Vendor: Xiting

Product: XAMS

Use-Case: Malware

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
1	0	1	1	1

Event Type	Rules	Models
app-login	T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP