Vendor: VMware

Product: NSX FW

Rules	Models	MITRE TTPs	Event Types	Parsers
32	16	4	2	2

Use-Case	Event Types/Parsers	MITRE TTP	Content
Cryptomining	network-connection-failed ↳ cef-nsx-fw-logs-1 network-connection-successful ↳ cef-nsx-fw-logs-1	T1496 - Resource Hijacking	1 Rules
Lateral Movement	network-connection-failed ↳ cef-nsx-fw-logs-1 network-connection-successful ↳ cef-nsx-fw-logs-1	T1071 - Application Layer Protocol T1090.002 - Proxy: External Proxy T1571 - Non-Standard Port	29 Rules 16 Models
Malware	network-connection-failed ↳ cef-nsx-fw-logs-1 network-connection-successful ↳ cef-nsx-fw-logs-1	T1071 - Application Layer Protocol	1 Rules
Ransomware	network-connection-failed ↳ cef-nsx-fw-logs-1 network-connection-successful ↳ cef-nsx-fw-logs-1	T1071 - Application Layer Protocol	2 Rules

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
									Non-Standard Port Proxy: External Proxy Application Layer Protocol Proxy		Resource Hijacking