Rules by Product and UseCase

April 15, 2026 · View on GitHub

Vendor: Microsoft

Product: MSSQL

Use-Case: Data Leak

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
8	2	7	2	0

Event Type	Rules	Models
app-activity	T1114 - Email Collection ↳ EM-InRule-EX: User has created an inbox forwarding rule to forward email to an external domain email ↳ EM-InRule-Public: User has created an inbox forwarding rule to forward email to a public email domain ↳ EM-InRule-Fin: User has created an inbox forwarding rule to forward emails containing financial keywords T1114.003 - Email Collection: Email Forwarding Rule ↳ EM-InRule-EX: User has created an inbox forwarding rule to forward email to an external domain email ↳ EM-InRule-Public: User has created an inbox forwarding rule to forward email to a public email domain ↳ EM-InRule-Fin: User has created an inbox forwarding rule to forward emails containing financial keywords
web-activity-allowed	T1041 - Exfiltration Over C2 Channel ↳ A-WEB-EXFIL-ASSET: Large amount of data exfiltrated from host T1567 - Exfiltration Over Web Service ↳ WEB-FS: User has accessed a file sharing domain ↳ WEB-OU-FS: One of the top file sharing users in the organization ↳ WEB-OG-FS: One of the top file sharing users in the peer group ↳ A-WEB-EXFIL-ASSET: Large amount of data exfiltrated from host T1071 - Application Layer Protocol ↳ WEB-New-File-20: User has uploaded 20MB or more to an infrequently accessed top domain T1071.001 - Application Layer Protocol: Web Protocols ↳ WEB-New-File-20: User has uploaded 20MB or more to an infrequently accessed top domain T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage ↳ WEB-FS: User has accessed a file sharing domain ↳ WEB-OU-FS: One of the top file sharing users in the organization ↳ WEB-OG-FS: One of the top file sharing users in the peer group	• WEB-OG-FS: File sharing activities of users in the peer group • WEB-OU-FS: File sharing activities of users in the organization