2_ds_code42_code42_incydr.md

Use-Case	Event Types/Parsers	MITRE TTP	Content
Data Exfiltration	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1048 - Exfiltration Over Alternative Protocol T1204 - User Execution	3 Rules 2 Models
Data Leak	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1020 - Automated Exfiltration T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1114.001 - T1114.001	46 Rules 19 Models
Destruction of Data	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1070.004 - Indicator Removal on Host: File Deletion	1 Rules
Malware	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1055.012 - T1055.012 T1204 - User Execution T1218.011 - Signed Binary Proxy Execution: Rundll32	6 Rules 3 Models
Phishing	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	12 Rules 6 Models
Privilege Abuse	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1078 - Valid Accounts	2 Rules
Privileged Activity	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1078 - Valid Accounts	2 Rules
Ransomware	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1486 - Data Encrypted for Impact	1 Rules
Workforce Protection	dlp-email-alert-out ↳code42-print-operations file-delete ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-file-operations-4 ↳code42-file-operations-2 ↳code42-file-operations-3 ↳code42-file-operations file-download ↳code42-file-operations-2 ↳code42-file-operations-3 file-read ↳code42-file-operations-2 ↳code42-file-operations-3 file-upload ↳code42-usb-insert file-write ↳code42-file-operations-4 ↳code42-file-operations-3 ↳code42-file-operations ↳code42-email-out-operations usb-insert ↳code42-usb-removed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 2 Models