Use Case: Compromised Credentials

Vendor: 1password

Product	MITRE ATT&CK® TTP	Content
1password	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: AIM Security

Product	MITRE ATT&CK® TTP	Content
AI Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: APC

Product	MITRE ATT&CK® TTP	Content
APC	T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	58 Rules 25 Models

Vendor: Abnormal Security

Product	MITRE ATT&CK® TTP	Content
Abnormal Security	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Absolute

Product	MITRE ATT&CK® TTP	Content
Absolute DDS	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: Accellion

Product	MITRE ATT&CK® TTP	Content
Kiteworks	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	75 Rules 38 Models

Vendor: Adaxes

Product	MITRE ATT&CK® TTP	Content
Adaxes	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Adobe

Product	MITRE ATT&CK® TTP	Content
Adobe Experience Manager	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models

Vendor: Airlock

Product	MITRE ATT&CK® TTP	Content
Airlock Allowlisting	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	50 Rules 26 Models

Vendor: Akamai

Product	MITRE ATT&CK® TTP	Content
Akamai Guardicore	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	80 Rules 42 Models
Akamai SIEM	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	63 Rules 31 Models
Cloud Akamai	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Amazon

Product	MITRE ATT&CK® TTP	Content
AWS Bastion	T1078 - Valid Accounts	3 Rules 1 Models
AWS CloudTrail	T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1213 - Data from Information Repositories T1535 - Unused/Unsupported Cloud Regions	67 Rules 40 Models
AWS CloudWatch	T1046 - Network Service Scanning T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	80 Rules 47 Models
AWS Elastic Load Balancer	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
AWS GuardDuty	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1213 - Data from Information Repositories	33 Rules 14 Models
AWS Network Firewall	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
AWS Redshift	T1213 - Data from Information Repositories	18 Rules 10 Models
AWS WAF	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	47 Rules 26 Models
Amazon EKS	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Amazon Inspector	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Amazon Q	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Amazon S3	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1535 - Unused/Unsupported Cloud Regions T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	46 Rules 28 Models

Vendor: Apache

Product	MITRE ATT&CK® TTP	Content
Apache	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Apache Subversion	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: AppSense

Product	MITRE ATT&CK® TTP	Content
AppSense Application Manager	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools TA0002 - TA0002	7 Rules 2 Models

Vendor: Apple

Product	MITRE ATT&CK® TTP	Content
macOS	T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	27 Rules 12 Models

Vendor: Arctic Wolf

Product	MITRE ATT&CK® TTP	Content
Cylance PROTECT	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Cylance Protect	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Armis

Product	MITRE ATT&CK® TTP	Content
Armis Platform	T1078 - Valid Accounts	3 Rules 2 Models

Vendor: AssetView

Product	MITRE ATT&CK® TTP	Content
AssetView	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1083 - File and Directory Discovery	31 Rules 14 Models

Vendor: Atlassian

Product	MITRE ATT&CK® TTP	Content
Atlassian	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models
Atlassian BitBucket	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Atlassian Guard	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Attivo

Product	MITRE ATT&CK® TTP	Content
BOTsink	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Auth0

Product	MITRE ATT&CK® TTP	Content
Auth0	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	164 Rules 85 Models

Vendor: Barracuda

Product	MITRE ATT&CK® TTP	Content
Barracuda Cloudgen Firewall	T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	82 Rules 36 Models

Vendor: BeyondTrust

Product	MITRE ATT&CK® TTP	Content
BeyondInsight	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
BeyondTrust	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	95 Rules 41 Models
BeyondTrust Privileged Identity	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
BeyondTrust Remote Support	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
BeyondTrust Secure Remote Access	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Bitdefender

Product	MITRE ATT&CK® TTP	Content
GravityZone	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Bitglass

Product	MITRE ATT&CK® TTP	Content
Bitglass CASB	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	75 Rules 38 Models

Vendor: BlackBerry

Product	MITRE ATT&CK® TTP	Content
BlackBerry Protect	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	70 Rules 35 Models

Vendor: Box

Product	MITRE ATT&CK® TTP	Content
Box Cloud Content Management	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	74 Rules 38 Models
Box Shield	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: CA Technologies

Product	MITRE ATT&CK® TTP	Content
CA Privileged Access Manager Server Control	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: CDS

Product	MITRE ATT&CK® TTP	Content
CDS	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	39 Rules 17 Models

Vendor: Canon

Product	MITRE ATT&CK® TTP	Content
imageRUNNER ADVANCE	T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	69 Rules 37 Models

