2_ds_imss_imss.md

April 15, 2026 · View on GitHub

Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Lateral Movementsecurity-alert
↳imss-i-str-alert-trigger-success-dlpalert
↳imss-i-str-alert-trigger-success-securityalert
↳imss-i-json-alert-trigger-success-spf
↳imss-i-str-alert-trigger-success-antispamrules
↳imss-i-str-alert-trigger-success-spoofedemailfilter
T1027 - Obfuscated Files or Information
T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
  • 2 Rules
Malwaredlp-alert
↳imss-i-str-alert-trigger-success-capacityregulation

security-alert
↳imss-i-str-alert-trigger-success-dlpalert
↳imss-i-str-alert-trigger-success-securityalert
↳imss-i-json-alert-trigger-success-spf
↳imss-i-str-alert-trigger-success-antispamrules
↳imss-i-str-alert-trigger-success-spoofedemailfilter
TA0002 - TA0002
  • 4 Rules
  • 2 Models
Privileged Activitysecurity-alert
↳imss-i-str-alert-trigger-success-dlpalert
↳imss-i-str-alert-trigger-success-securityalert
↳imss-i-json-alert-trigger-success-spf
↳imss-i-str-alert-trigger-success-antispamrules
↳imss-i-str-alert-trigger-success-spoofedemailfilter
T1068 - Exploitation for Privilege Escalation
  • 1 Rules