| Compromised Credentials | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1020 - Automated Exfiltration
T1071 - Application Layer Protocol
T1078 - Valid Accounts
T1133 - External Remote Services
| |
| Data Access | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
| |
| Data Leak | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1048 - Exfiltration Over Alternative Protocol
T1114.003 - Email Collection: Email Forwarding Rule
| |
| Evasion | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1090.003 - Proxy: Multi-hop Proxy
| |
| Malware | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
| |
| Physical Security | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
| |
| Privilege Abuse | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Privilege Escalation | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Privileged Activity | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Ransomware | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
| |
| Workforce Protection | app-activity
↳q-oam-app-login
↳s-oam-app-login
app-login
↳s-oam-app-login-1
↳s-oam-app-login
authentication-successful
↳oracle-access-manager
failed-app-login
↳q-oam-auth-successful
failed-physical-access
↳q-oam-app-activity-5
↳q-oam-app-activity-4
↳q-oam-app-activity-7
↳q-oam-app-activity-6
↳q-oam-app-activity-10
↳q-oam-app-activity-9
↳q-oam-app-activity-11
↳q-oam-app-activity-8
↳q-oam-app-activity-12
↳q-oam-app-activity-3
↳q-oam-app-activity-2
physical-access
↳oracle-access-manager
| T1078 - Valid Accounts
| |