Rules by Product and UseCase

Vendor: Jumpcloud

Product: Jumpcloud

Use-Case: Privilege Abuse

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
31	14	7	10	1

Event Type	Rules	Models
account-creation	T1098 - Account Manipulation ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user T1136 - Create Account ↳ AC-UH-F: First account creation activity from asset for user ↳ AC-UH-A: Abnormal account creation activity from asset for user ↳ AC-OZ-F: First account creation activity from network zone ↳ AC-OZ-A: Abnormal account creation activity from network zone ↳ AC-OH-F: First account creation activity from asset in the organization ↳ AC-OH-A: Abnormal account creation activity from asset in the organization ↳ AM-UD-F: First account creation on domain for user ↳ AM-UD-A: Abnormal account creation on domain for user ↳ AC-UT-TOW-A: Abnormal day for user to perform account creation activity ↳ AM-UA-AC-F: First account creation activity for user ↳ AM-UA-AC-A: Abnormal account creation activity for user ↳ AM-GA-AC-F: First account creation activity for peer group ↳ AM-GA-AC-A: Abnormal account creation activity for peer group ↳ AC-LocUA-F-new: First account creation activity by a new local user ↳ AC-LocUA-A: Abnormal account creation activity by local user ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user T1136.001 - Create Account: Create: Local Account ↳ AC-LocUA-F-new: First account creation activity by a new local user ↳ AC-LocUA-A: Abnormal account creation activity by local user T1136.002 - T1136.002 ↳ AM-UD-F: First account creation on domain for user ↳ AM-UD-A: Abnormal account creation on domain for user	• AE-GA: All activity for peer groups • AE-UA: All activity for users • AC-UT-TOW: Account creation activity time for user • AM-UD: Account creation on domain by user • AC-OH: Account creation hosts in organization • AC-OZ: Account creation activity from zone • AC-UH: Account creation activity on host for user
account-deleted	T1531 - Account Access Removal ↳ AM-UA-AD-F: First account deletion activity for user	• AE-UA: All activity for users
account-password-change	T1098 - Account Manipulation ↳ AM-UA-APLocU-F: First account password change for local user
account-password-reset	T1098 - Account Manipulation ↳ AM-UA-APLocU-F: First account password change for local user
app-activity	T1098 - Account Manipulation ↳ EM-InB-Ex: A user has been given mailbox permissions for an executive user ↳ EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own ↳ EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions T1098.002 - Account Manipulation: Exchange Email Delegate Permissions ↳ EM-InB-Ex: A user has been given mailbox permissions for an executive user ↳ EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own ↳ EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions T1078 - Valid Accounts ↳ APP-Account-deactivated: Activity from a de-activated user account ↳ APP-F-SA-NC: New service account access to application ↳ APP-AT-PRIV: Non-privileged user performing privileged application activity	• EM-InB-Perm-N: Models users who give mailbox permissions • APP-AT-PRIV: Privileged application activities
app-activity-failed	T1078 - Valid Accounts ↳ APP-Account-deactivated: Activity from a de-activated user account
app-login	T1078 - Valid Accounts ↳ APP-Account-deactivated: Activity from a de-activated user account ↳ APP-F-SA-NC: New service account access to application
failed-app-login	T1078 - Valid Accounts ↳ APP-Account-deactivated: Activity from a de-activated user account
file-download	T1078 - Valid Accounts ↳ FA-Account-deactivated: File Activity from a de-activated user account
privileged-access	T1078 - Valid Accounts ↳ WPA-OU-F: First privileged access event for user for organization ↳ WPA-OG-F: First privileged access event for user for peer group ↳ WPA-UH-F: First privileged access event on host for user ↳ WPA-HZ-F: First privileged access event on host from zone ↳ WPA-USH-F: First privileged access event on source host for user	• WPA-USH: Source hosts with privileged access events for user • WPA-HZ: Source zones with privileged access events for host • WPA-UH: Hosts with privileged access events for user • WPA-OG: Privileged access activity for users in the peer group • WPA-OU: Privileged access activity for users in the organization