Use Case: Malware

Vendor: APC

Product	Event Types	MITRE TTP	Content
APC	network-alert remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: Absolute

Product	Event Types	MITRE TTP	Content
Absolute SIEM Connector	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Accellion

Product	Event Types	MITRE TTP	Content
Accellion	account-password-change account-password-reset app-activity app-login dlp-email-alert-out failed-app-login file-delete file-download file-read file-upload	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Kiteworks	dlp-alert dlp-email-alert-out	T1204 - User Execution	4 Rules 2 Models

Vendor: Adaxes

Product	Event Types	MITRE TTP	Content
Adaxes	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: Airlock

Product	Event Types	MITRE TTP	Content
Airlock	app-activity-failed failed-app-login file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	7 Rules 2 Models
Airlock Web Application Firewall	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules

Vendor: Akamai

Product	Event Types	MITRE TTP	Content
Akamai Siem	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Cloud Akamai	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Alert Logic

Product	Event Types	MITRE TTP	Content
Alert Logic	network-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: AlgoSec

Product	Event Types	MITRE TTP	Content
Firewall Analyzer	network-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: Amazon

Product	Event Types	MITRE TTP	Content
AWS Bastion	failed-logon remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	6 Rules 2 Models
AWS CloudTrail	app-activity app-activity-failed app-login cloud-admin-activity cloud-admin-activity-failed failed-app-login storage-access storage-activity storage-activity-failed	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
AWS CloudWatch	app-activity file-alert netflow-connection	T1078 - Valid Accounts T1204 - User Execution	3 Rules 1 Models
AWS GuardDuty	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Anywhere365

Product	Event Types	MITRE TTP	Content
Anywhere365	authentication-failed authentication-successful security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	7 Rules 4 Models

Vendor: Apache Subversion

Product	Event Types	MITRE TTP	Content
Apache Subversion	app-activity app-activity-failed	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Apache

Product	Event Types	MITRE TTP	Content
Apache	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: AppSense Application Manager

Product	Event Types	MITRE TTP	Content
AppSense Application Manager	process-alert	T1204 - User Execution	9 Rules 6 Models

Vendor: Arbor

Product	Event Types	MITRE TTP	Content
Arbor	network-connection-failed	T1071 - Application Layer Protocol	1 Rules

Vendor: AssetView

Product	Event Types	MITRE TTP	Content
AssetView	file-download file-write print-activity security-alert usb-insert	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	10 Rules 5 Models

Vendor: Atlassian

Product	Event Types	MITRE TTP	Content
Atlassian BitBucket	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: Attivo

Product	Event Types	MITRE TTP	Content
BOTsink	network-connection-successful security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Avaya VPN

Product	Event Types	MITRE TTP	Content
Avaya VPN	failed-usb-activity failed-vpn-login usb-activity usb-insert usb-read usb-write vpn-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	5 Rules 2 Models

Vendor: Avaya

Product	Event Types	MITRE TTP	Content
Avaya Ethernet Routing Switch	authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: Axway

Product	Event Types	MITRE TTP	Content
Axway SFTP	file-upload remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: BIND

Product	Event Types	MITRE TTP	Content
BIND	dns-query	T1071.004 - Application Layer Protocol: DNS T1568.002 - Dynamic Resolution: Domain Generation Algorithms	2 Rules

Vendor: Barracuda

Product	Event Types	MITRE TTP	Content
Barracuda Firewall	account-password-change account-password-change-failed failed-logon failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1071 - Application Layer Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1210 - Exploitation of Remote Services	3 Rules

Vendor: BeyondTrust

Product	Event Types	MITRE TTP	Content
BeyondTrust	account-switch app-activity app-login failed-app-login privileged-access	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models
BeyondTrust PasswordSafe	account-switch privileged-access	T1204 - User Execution	4 Rules 2 Models
BeyondTrust PowerBroker	privileged-access process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	205 Rules 26 Models
BeyondTrust Privilege Management	local-logon process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	205 Rules 26 Models
BeyondTrust Privileged Identity	account-switch app-activity app-login privileged-access	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: Bitdefender

Product	Event Types	MITRE TTP	Content
Bitdefender	app-login security-alert	T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models
Bitdefender GravityZone	security-alert web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	28 Rules 9 Models

Vendor: Bitglass

Product	Event Types	MITRE TTP	Content
Bitglass CASB	app-login dlp-alert dlp-email-alert-out failed-app-login file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	10 Rules 3 Models

Vendor: BlackBerry

Product	Event Types	MITRE TTP	Content
BlackBerry Protect	app-activity app-login dlp-alert file-alert file-delete file-read process-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	14 Rules 8 Models

Vendor: BlueCat Networks

Product	Event Types	MITRE TTP	Content
BlueCat Networks Adonis	dns-query	T1071.004 - Application Layer Protocol: DNS T1568.002 - Dynamic Resolution: Domain Generation Algorithms	2 Rules

Vendor: Box

Product	Event Types	MITRE TTP	Content
Box Cloud Content Management	app-activity app-login file-delete file-download file-permission-change file-read file-upload file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models

Vendor: Bromium

Product	Event Types	MITRE TTP	Content
Bromium Advanced Endpoint Security	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Bromium Secure Platform	file-permission-change file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models

Vendor: CatoNetworks

Product	Event Types	MITRE TTP	Content
Cato Cloud	network-alert vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	30 Rules 8 Models

Vendor: Centrify

Product	Event Types	MITRE TTP	Content
Centrify Audit and Monitoring Service	file-delete file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models
Centrify Authentication Service	authentication-successful failed-logon local-logon remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	7 Rules 2 Models
Centrify Infrastructure Services	process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models
Centrify Zero Trust Privilege Services	account-switch app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models

Vendor: Check Point Software

Product	Event Types	MITRE TTP	Content
Check Point Endpoint Security	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Check Point Identity Awareness	failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1071 - Application Layer Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Check Point NGFW	app-login dlp-email-alert-in dlp-email-alert-out failed-vpn-login local-logon network-alert network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	31 Rules 8 Models
Check Point Security Gateway	failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1071 - Application Layer Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Check Point Security Gateway Virtual Edition (vSEC)	authentication-failed authentication-successful vpn-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Check Point Threat Prevention	network-alert network-connection-failed network-connection-successful vpn-login vpn-logout	T1071 - Application Layer Protocol T1078 - Valid Accounts T1204 - User Execution	6 Rules 2 Models

