Use Case: Data Leak
November 7, 2023 · View on GitHub
Use Case: Data Leak
Vendor: ASUPIM
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ASUPIM |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Abnormal Security
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Abnormal Security |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: Absolute
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Absolute SIEM Connector |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Accellion
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Kiteworks |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
Vendor: Adaxes
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Adaxes |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Airlock
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Application Whitelisting |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Web Application Firewall |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.001 - T1114.001 T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Akamai
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cloud Akamai |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Amazon
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| AWS CloudTrail |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| AWS WAF |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Anywhere365
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Anywhere365 |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Apache
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Apache |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Apache Subversion |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: AssetView
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| AssetView |
| T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.001 - T1114.001 |
|
Vendor: Atlassian
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Atlassian BitBucket |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Barracuda
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Barracuda Email Security Gateway |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Barracuda Firewall |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: BeyondTrust
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| BeyondInsight |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| BeyondTrust Privileged Identity |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| BeyondTrust Secure Remote Access |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Secure Remote Access |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Bitdefender
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| GravityZone |
| T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Bitglass
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Bitglass CASB |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol T1114.001 - T1114.001 TA0010 - TA0010 |
|
Vendor: BlackBerry
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| BlackBerry Protect |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
Vendor: Box
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Box Cloud Content Management |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Bromium
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Bromium Secure Platform |
| T1114.001 - T1114.001 |
|
Vendor: CatoNetworks
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cato Cloud |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Check Point
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Avanan |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Identity Awareness |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
| NGFW |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| Security Gateway |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Cimtrak
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cimtrak |
| T1114.001 - T1114.001 |
|
Vendor: Cisco
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ACS |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| ADC |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Adaptive Security Appliance |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| AnyConnect |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
| Call Manager |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Cisco |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Cisco Secure Email |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Cloud Web Security |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| CloudLock |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Duo Access Security |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Firepower |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| ISE |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.003 - Email Collection: Email Forwarding Rule T1133 - External Remote Services TA0010 - TA0010 |
|
| IronPort Email |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| IronPort Web Security |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Meraki MX appliances |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| Proxy Umbrella |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Secure Email |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Secure Web Appliance |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Umbrella |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Citrix
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Citrix Endpoint Management |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Citrix Gateway ActiveSync Connector |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Citrix Netscaler |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
| Citrix Netscaler VPN |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| Citrix ShareFile |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Web Logging |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Clearsense
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Clearsense |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Clearswift SEG
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Clearswift SEG |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: Click Studios
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Passwordstate |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Cloudflare
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cloudflare Insights |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Cloudflare WAF |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Code42
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Code42 Incydr |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: CrowdStrike
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Falcon |
| T1020 - Automated Exfiltration T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
Vendor: CyberArk
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| CyberArk Vault |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
| Privileged Session Manager |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Delinea
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Centrify Audit and Monitoring Service |
| T1114.001 - T1114.001 |
|
| Centrify Zero Trust Privilege Services |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Secret Server |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Dell
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| EMC Isilon |
| T1114.001 - T1114.001 |
|
| One Identity Manager |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| SonicWALL Aventail |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Digital Arts
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Digital Arts i-FILTER for Business |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Digital Guardian
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Digital Guardian Endpoint Protection |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
| Digital Guardian Network DLP |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol TA0010 - TA0010 |
|
Vendor: Dropbox
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Dropbox |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Dtex Systems
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| DTEX InTERCEPT |
| T1041 - Exfiltration Over C2 Channel T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: EMP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| EMP |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: ESET
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ESET Endpoint Security |
| T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: ESector
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ESector DEFESA |
| T1114.001 - T1114.001 |
|
Vendor: EdgeWave
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| EdgeWave iPrism |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Egnyte
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Egnyte |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: EndPoint
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| EndPoint |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
Vendor: Epic
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Epic SIEM |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Exabeam
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Exabeam Advanced Analytics |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Exabeam DL |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: F5
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| F5 Advanced Web Application Firewall (WAF) |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| F5 BIG-IP |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
| F5 BIG-IP Access Policy Manager (APM) |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
| F5 BIG-IP Application Security Manager (ASM) |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| WebSafe |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: FTP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| FTP |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Fidelis
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Fidelis XPS |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: FileAuditor
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| FileAuditor |
| T1114.001 - T1114.001 |
|
Vendor: FireEye
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| FireEye Endpoint Security (HX) |
| T1114.001 - T1114.001 |
|
| FireEye Network Security (NX) |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Forcepoint
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Forcepoint CASB |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Forcepoint DLP |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media TA0010 - TA0010 |
|
