2_ds_vmware_vmware_view.md

Use-Case	Event Types/Parsers	MITRE TTP	Content
Brute Force Attack	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1078 - Valid Accounts	1 Rules 1 Models
Compromised Credentials	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1078 - Valid Accounts T1078.002 - T1078.002 T1133 - External Remote Services T1558 - Steal or Forge Kerberos Tickets	15 Rules 8 Models
Data Access	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1078 - Valid Accounts	5 Rules 4 Models
Evasion	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Lateral Movement	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1021 - Remote Services T1078 - Valid Accounts T1550 - Use Alternate Authentication Material T1550.002 - Use Alternate Authentication Material: Pass the Hash T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting	16 Rules 7 Models
Malware	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1078 - Valid Accounts T1204 - User Execution	3 Rules 2 Models
Privilege Abuse	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation	13 Rules 6 Models
Privilege Escalation	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1021.002 - Remote Services: SMB/Windows Admin Shares T1078 - Valid Accounts T1087 - Account Discovery	3 Rules 3 Models
Privileged Activity	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1021 - Remote Services T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts	10 Rules 4 Models
Ransomware	account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity	T1078 - Valid Accounts	2 Rules