Vendor: Apache
July 25, 2023 · View on GitHub
Product: Cassandra
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 38 | 15 | 8 | 3 | 3 |
| Use-Case | Event Types/Parsers | MITRE TTP | Content |
|---|---|---|---|
| Compromised Credentials | database-login ↳cassandra-db-update database-update ↳cassandra-db-activity-failed security-alert ↳cassandra-db-login | T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1213 - Data from Information Repositories |
|
| Data Access | database-login ↳cassandra-db-update database-update ↳cassandra-db-activity-failed security-alert ↳cassandra-db-login | T1213 - Data from Information Repositories |
|
| Lateral Movement | database-login ↳cassandra-db-update database-update ↳cassandra-db-activity-failed security-alert ↳cassandra-db-login | T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools |
|
| Malware | database-login ↳cassandra-db-update database-update ↳cassandra-db-activity-failed security-alert ↳cassandra-db-login | T1078 - Valid Accounts T1204 - User Execution |
|
| Privilege Escalation | database-login ↳cassandra-db-update database-update ↳cassandra-db-activity-failed security-alert ↳cassandra-db-login | T1021.002 - Remote Services: SMB/Windows Admin Shares T1087 - Account Discovery |
|
| Privileged Activity | database-login ↳cassandra-db-update database-update ↳cassandra-db-activity-failed security-alert ↳cassandra-db-login | T1068 - Exploitation for Privilege Escalation |
|
ATT&CK Matrix for Enterprise
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| External Remote Services Valid Accounts | User Execution | External Remote Services Valid Accounts | Valid Accounts Exploitation for Privilege Escalation | Obfuscated Files or Information: Indicator Removal from Tools Valid Accounts Obfuscated Files or Information | Account Discovery | Remote Services Remote Services: SMB/Windows Admin Shares | Data from Information Repositories |