| Forcepoint Email Security |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Forcepoint Insider Threat |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Websense Secure Gateway |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Fortinet
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| FortiGate |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Fortinet Enterprise Firewall |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Fortinet FortiWeb |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Fortinet UTM |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| Fortinet VPN |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: GTB
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| GTBInspector |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
Vendor: GitHub
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| GitHub |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Google
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cloud Platform |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Workspace |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: HP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| HP LaserJet Printer |
| T1052 - Exfiltration Over Physical Medium |
|
| HP SafeCom |
| T1052 - Exfiltration Over Physical Medium |
|
| Print Server |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: HashiCorp
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Terraform |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: HelpSystems
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Powertech Identity Access Manager (BoKs) |
| T1114.001 - T1114.001 |
|
Vendor: Hornet
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Hornet Email |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: IBM
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| IBM Racf |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| IBM Security Access Manager |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| IBM Sterling B2B Integrator |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: ICDB
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ICDB |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: IMSS
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| IMSS |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
Vendor: IMSVA
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| IMSVA |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: Imperva
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Imperva File Activity Monitoring (FAM) |
| T1114.001 - T1114.001 |
|
| Incapsula |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Imprivata
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Imprivata |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: InfoWatch
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| InfoWatch |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1091 - Replication Through Removable Media T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Infoblox
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| BloxOne |
| T1114.001 - T1114.001 |
|
Vendor: Ipswitch
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| IPswitch MoveIt |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
| MoveIt DMZ |
| T1114.001 - T1114.001 |
|
Vendor: Juniper Networks
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Juniper Networks Pulse Secure |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.003 - Email Collection: Email Forwarding Rule T1133 - External Remote Services TA0010 - TA0010 |
|
| Juniper SRX |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Juniper VPN |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Kaspersky
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Kaspersky Endpoint Security for Business |
| T1020 - Automated Exfiltration T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media TA0010 - TA0010 |
|
Vendor: Kemp
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Kemp LoadMaster |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: LEAP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| LEAP |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: LOGBinder
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SharePoint |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: LanScope
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| LanScope Cat |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: LastPass
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| LastPass |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Lexmark
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Lexmark |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Lumension
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Lumension |
| T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media |
|
Vendor: Malwarebytes
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Malwarebytes Endpoint Protection |
| T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: ManageEngine
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ADSSP |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| PAM360 |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: McAfee
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| McAfee Advanced Threat Defense |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| McAfee DLP |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media TA0010 - TA0010 |
|
| McAfee Email Protection |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| McAfee Endpoint Security |
| T1020 - Automated Exfiltration T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media T1114.001 - T1114.001 TA0010 - TA0010 |
|
| McAfee Web Gateway |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Skyhigh Networks CASB |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
Vendor: Microsoft
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| 365 Defender |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Azure |
| T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
| Azure Active Directory |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Azure MFA |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Azure Security Center |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Cloud App Security (MCAS) |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
| Defender ATP |
| T1114.001 - T1114.001 |
|
| Exchange |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
| IIS |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Office 365 |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
| OneDrive |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Routing and Remote Access Service |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
| Sysmon |
| T1114.001 - T1114.001 |
|
| Web Application Proxy |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Web Application Proxy-TLS Gateway |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Windows |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1133 - External Remote Services TA0010 - TA0010 |
|
| Windows Defender |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Windows PrintService |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Mimecast
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Email Security |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1114.003 - Email Collection: Email Forwarding Rule |
|
| Targeted Threat Protection - URL |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Mvision
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Mvision |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
Vendor: NCP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| NCP |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Nasuni
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Nasuni |
| T1114.001 - T1114.001 |
|
Vendor: NetApp
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| NetApp |
| T1114.001 - T1114.001 |
|
Vendor: NetDocs
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| NetDocs |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: NetMotion Wireless
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| NetMotion Wireless |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Netskope
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Security Cloud |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Netwrix
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Netwrix Auditor |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: NextDLP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Reveal |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1091 - Replication Through Removable Media T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Nortel Contivity
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Nortel Contivity VPN |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: Nutanix
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Nutanix Files |
| T1114.001 - T1114.001 |
|
Vendor: ObserveIT
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ObserveIT |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
Vendor: Okta
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Okta Adaptive MFA |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: OneLogin
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| OneLogin |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Oracle
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Access Manager |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Palo Alto Networks
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cortex XDR |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| GlobalProtect |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.003 - Email Collection: Email Forwarding Rule T1133 - External Remote Services TA0010 - TA0010 |
|
| NGFW |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| Palo Alto Aperture |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
| Prisma Access |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Perforce
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Perforce |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Pharos
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Pharos |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Ping Identity
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Ping Identity |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: PostScript
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| PostScript |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Postfix
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Postfix |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: PowerSentry
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| PowerSentry |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Procad
