Vendor: LiquidFiles

April 15, 2026 · View on GitHub

Product: LiquidFiles

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
71261188
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessaccount-deleted
liquidfiles-l-json-user-deleted-success-inactiveuser

account-password-reset
liquidfiles-l-json-user-password-reset-success-password
liquidfiles-l-json-user-password-reset-success-password
liquidfiles-l-json-user-password-reset-success-password

app-activity
liquidfiles-l-json-app-activity-success-catchall
liquidfiles-l-json-app-activity-success-blacklistclient
liquidfiles-l-json-app-activity-success-externaluser
liquidfiles-l-json-file-upload-attachment
liquidfiles-l-json-app-authentication-success-user
liquidfiles-l-json-file-upload-success-message

app-login
liquidfiles-l-json-file-upload-attachment
liquidfiles-l-json-app-authentication-success-user
liquidfiles-l-json-file-upload-success-message

authentication-failed
liquidfiles-l-json-file-upload-attachment
liquidfiles-l-json-app-authentication-success-user
liquidfiles-l-json-file-upload-success-message

failed-app-login
liquidfiles-l-json-file-upload-attachment
liquidfiles-l-json-app-authentication-success-user
liquidfiles-l-json-file-upload-success-message
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationaccount-deleted
liquidfiles-l-json-user-deleted-success-inactiveuser

account-password-reset
liquidfiles-l-json-user-password-reset-success-password
liquidfiles-l-json-user-password-reset-success-password
liquidfiles-l-json-user-password-reset-success-password

app-activity
liquidfiles-l-json-app-activity-success-catchall
liquidfiles-l-json-app-activity-success-blacklistclient
liquidfiles-l-json-app-activity-success-externaluser
liquidfiles-l-json-file-upload-attachment
liquidfiles-l-json-app-authentication-success-user
liquidfiles-l-json-file-upload-success-message
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1531 - Account Access Removal
  • 6 Rules
  • 2 Models
Malwareapp-login
liquidfiles-l-json-file-upload-attachment
liquidfiles-l-json-app-authentication-success-user
liquidfiles-l-json-file-upload-success-message
T1078 - Valid Accounts
  • 1 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

Create Account

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy

Account Access Removal