Vendor: VMware

April 15, 2026 · View on GitHub

Product: VMware Horizon

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
132482264
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-login
vmware-horizon-str-app-login-success-loggedin

authentication-failed
vmware-horizon-str-endpoint-login-fail-view

authentication-successful
vmware-horizon-str-app-authentication-view
vmware-horizon-csv-endpoint-login-success-user
vmware-horizon-str-endpoint-authentication-success-allocated
vmware-horizon-str-endpoint-authentication-success-requestedpool

failed-logon
vmware-horizon-str-endpoint-login-fail-unable

remote-logon
vmware-horizon-kv-endpoint-login-success-applicationrequest
vmware-horizon-str-endpoint-login-fail-session
T1021 - Remote Services
T1078 - Valid Accounts
T1078.002 - T1078.002
T1078.003 - Valid Accounts: Local Accounts
T1110 - Brute Force
T1133 - External Remote Services
  • 40 Rules
  • 16 Models
Brute Force Attackfailed-logon
vmware-horizon-str-endpoint-login-fail-unable
T1021 - Remote Services
T1021.001 - Remote Services: Remote Desktop Protocol
T1110 - Brute Force
T1110.003 - T1110.003
  • 9 Rules
Data Accessapp-login
vmware-horizon-str-app-login-success-loggedin
T1078 - Valid Accounts
  • 5 Rules
  • 4 Models
Privilege Abuseapp-login
vmware-horizon-str-app-login-success-loggedin

failed-logon
vmware-horizon-str-endpoint-login-fail-unable

remote-logon
vmware-horizon-kv-endpoint-login-success-applicationrequest
vmware-horizon-str-endpoint-login-fail-session
T1078 - Valid Accounts
T1078.002 - T1078.002
  • 14 Rules
  • 7 Models
Privilege Escalationfailed-logon
vmware-horizon-str-endpoint-login-fail-unable

remote-logon
vmware-horizon-kv-endpoint-login-success-applicationrequest
vmware-horizon-str-endpoint-login-fail-session
T1078 - Valid Accounts
T1210 - Exploitation of Remote Services
T1555 - Credentials from Password Stores
T1555.005 - T1555.005
  • 3 Rules
  • 1 Models
Privileged Activityapp-login
vmware-horizon-str-app-login-success-loggedin

failed-logon
vmware-horizon-str-endpoint-login-fail-unable

remote-logon
vmware-horizon-kv-endpoint-login-success-applicationrequest
vmware-horizon-str-endpoint-login-fail-session
T1021 - Remote Services
T1068 - Exploitation for Privilege Escalation
T1078 - Valid Accounts
T1078.002 - T1078.002
  • 17 Rules
  • 7 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Valid Accounts

Exploitation for Privilege Escalation

Valid Accounts

Use Alternate Authentication Material

Use Alternate Authentication Material: Pass the Hash

Use Alternate Authentication Material: Pass the Ticket

Valid Accounts: Local Accounts

Brute Force

Steal or Forge Kerberos Tickets

Credentials from Password Stores

Steal or Forge Kerberos Tickets: Kerberoasting

Remote System Discovery

Exploitation of Remote Services

Remote Services

Use Alternate Authentication Material

Remote Services: Remote Desktop Protocol

Proxy: Multi-hop Proxy

Proxy