Rules by Product and UseCase

Vendor: SmartSuite

Product: SmartSuite

Use-Case: Account Manipulation

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
46	19	6	5	2

Event Type	Rules	Models
account-creation	T1136 - Create Account ↳ AC-UH-F: First account creation activity from asset for user ↳ AC-UH-A: Abnormal account creation activity from asset for user ↳ AC-OZ-F: First account creation activity from network zone ↳ AC-OZ-A: Abnormal account creation activity from network zone ↳ AC-OH-F: First account creation activity from asset in the organization ↳ AC-OH-A: Abnormal account creation activity from asset in the organization ↳ AM-UD-F: First account creation on domain for user ↳ AM-UD-A: Abnormal account creation on domain for user ↳ AC-UT-TOW-A: Abnormal day for user to perform account creation activity ↳ AM-UA-AC-F: First account creation activity for user ↳ AM-UA-AC-A: Abnormal account creation activity for user ↳ AM-GA-AC-F: First account creation activity for peer group ↳ AM-GA-AC-A: Abnormal account creation activity for peer group ↳ AC-LocUA-F-new: First account creation activity by a new local user ↳ AC-LocUA-A: Abnormal account creation activity by local user ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user ↳ A-ACCT-CR-DEL: Account created and deleted on asset ↳ A-AC-DhU-system-F: First account creation by system account on asset ↳ A-AC-DhU-system-A: Abnormal account creation by system account on asset T1136.001 - Create Account: Create: Local Account ↳ AC-LocUA-F-new: First account creation activity by a new local user ↳ AC-LocUA-A: Abnormal account creation activity by local user ↳ A-AC-DhU-system-F: First account creation by system account on asset ↳ A-AC-DhU-system-A: Abnormal account creation by system account on asset T1098 - Account Manipulation ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user T1136.002 - T1136.002 ↳ AM-UD-F: First account creation on domain for user ↳ AM-UD-A: Abnormal account creation on domain for user	• A-AC-DhU-system: System accounts performing account creation activities • AE-GA: All activity for peer groups • AE-UA: All activity for users • AC-UT-TOW: Account creation activity time for user • AM-UD: Account creation on domain by user • AC-OH: Account creation hosts in organization • AC-OZ: Account creation activity from zone • AC-UH: Account creation activity on host for user
account-deleted	T1136 - Create Account ↳ A-ACCT-CR-DEL: Account created and deleted on asset T1531 - Account Access Removal ↳ AM-UA-AD-F: First account deletion activity for user	• AE-UA: All activity for users
app-activity	T1098 - Account Manipulation ↳ EM-InB-Ex: A user has been given mailbox permissions for an executive user ↳ EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own ↳ EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions T1098.002 - Account Manipulation: Exchange Email Delegate Permissions ↳ EM-InB-Ex: A user has been given mailbox permissions for an executive user ↳ EM-InB-Perm-N-F: First time a user has given mailbox permissions on another mailbox that is not their own ↳ EM-InB-Perm-N-A: Abnormal for user to give mailbox permissions	• EM-InB-Perm-N: Models users who give mailbox permissions
member-added	T1098 - Account Manipulation ↳ GM-LocUA-F-new: First group management activity by a new local user ↳ GM-LocUA-A: Abnormal group management activity by local user ↳ MA-SELF: User added themself to a group ↳ MA-PRIV-F-local: First addition to privileged group by local user ↳ MA-PRIV-A: Abnormal addition to privileged group by user ↳ GM-UH-F: First group management activity from asset for user ↳ GM-UH-A: Abnormal group management activity from asset for user ↳ GM-OZ-F: First group management activity from network zone ↳ GM-OZ-A: Abnormal group management activity from network zone ↳ GM-OH-F: First group management activity from asset in the organization ↳ GM-OH-A: Abnormal group management activity from asset in the organization ↳ GM-UT-TOW-A: Abnormal day for user to perform group management activity ↳ AM-GA-MA-F: First account group management activity for peer group ↳ AM-OU-SS-F: First addition and removal of member from a group by user in a single session for organization ↳ AM-OU-SS-A: Abnormal addition and removal of member from a group in a single session in the organization ↳ AM-OG-SS-F: First addition and removal of member from a group by user in a single session for peer group ↳ AM-OG-SS-A: Abnormal addition and removal of member from a group in a single session in the peer group ↳ AM-OG-F: First member addition to this group for the organization ↳ AM-OG-A: Abnormal account addition to this group for the organization ↳ AM-GOU-F: First account OU addition to this group ↳ AM-GOU-A: Abnormal account OU addition to this group ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user ↳ A-GM-DhU-system-F: First group management by system account on asset T1136 - Create Account ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user	• A-GM-DhU-system: System accounts performing group management activities • AE-GA: All activity for peer groups • AM-GOU: Account management, OUs that are added to security groups • AM-AG: Account management, groups which users are being added to • AM-OG-SS: Models the peer groups who perform addition and removal of members from group in same session • AM-OU-SS: Models the users who perform addition and removal of members from group in same session in the organization • AE-UA: All activity for users • GM-UT-TOW: Group management activity time for user • GM-OH: Group management hosts in organization • GM-OZ: Group management activity from zone • GM-UH: Group management activity on host for user • AM-OU-PG: Account group management of high privileges in the organization
member-removed	T1098 - Account Manipulation ↳ GM-LocUA-F-new: First group management activity by a new local user ↳ GM-LocUA-A: Abnormal group management activity by local user ↳ GM-UH-F: First group management activity from asset for user ↳ GM-UH-A: Abnormal group management activity from asset for user ↳ GM-OZ-F: First group management activity from network zone ↳ GM-OZ-A: Abnormal group management activity from network zone ↳ GM-OH-F: First group management activity from asset in the organization ↳ GM-OH-A: Abnormal group management activity from asset in the organization ↳ GM-UT-TOW-A: Abnormal day for user to perform group management activity ↳ AM-UA-MA-F: First account group management activity for user ↳ AM-GA-MA-F: First account group management activity for peer group ↳ AM-OU-SS-F: First addition and removal of member from a group by user in a single session for organization ↳ AM-OU-SS-A: Abnormal addition and removal of member from a group in a single session in the organization ↳ AM-OG-SS-F: First addition and removal of member from a group by user in a single session for peer group ↳ AM-OG-SS-A: Abnormal addition and removal of member from a group in a single session in the peer group	• AM-OG-SS: Models the peer groups who perform addition and removal of members from group in same session • AM-OU-SS: Models the users who perform addition and removal of members from group in same session in the organization • AE-GA: All activity for peer groups • AE-UA: All activity for users • GM-UT-TOW: Group management activity time for user • GM-OH: Group management hosts in organization • GM-OZ: Group management activity from zone • GM-UH: Group management activity on host for user