2_ds_citrix_citrix_sharefile.md

Use-Case	Event Types/Parsers	MITRE TTP	Content
Cryptomining	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	3 Rules
Data Access	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1078 - Valid Accounts	5 Rules 4 Models
Data Exfiltration	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1030 - Data Transfer Size Limits T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution	5 Rules 2 Models
Data Leak	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1030 - Data Transfer Size Limits T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage	4 Rules 2 Models
Evasion	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071.001 - Application Layer Protocol: Web Protocols T1090.003 - Proxy: Multi-hop Proxy T1090.004 - T1090.004	7 Rules
Lateral Movement	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Malware	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1189 - Drive-by Compromise T1204.001 - T1204.001 T1566.002 - Phishing: Spearphishing Link T1568.002 - Dynamic Resolution: Domain Generation Algorithms	28 Rules 7 Models
Phishing	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071.001 - Application Layer Protocol: Web Protocols T1566.002 - Phishing: Spearphishing Link	3 Rules
Privilege Abuse	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1078 - Valid Accounts	3 Rules
Privileged Activity	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service	4 Rules
Ransomware	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	4 Rules
Workforce Protection	app-login ↳citrix-app-activity ↳citrix-app-activity-1 failed-app-login ↳citrix-app-login ↳citrix-app-login-2 file-download ↳citrix-app-login-fail-1 ↳citrix-app-login-fail-2 ↳citrix-app-login-fail file-upload ↳citrix-file-download web-activity-denied ↳citrix-file-upload	T1071.001 - Application Layer Protocol: Web Protocols	1 Rules