Vendor: Cisco

Product	Event Types	MITRE TTP	Content
ACI	authentication-failed authentication-successful config-change	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
AnyConnect	process-network vpn-login vpn-logout	T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1078 - Valid Accounts T1204 - User Execution	13 Rules 5 Models
Cisco ACS	app-activity authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Cisco ADC	web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	22 Rules 6 Models
Cisco Adaptive Security Appliance	authentication-failed authentication-successful dns-response failed-logon failed-vpn-login file-download file-upload nac-logon network-connection-successful process-created remote-logon vpn-login vpn-logout web-activity-denied	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1550.002 - Use Alternate Authentication Material: Pass the Hash T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	231 Rules 32 Models
Cisco Advance Malware Protection (AMP)	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Cisco Airespace	network-alert	T1204 - User Execution	4 Rules 2 Models
Cisco Call Manager	app-activity app-activity-failed authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Cisco Cloud Web Security	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Cisco CloudLock	dlp-alert	T1204 - User Execution	4 Rules 2 Models
Cisco Firepower	authentication-successful dns-query dns-response nac-logon netflow-connection network-alert network-connection-failed network-connection-successful security-alert vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	36 Rules 10 Models
Cisco ISE	app-activity authentication-failed authentication-successful computer-logon failed-vpn-login nac-failed-logon nac-logon remote-logon vpn-login vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models
Cisco Meraki MX appliances	network-alert network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	30 Rules 8 Models
Cisco NPE	process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models
Cisco Secure Network Analytics	network-alert	T1204 - User Execution	4 Rules 2 Models
Cisco Secure Web Appliance	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Cisco TACACS	process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models
Cisco Umbrella	config-change dns-query dns-response failed-logon network-connection-failed network-connection-successful remote-logon web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	35 Rules 8 Models
Duo Access Security	account-creation app-activity app-login authentication-failed authentication-successful failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
IronPort Web Security	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Proxy Umbrella	network-connection-successful web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Citrix

Product	Event Types	MITRE TTP	Content
Citrix AppFW	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
Citrix Endpoint Management	app-activity remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models
Citrix Gateway ActiveSync Connector	app-activity app-activity-failed	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Citrix Netscaler	app-activity app-login authentication-failed failed-vpn-login process-created vpn-login vpn-logout	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	205 Rules 26 Models
Citrix Netscaler VPN	authentication-failed authentication-successful remote-access remote-logon vpn-connection vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	5 Rules 2 Models
Citrix ShareFile	app-activity app-login failed-app-login file-download file-upload	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Citrix XenApp	app-login remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models
Citrix XenDesktop	remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models
Netscaler WAF	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
Web Logging	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Cloud Application

Product	Event Types	MITRE TTP	Content
Cloud Application	account-password-change app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Cloudflare

Product	Event Types	MITRE TTP	Content
Cloudflare CDN	network-alert	T1204 - User Execution	4 Rules 2 Models
Cloudflare Insights	app-activity app-login member-added member-removed	T1078 - Valid Accounts	1 Rules
Cloudflare WAF	network-alert network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	29 Rules 8 Models

Vendor: Code42

Product	Event Types	MITRE TTP	Content
Code42 Incydr	dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity usb-activity usb-insert	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models

Vendor: Cofense

Product	Event Types	MITRE TTP	Content
Phishme	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Cognitas CrossLink

Product	Event Types	MITRE TTP	Content
Cognitas CrossLink	vpn-login	T1078 - Valid Accounts	1 Rules

Vendor: Contrast Security

Product	Event Types	MITRE TTP	Content
Contrast Security	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: CrowdStrike

Product	Event Types	MITRE TTP	Content
Falcon	app-activity app-activity-failed app-login authentication-failed batch-logon computer-logon config-change dlp-alert dns-query failed-app-login file-alert file-delete file-download file-read file-write local-logon network-connection-successful process-alert process-created process-network remote-access remote-logon security-alert service-logon task-created usb-activity usb-insert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	225 Rules 39 Models

Vendor: CyberArk

Product	Event Types	MITRE TTP	Content
CyberArk Endpoint Privilege Management	privileged-object-access process-alert	T1204 - User Execution	11 Rules 6 Models
CyberArk Vault	account-password-change account-password-change-failed account-password-reset account-switch app-activity app-activity-failed app-login failed-app-login failed-logon file-delete file-permission-change file-read file-write remote-logon security-alert	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	13 Rules 5 Models
Privileged Session Manager	account-switch app-activity app-login	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models
Privileged Threat Analytics	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Cybereason

Product	Event Types	MITRE TTP	Content
Cybereason	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: DTEX InTERCEPT

Product	Event Types	MITRE TTP	Content
DTEX InTERCEPT	file-delete file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models

Vendor: Damballa

Product	Event Types	MITRE TTP	Content
Failsafe	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Darktrace

Product	Event Types	MITRE TTP	Content
Darktrace	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Darktrace Enterprise Immune System	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Dell

Product	Event Types	MITRE TTP	Content
Dell EMC Isilon	file-delete file-read file-write remote-access	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	8 Rules 3 Models
One Identity Manager	account-password-change account-switch app-activity	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models
RSA Authentication Manager	account-lockout authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
SonicWALL Aventail	vpn-login vpn-logout	T1078 - Valid Accounts	1 Rules

Vendor: Digital Arts

Product	Event Types	MITRE TTP	Content
Digital Arts i-FILTER for Business	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Digital Guardian

Product	Event Types	MITRE TTP	Content
Digital Guardian Endpoint Protection	app-activity dlp-alert dlp-email-alert-out file-delete file-download file-read file-upload file-write local-logon print-activity process-created usb-insert usb-write	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	210 Rules 27 Models
Digital Guardian Network DLP	dlp-alert dlp-email-alert-out dlp-email-alert-out-failed print-activity	T1204 - User Execution	4 Rules 2 Models

Vendor: Dropbox

Product	Event Types	MITRE TTP	Content
Dropbox	app-activity app-login file-delete file-download file-permission-change file-read file-write vpn-logout	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models

Vendor: Dtex Systems

Product	Event Types	MITRE TTP	Content
DTEX InTERCEPT	file-write local-logon print-activity process-created remote-logon usb-write web-activity-allowed workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1550.002 - Use Alternate Authentication Material: Pass the Hash T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	232 Rules 33 Models

Vendor: Duo Access Security

Product	Event Types	MITRE TTP	Content
Duo Access Security	app-activity failed-vpn-login vpn-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: EMP

Product	Event Types	MITRE TTP	Content
EMP	app-activity app-login	T1078 - Valid Accounts	1 Rules

Vendor: ESET

Product	Event Types	MITRE TTP	Content
ESET Endpoint Security	app-login authentication-failed authentication-successful failed-logon security-alert web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	31 Rules 9 Models

Vendor: ESector

Product	Event Types	MITRE TTP	Content
ESector DEFESA	file-delete file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models

