2_ds_citrix_citrix_sharefile.md

June 14, 2023 · View on GitHub

Use-Case	Event Types/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	app-activity ↳citrix-app-activity ↳citrix-file-share ↳citrix-app-activity-1 app-login ↳citrix-app-login ↳citrix-app-login-2 failed-app-login ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Data Access	app-activity ↳citrix-app-activity ↳citrix-file-share ↳citrix-app-activity-1 app-login ↳citrix-app-login ↳citrix-app-login-2 failed-app-login ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail	T1078 - Valid Accounts	20 Rules 11 Models
Lateral Movement	app-activity ↳citrix-app-activity ↳citrix-file-share ↳citrix-app-activity-1 app-login ↳citrix-app-login ↳citrix-app-login-2 failed-app-login ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Privilege Abuse	app-activity ↳citrix-app-activity ↳citrix-file-share ↳citrix-app-activity-1 app-login ↳citrix-app-login ↳citrix-app-login-2 failed-app-login ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-download ↳citrix-file-download file-upload ↳citrix-file-upload	T1078 - Valid Accounts T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Privileged Activity	app-activity ↳citrix-app-activity ↳citrix-file-share ↳citrix-app-activity-1 app-login ↳citrix-app-login ↳citrix-app-login-2 failed-app-login ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-download ↳citrix-file-download file-upload ↳citrix-file-upload	T1078 - Valid Accounts	3 Rules 1 Models
Ransomware	app-activity ↳citrix-app-activity ↳citrix-file-share ↳citrix-app-activity-1 app-login ↳citrix-app-login ↳citrix-app-login-2 failed-app-login ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail	T1078 - Valid Accounts	2 Rules