Vendor: Forescout
June 14, 2023 · View on GitHub
Product: EyeInspect
| Rules | Models | MITRE ATT&CK® TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 28 | 4 | 10 | 1 | 1 |
| Use-Case | Event Types/Parsers | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Abnormal Authentication & Access | failed-logon ↳json-eyeinspect-failed-logon | T1078 - Valid Accounts T1110 - Brute Force |
|
| Brute Force Attack | failed-logon ↳json-eyeinspect-failed-logon | T1021.001 - Remote Services: Remote Desktop Protocol T1110 - Brute Force T1110.003 - T1110.003 |
|
| Compromised Credentials | failed-logon ↳json-eyeinspect-failed-logon | T1078 - Valid Accounts |
|
| Lateral Movement | failed-logon ↳json-eyeinspect-failed-logon | T1021.001 - Remote Services: Remote Desktop Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1110 - Brute Force T1110.003 - T1110.003 T1550.002 - Use Alternate Authentication Material: Pass the Hash T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets |
|
| Malware | failed-logon ↳json-eyeinspect-failed-logon | T1210 - Exploitation of Remote Services |
|
| Privilege Abuse | failed-logon ↳json-eyeinspect-failed-logon | T1078 - Valid Accounts |
|
| Privilege Escalation | failed-logon ↳json-eyeinspect-failed-logon | T1210 - Exploitation of Remote Services |
|
| Privileged Activity | failed-logon ↳json-eyeinspect-failed-logon | T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts |
|
| Ransomware | failed-logon ↳json-eyeinspect-failed-logon | T1078 - Valid Accounts |
|
MITRE ATT&CK® Framework for Enterprise
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Valid Accounts | Valid Accounts Exploitation for Privilege Escalation | Valid Accounts Use Alternate Authentication Material Use Alternate Authentication Material: Pass the Hash Use Alternate Authentication Material: Pass the Ticket | Brute Force Steal or Forge Kerberos Tickets | Exploitation of Remote Services Remote Services Use Alternate Authentication Material Remote Services: Remote Desktop Protocol | Proxy: Multi-hop Proxy Proxy |