Vendor: EdgeWave

Product	Event Types	MITRE TTP	Content
EdgeWave iPrism	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Egnyte

Product	Event Types	MITRE TTP	Content
Egnyte	app-login failed-app-login file-delete file-download file-permission-change file-upload file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 2 Models

Vendor: EnSilo

Product	Event Types	MITRE TTP	Content
EnSilo	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: EndPoint

Product	Event Types	MITRE TTP	Content
EndPoint	dlp-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: Endgame

Product	Event Types	MITRE TTP	Content
Endgame EDR	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Entrust

Product	Event Types	MITRE TTP	Content
IdentityGuard	account-lockout authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: Epic

Product	Event Types	MITRE TTP	Content
Epic SIEM	account-password-change account-password-change-failed app-activity app-login authentication-successful failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Exabeam

Product	Event Types	MITRE TTP	Content
Exabeam DL	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Extrahop

Product	Event Types	MITRE TTP	Content
Reveal(x)	dns-query network-alert security-alert	T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1204 - User Execution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 4 Models

Vendor: Extreme Networks

Product	Event Types	MITRE TTP	Content
Zebra wireless LAN management	failed-logon	T1090.003 - Proxy: Multi-hop Proxy T1210 - Exploitation of Remote Services	2 Rules

Vendor: F-Secure

Product	Event Types	MITRE TTP	Content
F-Secure Client Security	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: F5

Product	Event Types	MITRE TTP	Content
BIG-IP DNS	dns-query dns-response	T1071.004 - Application Layer Protocol: DNS T1568.002 - Dynamic Resolution: Domain Generation Algorithms	4 Rules
F5 Advanced Web Application Firewall (WAF)	network-alert network-connection-failed	T1071 - Application Layer Protocol T1204 - User Execution	5 Rules 2 Models
F5 BIG-IP	authentication-failed failed-logon failed-vpn-login network-connection-successful remote-logon vpn-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	6 Rules 2 Models
F5 BIG-IP Access Policy Manager (APM)	authentication-failed authentication-successful vpn-login vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
F5 BIG-IP Advanced Firewall Module (AFM)	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
F5 BIG-IP Application Security Manager (ASM)	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
F5 IP Intelligence	network-alert	T1204 - User Execution	4 Rules 2 Models
F5 Silverline	network-alert	T1204 - User Execution	4 Rules 2 Models
WebSafe	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: FTP

Product	Event Types	MITRE TTP	Content
FTP	app-login failed-app-login file-delete file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 2 Models

Vendor: Fast Enterprises

Product	Event Types	MITRE TTP	Content
Fast Enterprises GenTax	app-login	T1078 - Valid Accounts	1 Rules

Vendor: Fidelis

Product	Event Types	MITRE TTP	Content
Fidelis Network	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Fidelis XPS	dlp-email-alert-in dlp-email-alert-out security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: FireEye

Product	Event Types	MITRE TTP	Content
FireEye Email Gateway	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
FireEye Email Security (EX)	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
FireEye Email Threat Prevention (ETP)	dlp-email-alert-in dlp-email-alert-in-failed security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
FireEye Endpoint Security (CM)	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
FireEye Endpoint Security (HX)	file-write network-alert process-alert security-alert	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	17 Rules 9 Models
FireEye Helix	network-alert	T1204 - User Execution	4 Rules 2 Models
FireEye Network Security (Helix)	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
FireEye Network Security (NX)	security-alert web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	31 Rules 10 Models

Vendor: Forcepoint

Product	Event Types	MITRE TTP	Content
Forcepoint CASB	app-activity app-login failed-app-login security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 4 Models
Forcepoint DLP	dlp-alert dlp-email-alert-in dlp-email-alert-out dlp-email-alert-out-failed usb-insert	T1204 - User Execution	4 Rules 2 Models
Forcepoint Insider Threat	dlp-alert	T1204 - User Execution	4 Rules 2 Models
Forcepoint NGFW	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
Websense Secure Gateway	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Forescout

Product	Event Types	MITRE TTP	Content
Forescout CounterACT	config-change nac-logon network-alert network-connection-failed network-connection-successful	T1071 - Application Layer Protocol T1204 - User Execution	5 Rules 2 Models

Vendor: Fortinet

Product	Event Types	MITRE TTP	Content
FortiAuthenticator	authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Fortinet Enterprise Firewall	app-activity app-activity-failed computer-logon netflow-connection network-connection-failed network-connection-successful	T1071 - Application Layer Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	3 Rules
Fortinet FortiWeb	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Fortinet UTM	app-activity app-activity-failed authentication-failed authentication-successful dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-vpn-login network-alert security-alert vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	33 Rules 10 Models
Fortinet VPN	authentication-successful vpn-login vpn-logout	T1078 - Valid Accounts	1 Rules

Vendor: GTB

Product	Event Types	MITRE TTP	Content
GTBInspector	dlp-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: Gamma

Product	Event Types	MITRE TTP	Content
Gamma	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Gemalto

Product	Event Types	MITRE TTP	Content
Gemalto MFA	authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: GitHub

Product	Event Types	MITRE TTP	Content
GitHub	app-activity app-activity-failed app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Google

Product	Event Types	MITRE TTP	Content
GCP Squid Proxy	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Google	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Google Calendar	app-activity	T1078 - Valid Accounts	1 Rules
Google Cloud Platform	app-activity cloud-admin-activity cloud-admin-activity-failed storage-access storage-activity storage-activity-failed	T1078 - Valid Accounts	1 Rules
Google Drive	file-delete file-download file-permission-change file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models

Vendor: HP

Product	Event Types	MITRE TTP	Content
Aruba Wireless controller	computer-logon nac-failed-logon nac-logon network-alert	T1204 - User Execution	4 Rules 2 Models
HP	local-logon nac-failed-logon nac-logon	T1204 - User Execution	4 Rules 2 Models
HP Comware	process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models
HP Virtual Connect Enterprise Manager	app-login	T1078 - Valid Accounts	1 Rules
IronPort Web Security	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: HashiCorp

Product	Event Types	MITRE TTP	Content
HashiCorp Vault	account-password-reset app-login	T1078 - Valid Accounts	1 Rules
Terraform	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: HelpSystems

Product	Event Types	MITRE TTP	Content
Powertech Identity Access Manager (BoKs)	account-switch file-delete file-read file-write local-logon process-created remote-logon	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	210 Rules 27 Models

Vendor: Huawei

Product	Event Types	MITRE TTP	Content
Enterprise Network Firewall	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
Unified Security Gateway	authentication-successful network-alert process-created vpn-login	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	206 Rules 26 Models

