Vendor: VMware
July 25, 2023 · View on GitHub
Product: VMware View
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 107 | 46 | 17 | 5 | 5 |
| Use-Case | Event Types/Parsers | MITRE TTP | Content |
|---|---|---|---|
| Abnormal Authentication & Access | account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity | T1021 - Remote Services T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services |
|
| Account Manipulation | account-password-change ↳vmware-view-remote-logon app-login ↳vmware-view-failed-login authentication-failed ↳vmware-view-remote-logon-1 failed-app-login ↳vmware-view-password-change remote-logon ↳vmware-view-login ↳vmware-view-app-login ↳vmware-view-app-activity | T1098 - Account Manipulation |
|
| Next Page -->> |
ATT&CK Matrix for Enterprise
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| External Remote Services Valid Accounts | User Execution | External Remote Services Valid Accounts Account Manipulation | Valid Accounts Exploitation for Privilege Escalation | Valid Accounts Use Alternate Authentication Material Use Alternate Authentication Material: Pass the Hash Valid Accounts: Local Accounts | Steal or Forge Kerberos Tickets Steal or Forge Kerberos Tickets: Kerberoasting | Account Discovery | Remote Services Remote Services: SMB/Windows Admin Shares Use Alternate Authentication Material | Proxy: Multi-hop Proxy Application Layer Protocol Proxy | Automated Exfiltration |