| Audit Tampering | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1047 - Windows Management Instrumentation
T1070 - Indicator Removal on Host
T1070.001 - Indicator Removal on Host: Clear Windows Event Logs
| |
| Brute Force Attack | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1078 - Valid Accounts
T1110 - Brute Force
| |
| Compromised Credentials | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1003 - OS Credential Dumping
T1003.003 - T1003.003
T1016 - System Network Configuration Discovery
T1020 - Automated Exfiltration
T1036 - Masquerading
T1040 - Network Sniffing
T1059.001 - Command and Scripting Interperter: PowerShell
T1071 - Application Layer Protocol
T1078 - Valid Accounts
T1078.002 - T1078.002
T1133 - External Remote Services
T1213 - Data from Information Repositories
T1547.004 - T1547.004
T1558 - Steal or Forge Kerberos Tickets
| |
| Cryptomining | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1496 - Resource Hijacking
| |
| Data Access | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1003 - OS Credential Dumping
T1078 - Valid Accounts
T1213 - Data from Information Repositories
| |
| Data Exfiltration | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1003 - OS Credential Dumping
T1020 - Automated Exfiltration
T1040 - Network Sniffing
T1048 - Exfiltration Over Alternative Protocol
T1059 - Command and Scripting Interperter
T1071 - Application Layer Protocol
T1105 - Ingress Tool Transfer
T1204 - User Execution
T1505.003 - Server Software Component: Web Shell
T1552.001 - T1552.001
T1560 - Archive Collected Data
| |
| Data Leak | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1020 - Automated Exfiltration
T1048 - Exfiltration Over Alternative Protocol
T1071 - Application Layer Protocol
T1114.003 - Email Collection: Email Forwarding Rule
T1204 - User Execution
| |
| Evasion | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
| |
| Lateral Movement | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1021 - Remote Services
T1021.001 - Remote Services: Remote Desktop Protocol
T1021.002 - Remote Services: SMB/Windows Admin Shares
T1021.003 - T1021.003
T1047 - Windows Management Instrumentation
T1059 - Command and Scripting Interperter
T1078 - Valid Accounts
T1083 - File and Directory Discovery
T1090 - Proxy
T1110 - Brute Force
T1135 - Network Share Discovery
T1175 - T1175
T1190 - Exploit Public Fasing Application
T1210 - Exploitation of Remote Services
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1219 - Remote Access Software
T1550 - Use Alternate Authentication Material
T1550.002 - Use Alternate Authentication Material: Pass the Hash
T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1550.004 - Use Alternate Authentication Material: Web Session Cookie
T1558 - Steal or Forge Kerberos Tickets
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
| |
| Malware | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1003 - OS Credential Dumping
T1003.002 - T1003.002
T1012 - Query Registry
T1021 - Remote Services
T1027 - Obfuscated Files or Information
T1027.004 - Obfuscated Files or Information: Compile After Delivery
T1036 - Masquerading
T1036.005 - Masquerading: Match Legitimate Name or Location
T1046 - Network Service Scanning
T1047 - Windows Management Instrumentation
T1053 - Scheduled Task/Job
T1053.005 - Scheduled Task/Job: Scheduled Task
T1055 - Process Injection
T1055.012 - T1055.012
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1059.002 - T1059.002
T1059.003 - T1059.003
T1059.004 - T1059.004
T1059.005 - T1059.005
T1059.006 - T1059.006
T1064 - Scripting
T1070.005 - T1070.005
T1078 - Valid Accounts
T1105 - Ingress Tool Transfer
T1112 - Modify Registry
T1123 - Audio Capture
T1127 - Trusted Developer Utilities Proxy Execution
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1134.001 - Access Token Manipulation: Token Impersonation/Theft
T1140 - Deobfuscate/Decode Files or Information
T1175 - T1175
T1197 - BITS Jobs
T1202 - Indirect Command Execution
T1203 - Exploitation for Client Execution
T1204 - User Execution
T1210 - Exploitation of Remote Services
T1218 - Signed Binary Proxy Execution