Vendor: IBM

Product	Event Types	MITRE TTP	Content
IBM	authentication-successful	T1078 - Valid Accounts	1 Rules
IBM DB2	authentication-failed file-read remote-logon security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	7 Rules 4 Models
IBM Endpoint Manager	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
IBM Racf	app-activity app-login database-access database-failed-login database-update failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
IBM Sametime	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
IBM Security Access Manager	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
IBM Sense	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
IBM Sterling B2B Integrator	app-activity failed-logon member-added member-removed remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	7 Rules 2 Models
Infosphere Guardium	database-alert database-failed-login database-login database-query	T1078 - Valid Accounts T1204 - User Execution	5 Rules 3 Models
Lotus Mobile Connect	authentication-failed authentication-successful failed-vpn-login vpn-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Proventia Network IPS	network-alert	T1204 - User Execution	4 Rules 2 Models
QRadar Network Security	network-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: ICDB

Product	Event Types	MITRE TTP	Content
ICDB	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: IPTables

Product	Event Types	MITRE TTP	Content
IPTables	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules

Vendor: IXIA

Product	Event Types	MITRE TTP	Content
IXIA ThreatArmor	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules

Vendor: Illumio

Product	Event Types	MITRE TTP	Content
Illumio	network-connection-failed	T1071 - Application Layer Protocol	1 Rules

Vendor: Imperva

Product	Event Types	MITRE TTP	Content
CounterBreach	database-alert	T1078 - Valid Accounts T1204 - User Execution	5 Rules 3 Models
Imperva File Activity Monitoring (FAM)	file-delete file-permission-change file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models
Imperva SecureSphere	app-login database-alert database-delete database-failed-login database-login database-query database-update failed-app-login network-alert security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	11 Rules 6 Models
Incapsula	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: InfoWatch

Product	Event Types	MITRE TTP	Content
InfoWatch	app-login dlp-email-alert-in dlp-email-alert-out print-activity usb-write web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	27 Rules 8 Models

Vendor: Infoblox

Product	Event Types	MITRE TTP	Content
Infoblox	computer-logon dns-query network-alert network-connection-failed network-connection-successful remote-logon	T1071 - Application Layer Protocol T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1204 - User Execution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Infoblox BloxOne	app-activity app-login	T1078 - Valid Accounts	1 Rules

Vendor: Inky

Product	Event Types	MITRE TTP	Content
Inky Anti-Phishing	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Ipswitch

Product	Event Types	MITRE TTP	Content
IPswitch MoveIt	app-activity app-login failed-app-login file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 2 Models
MoveIt DMZ	account-password-change authentication-failed authentication-successful failed-logon file-delete file-download file-upload file-write member-added	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	8 Rules 2 Models

Vendor: IronPort Web Security

Product	Event Types	MITRE TTP	Content
IronPort Web Security	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Johnson Controls

Product	Event Types	MITRE TTP	Content
Johnson Controls P2000	account-password-change-failed app-login failed-logon physical-access security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	9 Rules 4 Models

Vendor: Juniper Networks

Product	Event Types	MITRE TTP	Content
Juniper Networks ATP	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Juniper Networks Pulse Secure	account-deleted app-activity vpn-login	T1078 - Valid Accounts	1 Rules
Juniper OWA	app-login	T1078 - Valid Accounts	1 Rules
Juniper SRX	account-deleted authentication-failed authentication-successful failed-vpn-login network-alert network-connection-failed network-connection-successful security-alert vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	32 Rules 10 Models
Juniper VPN	account-deleted authentication-failed authentication-successful failed-vpn-login vpn-login vpn-logout web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	23 Rules 6 Models

Vendor: Kaspersky

Product	Event Types	MITRE TTP	Content
Kaspersky Endpoint Security for Business	dlp-alert security-alert usb-insert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Kemp

Product	Event Types	MITRE TTP	Content
Kemp LoadMaster	app-activity remote-logon security-alert	T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models
Load Balancer	authentication-failed remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	5 Rules 2 Models

Vendor: Kiteworks

Product	Event Types	MITRE TTP	Content
Kiteworks	account-password-change app-activity app-login file-delete file-download file-permission-change file-read file-upload file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models

Vendor: LEAP

Product	Event Types	MITRE TTP	Content
IMSS	dlp-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
LEAP	app-activity app-login	T1078 - Valid Accounts	1 Rules

Vendor: LOGBinder

Product	Event Types	MITRE TTP	Content
SharePoint	app-activity file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models

Vendor: LanScope Cat

Product	Event Types	MITRE TTP	Content
LanScope Cat	app-activity file-delete file-write process-created process-created-failed process-network	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	208 Rules 26 Models

Vendor: LanScope

Product	Event Types	MITRE TTP	Content
LanScope Cat	app-activity dlp-alert failed-usb-activity local-logon print-activity usb-activity usb-write web-activity-allowed workstation-locked workstation-unlocked	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	27 Rules 8 Models

Vendor: LastPass

Product	Event Types	MITRE TTP	Content
LastPass	app-activity app-login	T1078 - Valid Accounts	1 Rules

Vendor: Lastline

Product	Event Types	MITRE TTP	Content
Lastline	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Linux

Product	Event Types	MITRE TTP	Content
Linux CentOs	network-connection-failed	T1071 - Application Layer Protocol	1 Rules
SSH	failed-logon remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	6 Rules 2 Models

Vendor: LogMeIn

Product	Event Types	MITRE TTP	Content
RemotelyAnywhere	remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: LogRhythm

Product	Event Types	MITRE TTP	Content
LogRhythm	process-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models

Vendor: Lumension

Product	Event Types	MITRE TTP	Content
Lumension	app-login authentication-failed authentication-successful failed-app-login failed-usb-activity usb-activity usb-insert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Malwarebytes

Product	Event Types	MITRE TTP	Content
Malwarebytes Endpoint Protection	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: McAfee

Product	Event Types	MITRE TTP	Content
MDAM	database-alert database-delete database-query database-update	T1078 - Valid Accounts T1204 - User Execution	5 Rules 3 Models
McAfee Advanced Threat Defense	dlp-alert	T1204 - User Execution	4 Rules 2 Models
McAfee DLP	dlp-alert dlp-email-alert-out dlp-email-alert-out-failed failed-usb-activity print-activity usb-write	T1204 - User Execution	4 Rules 2 Models
McAfee Endpoint Security	dlp-alert failed-app-login file-write print-activity process-alert process-created-failed remote-logon security-alert usb-activity usb-insert usb-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1117 - T1117 T1118 - T1118 T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1170 - T1170 T1204 - User Execution T1220 - XSL Script Processing	23 Rules 10 Models
McAfee Enterprise Security Manager	network-alert	T1204 - User Execution	4 Rules 2 Models
McAfee IDPS	network-alert	T1204 - User Execution	4 Rules 2 Models
McAfee NSM	network-alert	T1204 - User Execution	4 Rules 2 Models
McAfee Network Security Platform (IPS)	network-alert	T1204 - User Execution	4 Rules 2 Models
McAfee Solidifier	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
McAfee Web Gateway	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Mcafee EPO	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Skyhigh Networks CASB	app-activity app-login dlp-alert	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: Microsoft

