Vendor: Microsoft

Product: Sysmon

Rules	Models	MITRE TTPs	Event Types	Parsers
653	127	117	6	6

Use-Case	Event Types/Parsers	MITRE TTP	Content
Abnormal Authentication & Access	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	32 Rules 17 Models
Account Manipulation	app-activity ↳sysmon-file-delete ↳xml-sysmon-alert dns-response ↳xml-sysmon-dns-query file-delete ↳sysmon-image-loaded process-created ↳raw-sysmon-process-network ↳json-sysmon-process-network ↳sysmon-process-network ↳cef-sysmon-process-network process-network ↳xml-sysmon-process-created-2 ↳xml-sysmon-process-created-1 ↳sysmon-process-created ↳l-sysmon-process-created ↳json-sysmon-process-created ↳cef-sysmon-process-created ↳sysmon-process-created-2 ↳sysmon-process-created-1 ↳xml-sysmon-process-created ↳json-sysmon-process-created-1 ↳json-sysmon-file-create ↳json-sysmon-file-create-1 ↳cef-sysmon-file-write-1 ↳l-sysmon-file-create ↳sysmon-file-create ↳xml-sysmon-file-write web-activity-denied ↳sysmon-registry-set-1 ↳sysmon-registry-set-2 ↳sysmon-registry-set ↳cef-sysmon-file-write-2	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	22 Rules 9 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Phishing: Spearphishing Link External Remote Services Valid Accounts Drive-by Compromise Exploit Public Fasing Application Phishing	Windows Management Instrumentation Command and Scripting Interperter Scheduled Task/Job Scripting System Services Exploitation for Client Execution User Execution Scheduled Task/Job: Scheduled Task Command and Scripting Interperter: PowerShell Scheduled Task/Job: At (Windows)	Pre-OS Boot Create Account Create or Modify System Process External Remote Services Valid Accounts Hijack Execution Flow Server Software Component: Web Shell Account Manipulation BITS Jobs Create or Modify System Process: Windows Service Scheduled Task/Job Server Software Component Event Triggered Execution Traffic Signaling Boot or Logon Autostart Execution Create Account: Create: Local Account Account Manipulation: Exchange Email Delegate Permissions	Access Token Manipulation: Token Impersonation/Theft Create or Modify System Process Valid Accounts Access Token Manipulation Exploitation for Privilege Escalation Hijack Execution Flow Process Injection Scheduled Task/Job Abuse Elevation Control Mechanism Event Triggered Execution Boot or Logon Autostart Execution Process Injection: Dynamic-link Library Injection Abuse Elevation Control Mechanism: Bypass User Account Control	Hide Artifacts Indirect Command Execution Impair Defenses Indicator Removal on Host: Clear Windows Event Logs Traffic Signaling Trusted Developer Utilities Proxy Execution Masquerading: Match Legitimate Name or Location Masquerading: Rename System Utilities File and Directory Permissions Modification: Windows File and Directory Permissions Modification Obfuscated Files or Information: Compile After Delivery Hijack Execution Flow: DLL Side-Loading Indicator Removal on Host: File Deletion Masquerading Valid Accounts Modify Registry BITS Jobs Hide Artifacts: NTFS File Attributes Indicator Removal on Host Pre-OS Boot File and Directory Permissions Modification XSL Script Processing Deobfuscate/Decode Files or Information Abuse Elevation Control Mechanism Impair Defenses: Disable or Modify System Firewall Obfuscated Files or Information Signed Binary Proxy Execution: Compiled HTML File Access Token Manipulation Exploitation for Defense Evasion Hijack Execution Flow Process Injection Signed Binary Proxy Execution: Msiexec Signed Binary Proxy Execution Signed Binary Proxy Execution: Regsvcs/Regasm Signed Binary Proxy Execution: CMSTP Signed Binary Proxy Execution: Control Panel Signed Binary Proxy Execution: InstallUtil Signed Binary Proxy Execution: Regsvr32 Trusted Developer Utilities Proxy Execution: MSBuild Signed Binary Proxy Execution: Rundll32	OS Credential Dumping Input Capture Unsecured Credentials Man-in-the-Middle Steal or Forge Kerberos Tickets Steal or Forge Kerberos Tickets: Kerberoasting Network Sniffing	Network Service Scanning Account Discovery Domain Trust Discovery Account Discovery: Local Account Account Discovery: Domain Account File and Directory Discovery Network Sniffing System Information Discovery Network Share Discovery Query Registry Process Discovery System Owner/User Discovery System Network Configuration Discovery	Exploitation of Remote Services Remote Services Remote Services: SMB/Windows Admin Shares Remote Services: Remote Desktop Protocol	Email Collection Input Capture Audio Capture Archive Collected Data Man-in-the-Middle Email Collection: Email Forwarding Rule	Web Service Non-Standard Port Data Encoding Application Layer Protocol: DNS Data Encoding: Standard Encoding Application Layer Protocol: Web Protocols Remote Access Software Dynamic Resolution Traffic Signaling Ingress Tool Transfer Dynamic Resolution: Domain Generation Algorithms Proxy: Multi-hop Proxy Proxy: External Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Data Transfer Size Limits Automated Exfiltration Exfiltration Over Web Service: Exfiltration to Cloud Storage Exfiltration Over Web Service	Account Access Removal Resource Hijacking Inhibit System Recovery