Vendor: ServiceNow

June 14, 2023 · View on GitHub

Product: ServiceNow

RulesModelsMITRE ATT&CK® TTPsEvent TypesParsers
98401177
Use-CaseEvent Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-activity
snow-app-activity
cef-servicenow-file-operation-2

app-login
cef-servicenow-login-1
cef-servicenow-login-2

failed-app-login
cef-servicenow-login-failed
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationapp-activity
snow-app-activity
cef-servicenow-file-operation-2
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Data Leakapp-activity
snow-app-activity
cef-servicenow-file-operation-2
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Destruction of Datafile-delete
cef-servicenow-file-operation-2
T1070.004 - Indicator Removal on Host: File Deletion
T1485 - Data Destruction
  • 1 Rules
Lateral Movementapp-activity
snow-app-activity
cef-servicenow-file-operation-2

app-login
cef-servicenow-login-1
cef-servicenow-login-2

failed-app-login
cef-servicenow-login-failed
T1078 - Valid Accounts
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Malwareapp-activity
snow-app-activity
cef-servicenow-file-operation-2

app-login
cef-servicenow-login-1
cef-servicenow-login-2
T1078 - Valid Accounts
  • 1 Rules
Privilege Escalationapp-activity
snow-app-activity
cef-servicenow-file-operation-2
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Ransomwareapp-activity
snow-app-activity
cef-servicenow-file-operation-2

app-login
cef-servicenow-login-1
cef-servicenow-login-2

failed-app-login
cef-servicenow-login-failed
T1078 - Valid Accounts
  • 2 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Indicator Removal on Host: File Deletion

Valid Accounts

Indicator Removal on Host

OS Credential Dumping

File and Directory Discovery

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy

Data Destruction