Product	Event Types	MITRE TTP	Content
Advanced Threat Analytics (ATA)	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
AppLocker	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Exchange	app-activity app-activity-failed dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models
IIS	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Microsoft Azure	app-activity app-activity-failed app-login authentication-failed authentication-successful cloud-admin-activity cloud-admin-activity-failed failed-app-login file-delete file-download file-read file-upload file-write network-alert network-connection-failed network-connection-successful process-created storage-access storage-activity storage-activity-failed	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	212 Rules 27 Models
Microsoft Azure AD Identity Protection	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Microsoft Azure Active Directory	account-password-change app-activity app-activity-failed app-login authentication-failed failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Microsoft Azure Advanced Threat Protection	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Microsoft Azure MFA	app-activity authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Microsoft Azure Security Center	process-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	13 Rules 9 Models
Microsoft Azure Sentinel	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Microsoft Cloud App Security (MCAS)	app-activity app-login failed-app-login file-delete file-upload file-write member-added member-removed process-created process-network process-network-failed security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	214 Rules 29 Models
Microsoft Defender ATP	process-created security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	207 Rules 29 Models
Microsoft Graph	dlp-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Microsoft Office 365	account-disabled account-password-change account-unlocked app-activity app-activity-failed app-login database-query dlp-alert dlp-email-alert-in dlp-email-alert-out dns-query failed-app-login file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed network-connection-failed network-connection-successful process-created remote-logon security-alert usb-activity usb-insert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	216 Rules 29 Models
Microsoft OneDrive	app-activity file-read	T1078 - Valid Accounts	1 Rules
Microsoft RRA	authentication-successful vpn-login	T1078 - Valid Accounts	1 Rules
Microsoft SQL Server	database-access database-activity-failed database-delete database-failed-login database-login database-query failed-app-login	T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Microsoft ScanMail	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Microsoft Sysmon	dns-query file-delete file-write image-loaded process-created process-network	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071.004 - Application Layer Protocol: DNS T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	212 Rules 26 Models
Microsoft Windows	account-creation account-deleted account-disabled account-enabled account-lockout account-password-change account-password-change-failed account-password-reset account-switch account-unlocked app-login audit-log-clear audit-policy-change authentication-failed authentication-successful batch-logon computer-logon config-change database-login dcom-activation-failed dns-query dns-response ds-access failed-app-login failed-logon failed-vpn-login file-close file-delete file-read file-write kerberos-logon local-logon logout-remote member-added member-removed nac-failed-logon nac-logon network-connection-successful ntlm-logon privileged-access privileged-object-access process-created process-network process-network-failed remote-access remote-logon security-alert service-created service-logon share-access share-access-denied task-created usb-activity usb-insert vpn-login vpn-logout winsession-disconnect workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1207 - Rogue Domain Controller T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1569.002 - T1569.002 T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	261 Rules 52 Models
Microsoft Windows DNSServer	database-failed-login database-login database-query dns-query	T1071.004 - Application Layer Protocol: DNS T1568.002 - Dynamic Resolution: Domain Generation Algorithms	2 Rules
NetApp	file-alert file-delete	T1204 - User Execution	2 Rules 1 Models
Web Application Proxy	remote-logon web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	30 Rules 8 Models
Web Application Proxy-TLS Gateway	web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	22 Rules 5 Models
Windows Defender	app-activity app-activity-failed app-login dlp-alert failed-app-login security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 4 Models

Vendor: Mimecast

Product	Event Types	MITRE TTP	Content
Mimecast	app-activity	T1078 - Valid Accounts	1 Rules
Mimecast Email Security	app-activity app-login dlp-email-alert-in dlp-email-alert-in-failed failed-app-login file-delete file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 2 Models
Targeted Threat Protection - URL	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: MobileIron

Product	Event Types	MITRE TTP	Content
MobileIron	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Morphisec

Product	Event Types	MITRE TTP	Content
Morphisec EPTP	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Mvision

Product	Event Types	MITRE TTP	Content
Mvision	dlp-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: NCP

Product	Event Types	MITRE TTP	Content
NCP	authentication-failed vpn-login vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: NNT

Product	Event Types	MITRE TTP	Content
NNT ChangeTracker	app-login	T1078 - Valid Accounts	1 Rules

Vendor: Namespace rDirectory

Product	Event Types	MITRE TTP	Content
Namespace rDirectory	account-creation account-deleted account-disabled account-enabled account-password-change ds-access member-added	T1207 - Rogue Domain Controller	1 Rules

Vendor: NetDocs

Product	Event Types	MITRE TTP	Content
NetDocs	app-activity file-delete file-read file-upload file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models

Vendor: NetIQ

Product	Event Types	MITRE TTP	Content
NetIQ	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: NetMotion Wireless

Product	Event Types	MITRE TTP	Content
NetMotion Wireless	vpn-login vpn-logout	T1078 - Valid Accounts	1 Rules

Vendor: Netskope

Product	Event Types	MITRE TTP	Content
Netskope Security Cloud	app-activity app-login dlp-alert dlp-email-alert-out failed-app-login file-delete file-download file-permission-change file-read file-upload file-write network-connection-failed network-connection-successful security-alert web-activity-allowed web-activity-denied	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	37 Rules 11 Models

Vendor: Netwrix

Product	Event Types	MITRE TTP	Content
Netwrix Auditor	account-disabled account-lockout account-password-reset account-unlocked app-activity app-login database-access database-failed-login ds-access failed-app-login failed-logon file-delete file-write member-added member-removed	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1207 - Rogue Domain Controller T1210 - Exploitation of Remote Services	10 Rules 2 Models
Sonicwall	network-alert network-connection-successful	T1204 - User Execution	4 Rules 2 Models

Vendor: Nexthink

Product	Event Types	MITRE TTP	Content
Nexthink	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: OSSEC

Product	Event Types	MITRE TTP	Content
OSSEC	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: ObserveIT

Product	Event Types	MITRE TTP	Content
ObserveIT	app-activity app-login database-access dlp-alert failed-app-login process-created remote-logon security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	209 Rules 28 Models

