| Compromised Credentials | app-activity
↳securelink-s-kv-app-activity-appactivity
app-login
↳securelink-s-str-app-login-success-connected
↳securelink-s-kv-app-login-success-nexuslogin
authentication-successful
↳securelink-s-kv-app-authentication-success-login
↳securelink-s-kv-app-authentication-success-emailauthorizationcode
| T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
| |
| Lateral Movement | app-login
↳securelink-s-str-app-login-success-connected
↳securelink-s-kv-app-login-success-nexuslogin
authentication-failed
↳securelink-s-kv-app-authentication-success-emailauthorizationcode
authentication-successful
↳securelink-s-kv-app-authentication-success-login
↳securelink-s-kv-app-authentication-success-emailauthorizationcode
| T1078 - Valid Accounts
T1090 - Proxy
T1090.003 - Proxy: Multi-hop Proxy
| |
| Malware | app-login
↳securelink-s-str-app-login-success-connected
↳securelink-s-kv-app-login-success-nexuslogin
authentication-successful
↳securelink-s-kv-app-authentication-success-login
↳securelink-s-kv-app-authentication-success-emailauthorizationcode
| T1078 - Valid Accounts
| |
| Privilege Abuse | account-password-change
↳securelink-s-kv-user-password-modify-success-passwordupdated
account-password-reset
↳securelink-s-kv-user-password-reset-fail-reset
↳securelink-s-kv-user-password-reset-success-passwordresetcomplete
app-activity
↳securelink-s-kv-app-activity-appactivity
app-activity-failed
↳securelink-s-kv-app-activity-appactivity
app-login
↳securelink-s-str-app-login-success-connected
↳securelink-s-kv-app-login-success-nexuslogin
| T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Ransomware | app-login
↳securelink-s-str-app-login-success-connected
↳securelink-s-kv-app-login-success-nexuslogin
authentication-failed
↳securelink-s-kv-app-authentication-success-emailauthorizationcode
authentication-successful
↳securelink-s-kv-app-authentication-success-login
↳securelink-s-kv-app-authentication-success-emailauthorizationcode
| T1078 - Valid Accounts
| |