2_ds_microsoft_sysmon.md

July 25, 2023 · View on GitHub

Use-Case	Event Types/Parsers	MITRE TTP	Content
Audit Tampering	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1047 - Windows Management Instrumentation T1070 - Indicator Removal on Host T1070.001 - Indicator Removal on Host: Clear Windows Event Logs	7 Rules
Compromised Credentials	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1016 - System Network Configuration Discovery T1020 - Automated Exfiltration T1036 - Masquerading T1040 - Network Sniffing T1059.001 - Command and Scripting Interperter: PowerShell T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1204.001 - T1204.001 T1547.004 - T1547.004 T1566.002 - Phishing: Spearphishing Link T1568.002 - Dynamic Resolution: Domain Generation Algorithms	114 Rules 39 Models
Cryptomining	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	5 Rules
Data Access	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery	39 Rules 21 Models
Data Exfiltration	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1020 - Automated Exfiltration T1030 - Data Transfer Size Limits T1040 - Network Sniffing T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1105 - Ingress Tool Transfer T1505.003 - Server Software Component: Web Shell T1552.001 - T1552.001 T1560 - Archive Collected Data T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution	21 Rules 2 Models
Data Leak	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1030 - Data Transfer Size Limits T1048 - Exfiltration Over Alternative Protocol T1071.001 - Application Layer Protocol: Web Protocols T1114.003 - Email Collection: Email Forwarding Rule T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage	7 Rules 2 Models
Destruction of Data	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1070.004 - Indicator Removal on Host: File Deletion	1 Rules
Evasion	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1027 - Obfuscated Files or Information T1036 - Masquerading T1036.003 - Masquerading: Rename System Utilities T1053 - Scheduled Task/Job T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1064 - Scripting T1070 - Indicator Removal on Host T1071.001 - Application Layer Protocol: Web Protocols T1090.003 - Proxy: Multi-hop Proxy T1090.004 - T1090.004 T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1132.001 - Data Encoding: Standard Encoding T1140 - Deobfuscate/Decode Files or Information T1202 - Indirect Command Execution T1204 - User Execution T1211 - Exploitation for Defense Evasion T1218.004 - Signed Binary Proxy Execution: InstallUtil T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm T1542.003 - T1542.003 T1543.003 - Create or Modify System Process: Windows Service T1562.004 - Impair Defenses: Disable or Modify System Firewall T1564.004 - Hide Artifacts: NTFS File Attributes	47 Rules
Lateral Movement	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1021.002 - Remote Services: SMB/Windows Admin Shares T1021.003 - T1021.003 T1047 - Windows Management Instrumentation T1059 - Command and Scripting Interperter T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1083 - File and Directory Discovery T1090 - Proxy T1090.002 - Proxy: External Proxy T1135 - Network Share Discovery T1175 - T1175 T1190 - Exploit Public Fasing Application T1205.001 - T1205.001 T1210 - Exploitation of Remote Services T1218.011 - Signed Binary Proxy Execution: Rundll32 T1219 - Remote Access Software T1571 - Non-Standard Port	85 Rules 19 Models
Malware	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.005 - Masquerading: Match Legitimate Name or Location T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1055.012 - T1055.012 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.002 - T1059.002 T1059.003 - T1059.003 T1059.004 - T1059.004 T1059.005 - T1059.005 T1059.006 - T1059.006 T1064 - Scripting T1070.005 - T1070.005 T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.004 - Application Layer Protocol: DNS T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy T1105 - Ingress Tool Transfer T1112 - Modify Registry T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1140 - Deobfuscate/Decode Files or Information T1175 - T1175 T1189 - Drive-by Compromise T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1204.001 - T1204.001 T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.001 - Signed Binary Proxy Execution: Compiled HTML File T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.004 - Signed Binary Proxy Execution: InstallUtil T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1220 - XSL Script Processing T1490 - Inhibit System Recovery T1505.003 - Server Software Component: Web Shell T1543.003 - Create or Modify System Process: Windows Service T1546.001 - T1546.001 T1547.001 - T1547.001 T1557.001 - T1557.001 T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1566.001 - T1566.001 T1566.002 - Phishing: Spearphishing Link T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011	276 Rules 43 Models
Phishing	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1071.001 - Application Layer Protocol: Web Protocols T1566.002 - Phishing: Spearphishing Link	3 Rules
Privilege Abuse	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1531 - Account Access Removal	20 Rules 10 Models
Privilege Escalation	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1012 - Query Registry T1016 - System Network Configuration Discovery T1027.004 - Obfuscated Files or Information: Compile After Delivery T1033 - System Owner/User Discovery T1047 - Windows Management Instrumentation T1053.002 - Scheduled Task/Job: At (Windows) T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1055.001 - Process Injection: Dynamic-link Library Injection T1056.004 - T1056.004 T1057 - Process Discovery T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1068 - Exploitation for Privilege Escalation T1070.004 - Indicator Removal on Host: File Deletion T1082 - System Information Discovery T1087 - Account Discovery T1087.001 - Account Discovery: Local Account T1087.002 - Account Discovery: Domain Account T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1218.003 - Signed Binary Proxy Execution: CMSTP T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification T1482 - Domain Trust Discovery T1543.003 - Create or Modify System Process: Windows Service T1547.006 - T1547.006 T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control T1560 - Archive Collected Data T1574.002 - Hijack Execution Flow: DLL Side-Loading	76 Rules 13 Models
Privileged Activity	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1102 - Web Service	5 Rules
Ransomware	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1055 - Process Injection T1070 - Indicator Removal on Host T1070.004 - Indicator Removal on Host: File Deletion T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1218.011 - Signed Binary Proxy Execution: Rundll32 T1490 - Inhibit System Recovery	11 Rules
Workforce Protection	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1071.001 - Application Layer Protocol: Web Protocols	1 Rules