Vendor: Okta

Product	Event Types	MITRE TTP	Content
Okta Adaptive MFA	account-lockout account-password-reset account-unlocked app-activity app-activity-failed app-login authentication-failed authentication-successful failed-app-login member-added security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 4 Models

Vendor: Onapsis

Product	Event Types	MITRE TTP	Content
Onapsis	app-login database-update failed-app-login security-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 4 Models

Vendor: OneLogin

Product	Event Types	MITRE TTP	Content
OneLogin	account-password-reset app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: OneSpan

Product	Event Types	MITRE TTP	Content
OneSpan	failed-logon	T1090.003 - Proxy: Multi-hop Proxy T1210 - Exploitation of Remote Services	2 Rules

Vendor: Oracle

Product	Event Types	MITRE TTP	Content
Oracle Access Manager	app-activity app-login authentication-failed authentication-successful failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Oracle Solaris	process-created process-created-failed	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models

Vendor: Ordr

Product	Event Types	MITRE TTP	Content
Ordr SCE	network-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: Osirium

Product	Event Types	MITRE TTP	Content
Osirium	app-login	T1078 - Valid Accounts	1 Rules

Vendor: Palo Alto Networks

Product	Event Types	MITRE TTP	Content
Cortex XDR	app-activity app-login security-alert	T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models
GlobalProtect	app-activity authentication-failed authentication-successful config-change failed-logon failed-vpn-login network-connection-failed network-connection-successful remote-logon vpn-login vpn-logout	T1071 - Application Layer Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	8 Rules 2 Models
Magnifier	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
NGFW	app-activity config-change dlp-alert failed-vpn-login file-alert network-alert network-connection-failed network-connection-successful remote-logon security-alert vpn-login web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	33 Rules 10 Models
Palo Alto Aperture	app-activity app-login dlp-alert file-delete file-download file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	9 Rules 3 Models
Traps	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
WildFire	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Password Manager Pro

Product	Event Types	MITRE TTP	Content
Password Manager Pro	account-password-change account-switch	T1204 - User Execution	4 Rules 2 Models

Vendor: Paxton

Product	Event Types	MITRE TTP	Content
NET2DOOR	account-password-change account-password-change-failed app-activity app-activity-failed app-login authentication-failed authentication-successful failed-app-login failed-physical-access file-delete file-download file-read file-upload file-write physical-access	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 2 Models

Vendor: Perforce

Product	Event Types	MITRE TTP	Content
Perforce	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: Ping Identity

Product	Event Types	MITRE TTP	Content
Ping Identity	app-login authentication-failed authentication-successful computer-logon nac-logon network-alert	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models
PingID	account-password-change account-password-change-failed account-password-reset authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules
PingOne	app-login authentication-successful failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: PowerSentry

Product	Event Types	MITRE TTP	Content
PowerSentry	app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Prisma Cloud

Product	Event Types	MITRE TTP	Content
Prisma Cloud	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Procad

Product	Event Types	MITRE TTP	Content
Pro.File DMS	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: Proofpoint

Product	Event Types	MITRE TTP	Content
Proofpoint Enterprise Protection	dlp-alert dlp-email-alert-in-failed	T1204 - User Execution	4 Rules 2 Models

Vendor: ProtectWise

Product	Event Types	MITRE TTP	Content
NDR	app-login authentication-failed authentication-successful failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: ProxySG

Product	Event Types	MITRE TTP	Content
ProxySG	authentication-failed	T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: Qualys

Product	Event Types	MITRE TTP	Content
Qualys	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Quest InTrust

Product	Event Types	MITRE TTP	Content
Quest InTrust	computer-logon process-created usb-activity	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	203 Rules 26 Models

Vendor: Quest Software

Product	Event Types	MITRE TTP	Content
Change Auditor	ds-access failed-ds-access failed-logon	T1090.003 - Proxy: Multi-hop Proxy T1207 - Rogue Domain Controller T1210 - Exploitation of Remote Services	3 Rules

Vendor: RSA

Product	Event Types	MITRE TTP	Content
RSA Authentication Manager	authentication-successful security-alert	T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models
RSA DLP	dlp-alert dlp-email-alert-out	T1204 - User Execution	4 Rules 2 Models
RSA ECAT	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
RSA NetWitness	app-login	T1078 - Valid Accounts	1 Rules
SecurID	authentication-failed authentication-successful vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: RUID

Product	Event Types	MITRE TTP	Content
RUID	authentication-successful	T1078 - Valid Accounts	1 Rules

Vendor: Radius

Product	Event Types	MITRE TTP	Content
Radius	authentication-failed authentication-successful computer-logon nac-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: RangerAudit

Product	Event Types	MITRE TTP	Content
RangerAudit	app-activity app-login database-activity-failed database-query failed-app-login file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 2 Models

Vendor: Rapid7

Product	Event Types	MITRE TTP	Content
InsightVM	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Nexpose	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Red Canary

Product	Event Types	MITRE TTP	Content
Red Canary	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: SAP

Product	Event Types	MITRE TTP	Content
SAP	account-creation account-deleted account-lockout account-unlocked app-activity authentication-failed authentication-successful file-download remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models

Vendor: SIGSCI

Product	Event Types	MITRE TTP	Content
SIGSCI	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: SSL Open VPN

Product	Event Types	MITRE TTP	Content
Nasuni	file-delete file-permission-change file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models
SSL Open VPN	app-activity app-activity-failed authentication-failed failed-vpn-login vpn-login vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Safend

Product	Event Types	MITRE TTP	Content
Data Protection Suite (DPS)	dlp-alert usb-insert usb-read usb-write	T1204 - User Execution	4 Rules 2 Models

Vendor: Sailpoint

Product	Event Types	MITRE TTP	Content
IdentityNow	app-activity app-login authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
SecurityIQ	account-creation account-deleted account-lockout account-password-reset file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models

Vendor: Salesforce

Product	Event Types	MITRE TTP	Content
Salesforce	app-activity app-login failed-app-login file-download file-upload	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Sangfor

Product	Event Types	MITRE TTP	Content
NGAF	network-alert web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	29 Rules 8 Models

Vendor: Secure Computing

Product	Event Types	MITRE TTP	Content
Secure Computing SafeWord	authentication-successful	T1078 - Valid Accounts	1 Rules

Vendor: Secure Envoy

Product	Event Types	MITRE TTP	Content
Secure Envoy	authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: SecureAuth

Product	Event Types	MITRE TTP	Content
SecureAuth Login	app-login authentication-successful	T1078 - Valid Accounts	1 Rules

Vendor: SecureLink

Product	Event Types	MITRE TTP	Content
SecureLink	app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: SecureNet

