Vendor: VMware

Product: AirWatch

Use-Case: Privileged Activity

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
3	1	2	2	2

Event Type	Rules	Models
app-activity	T1078 - Valid Accounts ↳ APP-Account-deactivated: Activity from a de-activated user account ↳ APP-AT-PRIV: Non-privileged user performing privileged application activity	• APP-AT-PRIV: Privileged application activities
security-alert	T1068 - Exploitation for Privilege Escalation ↳ ALERT-EXEC: Security violation by Executive