
beyondtrust-pi-privileged-access
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationaccount-password-change
beyondtrust-pi-account-password-change-1
beyondtrust-pi-account-password-change

app-activity
cef-liebsoft-app-activity-4
cef-liebsoft-app-activity-5
cef-liebsoft-app-activity-2
cef-liebsoft-app-activity-3
cef-liebsoft-app-activity-1
beyondtrust-pi-app-activity
beyondtrust-pi-password-access
beyondtrust-pi-app-activity-10
beyondtrust-pi-app-activity-5
beyondtrust-pi-app-activity-4
beyondtrust-pi-app-activity-9
beyondtrust-pi-app-activity-8
beyondtrust-pi-app-activity-6
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 4 Rules
  • 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Credentials from Password Stores

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy