Rules by Product and UseCase

April 15, 2026 · View on GitHub

Vendor: FTP

Product: FTP

Use-Case: Privilege Abuse

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
723714
Event TypeRulesModels
app-activityT1098 - Account Manipulation
EM-InB-Ex: A user has been given mailbox permissions for an executive user
EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own
EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions

T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
EM-InB-Ex: A user has been given mailbox permissions for an executive user
EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own
EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions

T1078 - Valid Accounts
APP-Account-deactivated: Activity from a de-activated user account
APP-F-SA-NC: New service account access to application
APP-AT-PRIV: Non-privileged user performing privileged application activity
EM-InB-Perm-N: Models users who give mailbox permissions
APP-AT-PRIV: Privileged application activities
app-activity-failedT1078 - Valid Accounts
APP-Account-deactivated: Activity from a de-activated user account
app-loginT1078 - Valid Accounts
APP-Account-deactivated: Activity from a de-activated user account
APP-F-SA-NC: New service account access to application
failed-app-loginT1078 - Valid Accounts
APP-Account-deactivated: Activity from a de-activated user account
file-deleteT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account
file-readT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account
file-writeT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account