Vendor: Code42
July 25, 2023 · View on GitHub
Product: Code42 Incydr
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 90 | 36 | 16 | 7 | 7 |
ATT&CK Matrix for Enterprise
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | User Execution | Valid Accounts | Valid Accounts Process Injection | Indicator Removal on Host: File Deletion Valid Accounts Indicator Removal on Host Obfuscated Files or Information Process Injection Signed Binary Proxy Execution Signed Binary Proxy Execution: Rundll32 | OS Credential Dumping | File and Directory Discovery | Email Collection | Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Over Physical Medium: Exfiltration over USB Exfiltration Over Physical Medium Automated Exfiltration | Data Encrypted for Impact |