T1218.001 - Signed Binary Proxy Execution: Compiled HTML File
T1218.002 - Signed Binary Proxy Execution: Control Panel
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.005 - T1218.005
T1218.007 - Signed Binary Proxy Execution: Msiexec
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1220 - XSL Script Processing
T1490 - Inhibit System Recovery
T1505.003 - Server Software Component: Web Shell
T1543.003 - Create or Modify System Process: Windows Service
T1546.001 - T1546.001
T1547.001 - T1547.001
T1557.001 - T1557.001
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1566.001 - T1566.001
T1569 - System Services
T1574 - Hijack Execution Flow
T1574.002 - Hijack Execution Flow: DLL Side-Loading
T1574.010 - T1574.010
T1574.011 - T1574.011
| |
| Privilege Abuse | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1047 - Windows Management Instrumentation
T1078 - Valid Accounts
T1078.002 - T1078.002
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1136.001 - Create Account: Create: Local Account
T1531 - Account Access Removal
| |
| Privilege Escalation | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1003 - OS Credential Dumping
T1012 - Query Registry
T1016 - System Network Configuration Discovery
T1021.002 - Remote Services: SMB/Windows Admin Shares
T1027.004 - Obfuscated Files or Information: Compile After Delivery
T1033 - System Owner/User Discovery
T1047 - Windows Management Instrumentation
T1053.002 - Scheduled Task/Job: At (Windows)
T1053.005 - Scheduled Task/Job: Scheduled Task
T1055 - Process Injection
T1055.001 - Process Injection: Dynamic-link Library Injection
T1056.004 - T1056.004
T1057 - Process Discovery
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1068 - Exploitation for Privilege Escalation
T1070.004 - Indicator Removal on Host: File Deletion
T1078 - Valid Accounts
T1082 - System Information Discovery
T1087 - Account Discovery
T1087.001 - Account Discovery: Local Account
T1087.002 - Account Discovery: Domain Account
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1134.001 - Access Token Manipulation: Token Impersonation/Theft
T1210 - Exploitation of Remote Services
T1218.003 - Signed Binary Proxy Execution: CMSTP
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification
T1482 - Domain Trust Discovery
T1543.003 - Create or Modify System Process: Windows Service
T1547.006 - T1547.006
T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control
T1560 - Archive Collected Data
T1574.002 - Hijack Execution Flow: DLL Side-Loading
| |
| Privileged Activity | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1021 - Remote Services
T1068 - Exploitation for Privilege Escalation
T1078 - Valid Accounts
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Ransomware | account-creation
↳unix-auditd-account-created-id
↳unix-auditd-account-deleted
account-deleted
↳unix-auditd-member-added
↳unix-auditd-member-added-2
↳unix-auditd-member-added-3
app-activity
↳cef-unix-ssh-disconnect
authentication-failed
↳cef-unix-user-cmd-1
↳cef-unix-process-1
↳cef-unix-exe-1
authentication-successful
↳cef-unix-authentication-1
↳unix-auditd-login-1
config-change
↳cef-unix-auditd-login
database-login
↳cef-unix-user-start-1
↳cef-unix-user-login-1
dlp-alert
↳cef-unix-su-2
↳cef-unix-su-1
↳unix-auditd-account-switch
↳unix-account-switch-1
↳unix-auditd-account-switch-1
↳auditd-unix-account-switch
failed-logon
↳unix-auditd-login
↳cef-unix-crypto-key-1
↳cef-unix-crypto-1
local-logon
↳cef-unix-local-logon
↳unix-local-logon-2
↳cef-unix-local-logon-2
↳cef-unix-local-logon-1
member-added
↳unix-auditd-member-removed
member-removed
↳unix-auditd-grp-pw-change
process-created
↳unix-process-created-failed
↳unix-process-creation-failure
process-created-failed
↳auditd-unix-process-created
↳cef-aix-process-created
↳unix-process-created-1
↳audit-unix-process-created
remote-logon
↳cef-unix-ssh-fail
↳cef-unix-authentication-1
↳unix-auditd-login-1
| T1003 - OS Credential Dumping
T1055 - Process Injection
T1070 - Indicator Removal on Host
T1070.004 - Indicator Removal on Host: File Deletion
T1078 - Valid Accounts
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1490 - Inhibit System Recovery
| |