Vendor: Oracle

July 25, 2023 · View on GitHub

Product: Access Manager

RulesModelsMITRE TTPsEvent TypesParsers
7430855
Use-CaseEvent Types/ParsersMITRE TTPContent
Abnormal Authentication & Accessapp-activity
q-oam-app-login
s-oam-app-login

app-login
s-oam-app-login-1
s-oam-app-login

authentication-successful
oracle-access-manager

failed-app-login
q-oam-auth-successful

failed-physical-access
q-oam-app-activity-5
q-oam-app-activity-4
q-oam-app-activity-7
q-oam-app-activity-6
q-oam-app-activity-10
q-oam-app-activity-9
q-oam-app-activity-11
q-oam-app-activity-8
q-oam-app-activity-12
q-oam-app-activity-3
q-oam-app-activity-2

physical-access
oracle-access-manager
T1078 - Valid Accounts
T1133 - External Remote Services
  • 32 Rules
  • 15 Models
Account Manipulationapp-activity
q-oam-app-login
s-oam-app-login

app-login
s-oam-app-login-1
s-oam-app-login

authentication-successful
oracle-access-manager

failed-app-login
q-oam-auth-successful

failed-physical-access
q-oam-app-activity-5
q-oam-app-activity-4
q-oam-app-activity-7
q-oam-app-activity-6
q-oam-app-activity-10
q-oam-app-activity-9
q-oam-app-activity-11
q-oam-app-activity-8
q-oam-app-activity-12
q-oam-app-activity-3
q-oam-app-activity-2

physical-access
oracle-access-manager
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy

Exfiltration Over Alternative Protocol

Automated Exfiltration