Vendor: CatoNetworks

Product	MITRE ATT&CK® TTP	Content
Cato Cloud	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	86 Rules 43 Models

Vendor: Check Point

Product	MITRE ATT&CK® TTP	Content
Check Point Anti-Malware	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Check Point Avanan	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Check Point Endpoint Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	36 Rules 17 Models
Check Point Identity Awareness	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	47 Rules 21 Models
Check Point NGFW	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	119 Rules 63 Models
Check Point Security Gateway	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	58 Rules 32 Models
Check Point Threat Emulation	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Harmony SaaS	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
SmartDefense	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	60 Rules 33 Models

Vendor: Checkmarx

Product	MITRE ATT&CK® TTP	Content
Checkmarx	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Cimcor

Product	MITRE ATT&CK® TTP	Content
CimTrak	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	73 Rules 38 Models

Vendor: Cisco

Product	MITRE ATT&CK® TTP	Content
Cisco Cloud Security	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Cisco Collaboration	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	34 Rules 17 Models
Cisco Cyber Vision	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	48 Rules 25 Models
Cisco Data Center	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
Cisco IOS	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	68 Rules 24 Models
Cisco ISE	T1021 - Remote Services T1078 - Valid Accounts	6 Rules 3 Models
Cisco Identity Intelligence	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Cisco Identity and Access Management	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	91 Rules 46 Models
Cisco Network Infrastructure and Management	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	72 Rules 39 Models
Cisco Network Monitoring and Analytics	T1046 - Network Service Scanning	1 Rules 1 Models
Cisco Network Security	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	212 Rules 95 Models
Cisco Remote Access Security	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	25 Rules 12 Models
Cisco Secure Endpoint	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	90 Rules 47 Models
Cisco Secure Firewall Management Center	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models
Cisco Secure Network Analytics	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
Cisco Web Security	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Duo Access	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: Citrix

Product	MITRE ATT&CK® TTP	Content
Citrix Gateway	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1040 - Network Sniffing T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	160 Rules 75 Models
Citrix Security Analytics	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Citrix Virtual Apps	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	39 Rules 20 Models

Vendor: Claroty

Product	MITRE ATT&CK® TTP	Content
CTD	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	83 Rules 43 Models
Claroty	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models

Vendor: Click Studios

Product	MITRE ATT&CK® TTP	Content
Passwordstate	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Cloudflare

Product	MITRE ATT&CK® TTP	Content
Cloudflare Audit	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Cloudflare Insights	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	82 Rules 46 Models
Cloudflare WAF	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Cohesity

Product	MITRE ATT&CK® TTP	Content
Cohesity DataPlatform	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	65 Rules 33 Models

Vendor: Commvault

Product	MITRE ATT&CK® TTP	Content
Commvault	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Commvault ThreatWise	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Corelight

Product	MITRE ATT&CK® TTP	Content
Corelight IDS	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: Cribl

Product	MITRE ATT&CK® TTP	Content
Cribl	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: CrowdStrike

Product	MITRE ATT&CK® TTP	Content
Falcon	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1187 - Forced Authentication T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	174 Rules 72 Models
Identity Threat Detection & Response	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	36 Rules 16 Models

Vendor: CyberArk

Product	MITRE ATT&CK® TTP	Content
CyberArk Privilege Access Manager	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	133 Rules 63 Models

Vendor: Cybereason

Product	MITRE ATT&CK® TTP	Content
Cybereason	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Cylance

Product	MITRE ATT&CK® TTP	Content
Cylance OPTICS	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools TA0002 - TA0002	7 Rules 2 Models

Vendor: Cynet

Product	MITRE ATT&CK® TTP	Content
Cynet EDR	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	45 Rules 20 Models

Vendor: Darktrace

Product	MITRE ATT&CK® TTP	Content
Darktrace	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: Delinea

Product	MITRE ATT&CK® TTP	Content
Centrify Audit and Monitoring Service	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services	71 Rules 38 Models
Centrify Authentication Service	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	47 Rules 23 Models
Centrify Infrastructure Services	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	29 Rules 5 Models
Centrify Zero Trust Privilege Services	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Secret Server	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Dell

Product	MITRE ATT&CK® TTP	Content
EMC Isilon	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1083 - File and Directory Discovery	32 Rules 14 Models
PowerProtect	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
PowerProtect Data Manager	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models
PowerStore	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	63 Rules 33 Models
Sonicwall	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	139 Rules 72 Models

Vendor: Digital Arts

Product	MITRE ATT&CK® TTP	Content
Digital Arts i-FILTER for Business	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Digital Guardian