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Pro.File DMS |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Proofpoint
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ObserveIT |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Proofpoint CASB |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Proofpoint DLP |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Proofpoint Enterprise Protection |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Proofpoint TAP |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| Proofpoint TAP/POD |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: QUSH
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Reveal |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1091 - Replication Through Removable Media T1114.001 - T1114.001 T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Quest Software
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Change Auditor |
| T1114.001 - T1114.001 |
|
Vendor: RSA
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| RSA DLP |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071 - Application Layer Protocol TA0010 - TA0010 |
|
| SecurID |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: RangerAudit
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| RangerAudit |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Ricoh
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Ricoh |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: SAP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SAP |
| T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: SFTP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SFTP |
| T1114.001 - T1114.001 |
|
Vendor: SIGSCI
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SIGSCI |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: SSL Open VPN
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SSL Open VPN |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.003 - Email Collection: Email Forwarding Rule T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: SafeSend
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SafeSend |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: Safend
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Data Protection Suite (DPS) |
| T1020 - Automated Exfiltration T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media TA0010 - TA0010 |
|
Vendor: Sailpoint
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| FAM |
| T1114.001 - T1114.001 |
|
| IdentityNow |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| SailPoint IIQ |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| SecurityIQ |
| T1114.001 - T1114.001 |
|
Vendor: Salesforce
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Salesforce |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Sangfor
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| NGAF |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Seclore
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Seclore |
| T1114.001 - T1114.001 |
|
Vendor: SecureLink
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SecureLink |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: SecureNet
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| SecureNet |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: SentinelOne
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Singularity Platform |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Vigilance |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: ServiceNow
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ServiceNow |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: SkySea
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| ClientView |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1071.001 - Application Layer Protocol: Web Protocols T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Skyhigh Security
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Skyhigh Security Cloud |
| T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Slack
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Slack |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Sonicwall
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Sonicwall |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Sophos
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Sophos Endpoint Protection |
| T1020 - Automated Exfiltration T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media TA0010 - TA0010 |
|
| Sophos SafeGuard |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Sophos UTM |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Sophos XG Firewall |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Squid
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Squid |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: StealthBits
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| StealthIntercept |
| T1114.001 - T1114.001 |
|
Vendor: Swivel
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Swivel |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Symantec
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Symantec |
| T1052 - Exfiltration Over Physical Medium |
|
| Symantec Blue Coat ProxySG Appliance |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Symantec Brightmail |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Symantec CloudSOC |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
| Symantec DLP |
| T1020 - Automated Exfiltration T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1091 - Replication Through Removable Media TA0010 - TA0010 |
|
| Symantec EDR |
| T1114.001 - T1114.001 |
|
| Symantec Email Security.cloud |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| Symantec Endpoint Protection |
| T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.003 - Email Collection: Email Forwarding Rule |
|
| Symantec Fireglass |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Symantec Secure Web Gateway |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Symantec VIP |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Symantec WSS |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Tanium
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cloud Platform |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Integrity Monitor |
| T1114.001 - T1114.001 |
|
Vendor: Tessian
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Tessian Cloud Email Security |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: TitanFTP
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| TitanFTP |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Trend Micro
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Apex One |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
| InterScan Web Security |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| OfficeScan |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1091 - Replication Through Removable Media T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
Vendor: Tyco
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| CCURE Building Management System |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Unix
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Auditbeat |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Unix |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1114.001 - T1114.001 |
|
| Unix Sendmail |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
|
Vendor: VMware
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| AirWatch |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| Carbon Black App Control |
| T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114.001 - T1114.001 |
|
| Carbon Black Cloud Endpoint Standard |
| T1114.001 - T1114.001 |
|
| Carbon Black Cloud Enterprise EDR |
| T1114.001 - T1114.001 |
|
| Carbon Black EDR |
| T1114.001 - T1114.001 |
|
| VMWare ID Manager (VIDM) |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| VMware VCenter |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
| VMware View |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Varonis
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Data Security Platform |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.001 - T1114.001 TA0010 - TA0010 |
|
Vendor: Vectra
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Cognito Stream |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols T1114.001 - T1114.001 T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
| Vectra Cognito Detect |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Virtru
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Virtru |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010 |
|
Vendor: Watchguard
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Watchguard |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Weblogin
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Weblogin |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Wiz
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Wiz |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Workday
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Workday |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: XPS
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| XPS |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Xerox
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Xerox |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: YSoft
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| YSoft |
| T1052 - Exfiltration Over Physical Medium |
|
Vendor: Zeek
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Zeek Network Security Monitor |
| T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: Zendesk
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Zendesk |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Zlock
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Zlock |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: Zscaler
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Zscaler Internet Access |
| T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage TA0010 - TA0010 |
|
| Zscaler Private Access |
| T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1133 - External Remote Services TA0010 - TA0010 |
|
Vendor: eDocs
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| eDocs |
| T1114.003 - Email Collection: Email Forwarding Rule |
|
Vendor: iBoss
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Secure Web Gateway |
| T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage |
|
Vendor: iManage
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| iManage |
| T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|
Vendor: oVirt
| Product | Event Types | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| oVirt |
| T1114.003 - Email Collection: Email Forwarding Rule |
|