Vendor: McAfee

April 15, 2026 · View on GitHub

Product: McAfee Web Gateway

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
75272128
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessweb-activity-allowed
mcafee-wg-json-http-session-mwg
mcafee-wg-kv-http-session-success-mwgaccess3
mcafee-wg-str-http-session-post
mcafee-wg-str-http-session-head
mcafee-wg-str-http-session-get
mcafee-wg-str-http-session-option
mcafee-wg-str-http-session-denied
mcafee-wg-str-http-session-connect
mcafee-wg-str-http-session-connect-1

web-activity-denied
mcafee-wg-json-http-session-mwg
mcafee-wg-kv-http-session-success-mwgaccess3
mcafee-wg-str-http-session-post
mcafee-wg-str-http-session-head
mcafee-wg-str-http-session-get
mcafee-wg-str-http-session-option
mcafee-wg-str-http-session-denied
mcafee-wg-str-http-session-connect
mcafee-wg-str-http-session-connect-1
T1071 - Application Layer Protocol
T1071.001 - Application Layer Protocol: Web Protocols
  • 6 Rules
  • 6 Models
Compromised Credentialsweb-activity-allowed
mcafee-wg-json-http-session-mwg
mcafee-wg-kv-http-session-success-mwgaccess3
mcafee-wg-str-http-session-post
mcafee-wg-str-http-session-head
mcafee-wg-str-http-session-get
mcafee-wg-str-http-session-option
mcafee-wg-str-http-session-denied
mcafee-wg-str-http-session-connect
mcafee-wg-str-http-session-connect-1

web-activity-denied
mcafee-wg-json-http-session-mwg
mcafee-wg-kv-http-session-success-mwgaccess3
mcafee-wg-str-http-session-post
mcafee-wg-str-http-session-head
mcafee-wg-str-http-session-get
mcafee-wg-str-http-session-option
mcafee-wg-str-http-session-denied
mcafee-wg-str-http-session-connect
mcafee-wg-str-http-session-connect-1
T1071 - Application Layer Protocol
T1071.001 - Application Layer Protocol: Web Protocols
T1078 - Valid Accounts
T1102 - Web Service
T1189 - Drive-by Compromise
T1190 - Exploit Public Fasing Application
T1204 - User Execution
T1204.001 - T1204.001
T1566 - Phishing
T1566.002 - Phishing: Spearphishing Link
T1568 - Dynamic Resolution
T1568.002 - Dynamic Resolution: Domain Generation Algorithms
  • 40 Rules
  • 22 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Phishing: Spearphishing Link

Valid Accounts

Drive-by Compromise

Exploit Public Fasing Application

Phishing

User Execution

Valid Accounts

Valid Accounts

Valid Accounts

Internal Spearphishing

Web Service

Application Layer Protocol: Web Protocols

Dynamic Resolution

Dynamic Resolution: Domain Generation Algorithms

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy

Exfiltration Over C2 Channel

Exfiltration Over Web Service: Exfiltration to Cloud Storage

Exfiltration Over Web Service

Resource Hijacking