Vendor: Accellion

July 25, 2023 · View on GitHub

Product: Kiteworks

RulesModelsMITRE TTPsEvent TypesParsers
16868241515
Use-CaseEvent Types/ParsersMITRE TTPContent
Abnormal Authentication & Accessaccount-password-change
q-kiteworks-email-out
accelion-kite-app-activity-email-alert
q-kiteworks-email-out-1

account-password-reset
kiteworks-account-unlocked-1
kiteworks-account-unlocked-2

account-unlocked
kiteworks-account-lockout-1

app-activity
accelion-kite-failed-app-login
kiteworks-failed-app-login-1

app-login
accelion-kite-app-activity-5
q-kiteworks-app-activity
accelion-kite-app-activity-2
accelion-kite-app-activity-4
accelion-kite-app-activity-3
accelion-kite-app-delete-draft
accelion-kite-app-setting
accelion-kite-app-user-delete
q-kiteworks-app-activity-4
q-kiteworks-app-activity-5
accelion-kite-app-network-setting
accelion-kite-app-file-withdraw
q-kiteworks-app-activity-1
q-kiteworks-app-activity-2
q-kiteworks-app-activity-3
accelion-kite-app-system
accelion-kite-app-3

dlp-email-alert-out
accelion-kite-app-login-1
q-kiteworks-app-login-1
accelion-kite-app-admin-login
q-kiteworks-app-login

failed-app-login
accelion-kite-app-reset-password

file-alert
q-kiteworks-file-upload
q-kiteworks-file-upload-1
accelion-kite-app-3

file-delete
q-kiteworks-file-write

file-download
accelion-kite-app-activity-6
q-kiteworks-file-read
q-kiteworks-file-read-1

file-permission-change
accelion-kite-app-password-change
q-kiteworks-password-change
kiteworks-password-change-1

file-read
q-kiteworks-file-delete
accelion-kite-app-file-delete
accelion-kite-app-file-delete-1

file-upload
q-kiteworks-file-download-2
q-kiteworks-file-download-1
accelion-kite-app-download-1
q-kiteworks-file-download
accelion-kite-app-download

file-write
q-kiteworks-file-permission-change

security-alert
accelion-dlp-alert
T1078 - Valid Accounts
T1133 - External Remote Services
  • 31 Rules
  • 14 Models
Account Manipulationaccount-password-change
q-kiteworks-email-out
accelion-kite-app-activity-email-alert
q-kiteworks-email-out-1

account-password-reset
kiteworks-account-unlocked-1
kiteworks-account-unlocked-2

account-unlocked
kiteworks-account-lockout-1

app-activity
accelion-kite-failed-app-login
kiteworks-failed-app-login-1

app-login
accelion-kite-app-activity-5
q-kiteworks-app-activity
accelion-kite-app-activity-2
accelion-kite-app-activity-4
accelion-kite-app-activity-3
accelion-kite-app-delete-draft
accelion-kite-app-setting
accelion-kite-app-user-delete
q-kiteworks-app-activity-4
q-kiteworks-app-activity-5
accelion-kite-app-network-setting
accelion-kite-app-file-withdraw
q-kiteworks-app-activity-1
q-kiteworks-app-activity-2
q-kiteworks-app-activity-3
accelion-kite-app-system
accelion-kite-app-3

dlp-email-alert-out
accelion-kite-app-login-1
q-kiteworks-app-login-1
accelion-kite-app-admin-login
q-kiteworks-app-login

failed-app-login
accelion-kite-app-reset-password

file-alert
q-kiteworks-file-upload
q-kiteworks-file-upload-1
accelion-kite-app-3

file-delete
q-kiteworks-file-write

file-download
accelion-kite-app-activity-6
q-kiteworks-file-read
q-kiteworks-file-read-1

file-permission-change
accelion-kite-app-password-change
q-kiteworks-password-change
kiteworks-password-change-1

file-read
q-kiteworks-file-delete
accelion-kite-app-file-delete
accelion-kite-app-file-delete-1

file-upload
q-kiteworks-file-download-2
q-kiteworks-file-download-1
accelion-kite-app-download-1
q-kiteworks-file-download
accelion-kite-app-download

file-write
q-kiteworks-file-permission-change

security-alert
accelion-dlp-alert
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 4 Rules
  • 1 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

User Execution

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Exploitation for Privilege Escalation

Process Injection

Obfuscated Files or Information: Indicator Removal from Tools

Indicator Removal on Host: File Deletion

Valid Accounts

Indicator Removal on Host

Obfuscated Files or Information

Process Injection

Signed Binary Proxy Execution

Signed Binary Proxy Execution: Rundll32

OS Credential Dumping

Account Discovery

File and Directory Discovery

Remote Services

Remote Services: SMB/Windows Admin Shares

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy

Exfiltration Over Alternative Protocol

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Automated Exfiltration

Data Encrypted for Impact