Vendor: Netwrix

April 15, 2026 · View on GitHub

Product: Netwrix Auditor

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
112	39	30	4	0

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Abnormal Authentication & Access	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	17 Rules 6 Models
Brute Force Attack	failed-logon ↳netwrix-auditor-kv-database-who	T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1110 - Brute Force T1110.003 - T1110.003	9 Rules
Compromised Credentials	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who file-delete ↳netwrix-auditor-xml-file-success-action file-write ↳netwrix-auditor-xml-file-success-action	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	61 Rules 31 Models
Data Access	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon file-delete ↳netwrix-auditor-xml-file-success-action file-write ↳netwrix-auditor-xml-file-success-action	T1078 - Valid Accounts T1083 - File and Directory Discovery	29 Rules 17 Models
Data Exfiltration	file-write ↳netwrix-auditor-xml-file-success-action	TA0002 - TA0002	2 Rules 1 Models
Data Leak	file-write ↳netwrix-auditor-xml-file-success-action	T1114 - Email Collection T1114.001 - T1114.001	1 Rules
Destruction of Data	file-delete ↳netwrix-auditor-xml-file-success-action	T1070 - Indicator Removal on Host T1070.004 - Indicator Removal on Host: File Deletion T1485 - Data Destruction	1 Rules
Lateral Movement	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who	T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy T1110 - Brute Force T1110.003 - T1110.003 T1550 - Use Alternate Authentication Material T1550.002 - Use Alternate Authentication Material: Pass the Hash T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	14 Rules 1 Models
Malware	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who file-write ↳netwrix-auditor-xml-file-success-action	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1078 - Valid Accounts T1210 - Exploitation of Remote Services T1505 - Server Software Component T1505.003 - Server Software Component: Web Shell T1547 - Boot or Logon Autostart Execution T1547.001 - T1547.001 TA0002 - TA0002	12 Rules 4 Models
Privilege Abuse	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who file-delete ↳netwrix-auditor-xml-file-success-action file-write ↳netwrix-auditor-xml-file-success-action	T1078 - Valid Accounts	6 Rules 1 Models
Privilege Escalation	failed-logon ↳netwrix-auditor-kv-database-who	T1210 - Exploitation of Remote Services	1 Rules
Privileged Activity	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who file-delete ↳netwrix-auditor-xml-file-success-action file-write ↳netwrix-auditor-xml-file-success-action	T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts	4 Rules
Ransomware	app-login ↳netwrix-auditor-cef-app-login-success-successfullogon failed-logon ↳netwrix-auditor-kv-database-who file-write ↳netwrix-auditor-xml-file-success-action	T1078 - Valid Accounts T1486 - Data Encrypted for Impact	3 Rules

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
External Remote Services Valid Accounts Exploit Public Fasing Application		External Remote Services Valid Accounts Server Software Component: Web Shell Server Software Component Boot or Logon Autostart Execution	Valid Accounts Exploitation for Privilege Escalation Boot or Logon Autostart Execution	Indicator Removal on Host: File Deletion Valid Accounts Use Alternate Authentication Material Use Alternate Authentication Material: Pass the Hash Indicator Removal on Host Use Alternate Authentication Material: Pass the Ticket	OS Credential Dumping Brute Force Steal or Forge Kerberos Tickets	File and Directory Discovery	Exploitation of Remote Services Remote Services Use Alternate Authentication Material Remote Services: Remote Desktop Protocol	Email Collection	Proxy: Multi-hop Proxy Proxy		Data Destruction Data Encrypted for Impact