Vendor: StealthBits

Product: StealthIntercept

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
42	17	5	2	0

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Account Manipulation	ds-access ↳stealthbits-s-leef-ds-object-activity-attrnewvalue failed-ds-access ↳stealthbits-s-leef-ds-object-activity-attrnewvalue	T1207 - Rogue Domain Controller T1484 - Group Policy Modification	35 Rules 16 Models
Compromised Credentials	ds-access ↳stealthbits-s-leef-ds-object-activity-attrnewvalue	T1003 - OS Credential Dumping T1003.006 - OS Credential Dumping: DCSync T1207 - Rogue Domain Controller T1558 - Steal or Forge Kerberos Tickets	7 Rules 1 Models
Privilege Abuse	ds-access ↳stealthbits-s-leef-ds-object-activity-attrnewvalue	T1484 - Group Policy Modification	2 Rules 2 Models
Privileged Activity	ds-access ↳stealthbits-s-leef-ds-object-activity-attrnewvalue	T1003 - OS Credential Dumping T1003.006 - OS Credential Dumping: DCSync T1207 - Rogue Domain Controller T1484 - Group Policy Modification	7 Rules 2 Models

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
			Group Policy Modification	Group Policy Modification Rogue Domain Controller	OS Credential Dumping Steal or Forge Kerberos Tickets OS Credential Dumping: DCSync