| Compromised Credentials | app-activity
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-app-activity-success-createddraft
↳accellion-kw-kv-app-activity-success-requestedafile
↳accellion-kw-kv-app-activity-success-viewedemailsubject
↳accellion-kw-kv-app-activity-success-userprofile
↳accellion-kw-kv-app-activity-success-draftchanged
↳accellion-kw-kv-app-activity-success-userdeleted
app-login
↳accellion-kw-str-app-login-success-sessionstarted
↳accellion-kw-mix-app-login-success-loggedin
failed-app-login
↳accellion-kw-kv-app-login-fail-userlogin
file-delete
↳accellion-kw-kv-file-delete-success-deletedfolder
file-permission-change
↳accellion-kw-kv-file-permission-modify-success-addednewpermission
file-read
↳accellion-kw-kv-file-read-success-viewfile
↳accellion-kw-kv-file-read-success-viewedfile
file-write
↳accellion-kw-kv-file-write-success-createdfolder
| T1003 - OS Credential Dumping
T1003.001 - T1003.001
T1003.002 - T1003.002
T1003.003 - T1003.003
T1078 - Valid Accounts
T1083 - File and Directory Discovery
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
| |
| Data Access | app-activity
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-app-activity-success-createddraft
↳accellion-kw-kv-app-activity-success-requestedafile
↳accellion-kw-kv-app-activity-success-viewedemailsubject
↳accellion-kw-kv-app-activity-success-userprofile
↳accellion-kw-kv-app-activity-success-draftchanged
↳accellion-kw-kv-app-activity-success-userdeleted
app-login
↳accellion-kw-str-app-login-success-sessionstarted
↳accellion-kw-mix-app-login-success-loggedin
failed-app-login
↳accellion-kw-kv-app-login-fail-userlogin
file-delete
↳accellion-kw-kv-file-delete-success-deletedfolder
file-permission-change
↳accellion-kw-kv-file-permission-modify-success-addednewpermission
file-read
↳accellion-kw-kv-file-read-success-viewfile
↳accellion-kw-kv-file-read-success-viewedfile
file-write
↳accellion-kw-kv-file-write-success-createdfolder
| T1078 - Valid Accounts
T1083 - File and Directory Discovery
| |
| Data Leak | app-activity
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-app-activity-success-createddraft
↳accellion-kw-kv-app-activity-success-requestedafile
↳accellion-kw-kv-app-activity-success-viewedemailsubject
↳accellion-kw-kv-app-activity-success-userprofile
↳accellion-kw-kv-app-activity-success-draftchanged
↳accellion-kw-kv-app-activity-success-userdeleted
dlp-email-alert-out
↳accellion-kw-kv-email-send-success-withfiles
file-write
↳accellion-kw-kv-file-write-success-createdfolder
| T1048 - Exfiltration Over Alternative Protocol
T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
T1114 - Email Collection
T1114.001 - T1114.001
T1114.003 - Email Collection: Email Forwarding Rule
| |
| Privilege Abuse | account-password-change
↳accellion-kiteworks-kv-user-password-modify-success-updatedpassword
↳accellion-kw-kv-user-password-modify-success-resetpassword
app-activity
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-app-activity-success-createddraft
↳accellion-kw-kv-app-activity-success-requestedafile
↳accellion-kw-kv-app-activity-success-viewedemailsubject
↳accellion-kw-kv-app-activity-success-userprofile
↳accellion-kw-kv-app-activity-success-draftchanged
↳accellion-kw-kv-app-activity-success-userdeleted
app-login
↳accellion-kw-str-app-login-success-sessionstarted
↳accellion-kw-mix-app-login-success-loggedin
dlp-email-alert-out
↳accellion-kw-kv-email-send-success-withfiles
failed-app-login
↳accellion-kw-kv-app-login-fail-userlogin
file-delete
↳accellion-kw-kv-file-delete-success-deletedfolder
file-download
↳accellion-kw-kv-file-download-success-downloadedfile
↳accellion-kw-kv-file-download-success-downloaded
↳accellion-kw-kv-file-download-success-downloadedarchive
file-permission-change
↳accellion-kw-kv-file-permission-modify-success-addednewpermission
file-read
↳accellion-kw-kv-file-read-success-viewfile
↳accellion-kw-kv-file-read-success-viewedfile
file-upload
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-file-upload-success-uploadedfile
file-write
↳accellion-kw-kv-file-write-success-createdfolder
member-added
↳accellion-kw-kv-group-member-add-adduser
| T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
| |
| Privilege Escalation | app-activity
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-app-activity-success-createddraft
↳accellion-kw-kv-app-activity-success-requestedafile
↳accellion-kw-kv-app-activity-success-viewedemailsubject
↳accellion-kw-kv-app-activity-success-userprofile
↳accellion-kw-kv-app-activity-success-draftchanged
↳accellion-kw-kv-app-activity-success-userdeleted
| T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Privileged Activity | app-activity
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-app-activity-success-createddraft
↳accellion-kw-kv-app-activity-success-requestedafile
↳accellion-kw-kv-app-activity-success-viewedemailsubject
↳accellion-kw-kv-app-activity-success-userprofile
↳accellion-kw-kv-app-activity-success-draftchanged
↳accellion-kw-kv-app-activity-success-userdeleted
app-login
↳accellion-kw-str-app-login-success-sessionstarted
↳accellion-kw-mix-app-login-success-loggedin
dlp-email-alert-out
↳accellion-kw-kv-email-send-success-withfiles
failed-app-login
↳accellion-kw-kv-app-login-fail-userlogin
file-delete
↳accellion-kw-kv-file-delete-success-deletedfolder
file-download
↳accellion-kw-kv-file-download-success-downloadedfile
↳accellion-kw-kv-file-download-success-downloaded
↳accellion-kw-kv-file-download-success-downloadedarchive
file-permission-change
↳accellion-kw-kv-file-permission-modify-success-addednewpermission
file-read
↳accellion-kw-kv-file-read-success-viewfile
↳accellion-kw-kv-file-read-success-viewedfile
file-upload
↳accellion-kw-kv-file-upload-success-uploadedfile1
↳accellion-kw-kv-file-upload-success-uploadedfile
file-write
↳accellion-kw-kv-file-write-success-createdfolder
| T1078 - Valid Accounts
| |