Vendor: ManageEngine

June 14, 2023 · View on GitHub

Product: PAM360

Use-Case: Privilege Escalation

RulesModelsMITRE ATT&CK® TTPsEvent TypesParsers
52322
Event TypeRulesModels
app-activityT1098.002 - Account Manipulation: Exchange Email Delegate Permissions
EM-InB-Ex: A user has been given mailbox permissions for an executive user
EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own
EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions
EM-InB-Perm-N: Models users who give mailbox permissions
remote-logonT1078 - Valid Accounts
AS-PV-UHWoPC: Access to Password Vault managed asset with no password checkout for user
DC18-new: Account switch by new user

T1555.005 - T1555.005
AS-PV-UHWoPC: Access to Password Vault managed asset with no password checkout for user
AS-PV-OA: Password retrieval based accounts