Product	Event Types	MITRE TTP	Content
SecureNet	vpn-login vpn-logout	T1078 - Valid Accounts	1 Rules

Vendor: SecureWorks

Product	Event Types	MITRE TTP	Content
iSensor IPS	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: SentinelOne

Product	Event Types	MITRE TTP	Content
SentinelOne	app-activity dns-query dns-response file-alert file-delete file-read file-write network-alert network-connection-failed network-connection-successful process-created security-alert task-created web-activity-allowed	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1550.002 - Use Alternate Authentication Material: Pass the Hash T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	249 Rules 43 Models

Vendor: ServiceNow

Product	Event Types	MITRE TTP	Content
ServiceNow	account-switch app-activity app-login authentication-failed authentication-successful failed-app-login file-delete file-download file-read file-upload file-write remote-logon	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	10 Rules 3 Models

Vendor: Shibboleth

Product	Event Types	MITRE TTP	Content
Shibboleth IdP	authentication-successful	T1078 - Valid Accounts	1 Rules
Shibboleth SSO	account-password-change app-login	T1078 - Valid Accounts	1 Rules

Vendor: Silverfort

Product	Event Types	MITRE TTP	Content
Silverfort	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: SiteMinder

Product	Event Types	MITRE TTP	Content
SiteMinder	authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: SkySea

Product	Event Types	MITRE TTP	Content
ClientView	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity security-alert share-access web-activity-allowed web-activity-denied	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1569.002 - T1569.002	38 Rules 11 Models

Vendor: Slack

Product	Event Types	MITRE TTP	Content
BeyondTrust Secure Remote Access	app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Epic SIEM	app-activity failed-physical-access file-delete file-write physical-access	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	7 Rules 2 Models
Exabeam Advanced Analytics	account-disabled account-enabled account-password-change account-unlocked app-activity app-login authentication-failed authentication-successful failed-app-login file-delete file-permission-change file-read file-write nac-logon security-alert	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	12 Rules 5 Models
Slack	account-password-change app-activity app-login authentication-failed authentication-successful failed-app-login file-delete file-download file-read file-upload file-write remote-logon	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	10 Rules 3 Models

Vendor: Snort

Product	Event Types	MITRE TTP	Content
Snort	network-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Sonicwall

Product	Event Types	MITRE TTP	Content
Sonicwall	authentication-failed authentication-successful failed-vpn-login remote-logon vpn-login vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	5 Rules 2 Models

Vendor: Sophos

Product	Event Types	MITRE TTP	Content
Sophos Endpoint Protection	app-activity-failed dlp-alert failed-usb-activity file-alert network-alert network-connection-failed security-alert usb-insert usb-write	T1071 - Application Layer Protocol T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	8 Rules 4 Models
Sophos Firewall	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
Sophos Invincea	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Sophos SafeGuard	app-activity app-activity-failed	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Sophos UTM	web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	22 Rules 5 Models
Sophos XG Firewall	dlp-alert failed-vpn-login network-connection-failed network-connection-successful security-alert vpn-login vpn-logout web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	29 Rules 9 Models

Vendor: Splunk

Product	Event Types	MITRE TTP	Content
Splunk Stream	computer-logon dns-query dns-response	T1071.004 - Application Layer Protocol: DNS T1568.002 - Dynamic Resolution: Domain Generation Algorithms	4 Rules

Vendor: Squid

Product	Event Types	MITRE TTP	Content
Squid	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: StealthBits

Product	Event Types	MITRE TTP	Content
StealthIntercept	account-disabled account-enabled ds-access failed-ds-access file-permission-change file-read file-write member-added member-removed	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution T1207 - Rogue Domain Controller	7 Rules 2 Models

Vendor: Sun One

Product	Event Types	MITRE TTP	Content
LDAP	authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	1 Rules

Vendor: Suricata

Product	Event Types	MITRE TTP	Content
Suricata	network-alert	T1204 - User Execution	4 Rules 2 Models
Suricata IDS	network-alert remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: Swift

Product	Event Types	MITRE TTP	Content
Swift	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Swipes

Product	Event Types	MITRE TTP	Content
Sonicwall	failed-vpn-login remote-logon vpn-login vpn-logout	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	5 Rules 2 Models

Vendor: Swivel

Product	Event Types	MITRE TTP	Content
Swivel	app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Symantec

Product	Event Types	MITRE TTP	Content
Symantec Advanced Threat Protection	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Symantec Blue Coat Content Analysis System	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Symantec Blue Coat ProxySG Appliance	network-connection-failed web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Symantec CloudSOC	app-activity app-login dlp-alert failed-app-login file-delete file-download file-upload	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models
Symantec Critical System Protection	account-switch failed-logon local-logon	T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	6 Rules 2 Models
Symantec DLP	config-change dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon failed-usb-activity member-added member-removed network-alert process-alert security-alert usb-activity usb-insert usb-read usb-write	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	15 Rules 8 Models
Symantec EDR	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Symantec Email Security.cloud	dlp-email-alert-in dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Symantec Endpoint Protection	app-activity network-alert network-connection-failed network-connection-successful process-alert security-alert	T1071 - Application Layer Protocol T1078 - Valid Accounts T1204 - User Execution	15 Rules 8 Models
Symantec Fireglass	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models
Symantec Managed Security Services	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Symantec VIP	app-activity app-activity-failed authentication-failed authentication-successful	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Symantec WSS	web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	25 Rules 6 Models

Vendor: Synology NAS

Product	Event Types	MITRE TTP	Content
Synology NAS	share-access	T1569 - System Services T1569.002 - T1569.002	2 Rules

Vendor: Tanium

Product	Event Types	MITRE TTP	Content
Endpoint Platform	authentication-failed authentication-successful dns-response process-created security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	210 Rules 29 Models
Threat Response	process-alert	T1204 - User Execution	9 Rules 6 Models

Vendor: Tenable.io

Product	Event Types	MITRE TTP	Content
Tenable.io	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Thycotic Secret Server

Product	Event Types	MITRE TTP	Content
Thycotic Secret Server	account-switch app-activity app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models

Vendor: TrapX

Product	Event Types	MITRE TTP	Content
TrapX	network-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: Trend Micro

Product	Event Types	MITRE TTP	Content
Cloud App Security	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Deep Discovery Email Inspector	dlp-alert dlp-email-alert-in	T1204 - User Execution	4 Rules 2 Models
Deep Discovery Inspector	account-password-change app-login security-alert	T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models
Deep Security Agent	security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
OfficeScan	dlp-alert dlp-email-alert-in dlp-email-alert-out privileged-object-access security-alert usb-write web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	28 Rules 10 Models
Trend Micro	database-failed-login network-connection-failed network-connection-successful security-alert	T1071 - Application Layer Protocol T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models
Trend Micro Apex One	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Trend Micro TippingPoint NGIPS	network-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models

Vendor: Tripwire Enterprise

Product	Event Types	MITRE TTP	Content
Tripwire Enterprise	file-alert	T1204 - User Execution	2 Rules 1 Models

Vendor: Tufin

Product	Event Types	MITRE TTP	Content
SecureTrack	authentication-successful	T1078 - Valid Accounts	1 Rules

Vendor: Tyco

Product	Event Types	MITRE TTP	Content
CCURE Building Management System	app-activity app-login failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Unix

Product	Event Types	MITRE TTP	Content
Auditbeat	app-activity app-activity-failed authentication-successful process-created process-network process-network-failed	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	206 Rules 26 Models
CDS	failed-logon remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	6 Rules 2 Models
FTP	app-activity app-activity-failed	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Unix	account-creation account-deleted account-lockout account-password-change account-switch authentication-failed authentication-successful batch-logon computer-logon dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon file-delete file-read file-write kerberos-logon local-logon member-added member-removed process-created process-created-failed remote-access remote-logon security-alert task-created	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	223 Rules 37 Models
Unix Auditd	account-deleted account-password-change account-switch app-activity-failed authentication-failed authentication-successful failed-logon file-read file-write local-logon member-added member-removed process-created process-created-failed remote-logon security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1090.003 - Proxy: Multi-hop Proxy T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	213 Rules 29 Models
Unix Privilege Management	account-switch	T1204 - User Execution	4 Rules 2 Models

Vendor: VMware

Product	Event Types	MITRE TTP	Content
NSX FW	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
VMWare ID Manager (VIDM)	privileged-object-access	T1204 - User Execution	4 Rules 2 Models
VMware Carbon Black App Control	app-login file-alert file-delete file-download file-read file-write local-logon network-connection-failed network-connection-successful process-alert process-created process-created-failed process-network security-alert usb-insert workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1071 - Application Layer Protocol T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	213 Rules 31 Models
VMware Carbon Black Cloud Endpoint Standard	file-read file-write network-alert network-connection-successful process-created security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	211 Rules 29 Models
VMware Carbon Black EDR	process-alert process-created security-alert	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1086 - Command and Scripting Interpreter: PowerShell T1093 - Process Injection: Process Hollowing T1105 - Ingress Tool Transfer T1112 - Modify Registry T1117 - T1117 T1118 - T1118 T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1170 - T1170 T1171 - T1171 T1175 - T1175 T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1223 - T1223 T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	207 Rules 31 Models
VMware ESXi	remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models
VMware Horizon	authentication-failed remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	5 Rules 2 Models
VMware NSX	network-connection-failed network-connection-successful	T1071 - Application Layer Protocol	1 Rules
VMware VCenter	app-activity app-login failed-logon remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services	7 Rules 2 Models
VMware View	account-password-change app-activity app-login failed-app-login remote-logon	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	6 Rules 2 Models

Vendor: Varonis

Product	Event Types	MITRE TTP	Content
Data Security Platform	authentication-failed authentication-successful dlp-alert file-delete file-permission-change file-read file-write vpn-login vpn-logout	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution	9 Rules 3 Models

Vendor: Vectra

Product	Event Types	MITRE TTP	Content
Vectra Cognito Detect	app-activity security-alert	T1078 - Valid Accounts T1204 - User Execution	7 Rules 4 Models

Vendor: Virtru

Product	Event Types	MITRE TTP	Content
Virtru	dlp-alert	T1204 - User Execution	4 Rules 2 Models

Vendor: Vormetric

Product	Event Types	MITRE TTP	Content
Vormetric	file-alert file-read	T1204 - User Execution	2 Rules 1 Models

Vendor: Watchguard

Product	Event Types	MITRE TTP	Content
Malwarebytes Incident Response	network-alert security-alert	T1078 - Valid Accounts T1204 - User Execution	6 Rules 4 Models
Watchguard	security-alert web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	31 Rules 10 Models

Vendor: Weblogin

Product	Event Types	MITRE TTP	Content
NetApp	file-delete file-read file-write	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1085 - Signed Binary Proxy Execution: Rundll32 T1204 - User Execution	6 Rules 2 Models
Weblogin	web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	22 Rules 6 Models

Vendor: Websense Secure Gateway

Product	Event Types	MITRE TTP	Content
Websense Secure Gateway	web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	22 Rules 6 Models

Vendor: Workday

Product	Event Types	MITRE TTP	Content
Workday	app-activity app-login authentication-failed failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Xceedium

Product	Event Types	MITRE TTP	Content
Xceedium	app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: Zeek

Product	Event Types	MITRE TTP	Content
Zeek Network Security Monitor	app-activity authentication-failed authentication-successful computer-logon dlp-email-alert-in dlp-email-alert-out dns-query dns-response failed-logon file-delete file-read file-write kerberos-logon nac-failed-logon nac-logon network-alert network-connection-failed network-connection-successful ntlm-logon remote-access remote-logon share-access web-activity-allowed web-activity-denied	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1085 - Signed Binary Proxy Execution: Rundll32 T1090.003 - Proxy: Multi-hop Proxy T1204 - User Execution T1210 - Exploitation of Remote Services T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1569.002 - T1569.002	42 Rules 9 Models

Vendor: Zlock

Product	Event Types	MITRE TTP	Content
Zlock	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: Zscaler

Product	Event Types	MITRE TTP	Content
Zscaler Internet Access	app-login dlp-alert network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1204 - User Execution T1550.002 - Use Alternate Authentication Material: Pass the Hash T1568.002 - Dynamic Resolution: Domain Generation Algorithms	30 Rules 8 Models
Zscaler Private Access	vpn-login vpn-logout	T1078 - Valid Accounts	1 Rules

Vendor: eDocs

Product	Event Types	MITRE TTP	Content
eDocs	app-activity	T1078 - Valid Accounts	1 Rules

Vendor: iManage

Product	Event Types	MITRE TTP	Content
iManage	app-activity dlp-alert	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models

Vendor: oVirt

Product	Event Types	MITRE TTP	Content
oVirt	app-activity app-activity-failed app-login failed-app-login	T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	2 Rules

Vendor: pfSense

Product	Event Types	MITRE TTP	Content
pfSense	network-connection-failed	T1071 - Application Layer Protocol	1 Rules

Vendor: xsuite

Product	Event Types	MITRE TTP	Content
xsuite	remote-logon	T1078 - Valid Accounts T1204 - User Execution	5 Rules 2 Models