Product	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	56 Rules 17 Models
Digital Guardian Network DLP	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	100 Rules 43 Models

Vendor: Dropbox

Product	MITRE ATT&CK® TTP	Content
Dropbox	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	109 Rules 51 Models

Vendor: Dtex Systems

Product	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1083 - File and Directory Discovery T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	60 Rules 19 Models

Vendor: ESET

Product	MITRE ATT&CK® TTP	Content
ESET Endpoint Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	83 Rules 42 Models

Vendor: Egnyte

Product	MITRE ATT&CK® TTP	Content
Egnyte	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services	71 Rules 38 Models

Vendor: Entrust

Product	MITRE ATT&CK® TTP	Content
Entrust Identity Enterprise	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Epic

Product	MITRE ATT&CK® TTP	Content
Epic SIEM	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1213 - Data from Information Repositories	92 Rules 48 Models

Vendor: Ermes

Product	MITRE ATT&CK® TTP	Content
Ermes Browser Security Platform	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	65 Rules 33 Models

Vendor: Exabeam

Product	MITRE ATT&CK® TTP	Content
Correlation Rule	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Search	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: Extrahop

Product	MITRE ATT&CK® TTP	Content
Extrahop Reveal(x)	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: Extreme Networks

Product	MITRE ATT&CK® TTP	Content
EXOS	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
Platform ONE	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Universal ZTNA	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Zebra WLAN Management	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: F-Secure

Product	MITRE ATT&CK® TTP	Content
F-Secure Client Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
F-Secure Policy Manager	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: F5

Product	MITRE ATT&CK® TTP	Content
BIG-IP F5 LBR	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
F5 Access Policy Manager	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	65 Rules 32 Models
F5 Advanced Firewall Manager	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
F5 Application Security Manager	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
F5 BIG-IP	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	90 Rules 47 Models
F5 Distributed Cloud	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	100 Rules 55 Models
F5 Silverline	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
F5 WebSafe	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: FTP

Product	MITRE ATT&CK® TTP	Content
FTP	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	75 Rules 38 Models

Vendor: Fastly

Product	MITRE ATT&CK® TTP	Content
Next-Gen Web Application Firewall	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models

Vendor: FireMon

Product	MITRE ATT&CK® TTP	Content
FireMon	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: Forcepoint

Product	MITRE ATT&CK® TTP	Content
Forcepoint Next-Gen Firewall	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Websense Security Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Forescout

Product	MITRE ATT&CK® TTP	Content
Forescout CounterACT	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	60 Rules 33 Models

Vendor: Fortinet

Product	MITRE ATT&CK® TTP	Content
FortiAuthenticator	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
FortiClient	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	86 Rules 50 Models
FortiGate	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	125 Rules 63 Models
FortiNAC	T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	66 Rules 36 Models
FortiSIEM	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	30 Rules 13 Models
FortiXDR	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools TA0002 - TA0002	7 Rules 2 Models
Fortinet Enterprise Firewall	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Fortinet UTM	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	120 Rules 64 Models
Fortiweb Web Application Firewall	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	63 Rules 31 Models

Vendor: FreeBSD

Product	MITRE ATT&CK® TTP	Content
FreeBSD	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	36 Rules 9 Models

Vendor: Gamma

Product	MITRE ATT&CK® TTP	Content
Gamma	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: GitHub

Product	MITRE ATT&CK® TTP	Content
GitHub	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	72 Rules 29 Models

Vendor: GitLab

Product	MITRE ATT&CK® TTP	Content
GitLab	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: GoAnywhere

Product	MITRE ATT&CK® TTP	Content
GoAnywhere MFT	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1213 - Data from Information Repositories T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	69 Rules 33 Models

Vendor: Google

Product	MITRE ATT&CK® TTP	Content
GCP CloudAudit	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models
Gemini Enterprise	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Google Cloud Platform	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1046 - Network Service Scanning T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1213 - Data from Information Repositories T1535 - Unused/Unsupported Cloud Regions T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	154 Rules 84 Models
Google Workspace	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	75 Rules 38 Models
Security Command Center	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: HP

Product	MITRE ATT&CK® TTP	Content
Aruba ClearPass Policy Manager	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	48 Rules 27 Models
Aruba Mobility Master	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	19 Rules 8 Models
Aruba Wireless controller	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	13 Rules 7 Models
ArubaOS	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	42 Rules 19 Models
HP iLO	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	27 Rules 16 Models
HPE 3PAR StoreServ	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
NonStop	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: HUMAN Security

Product	MITRE ATT&CK® TTP	Content
HUMAN Bot Defender	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models

Vendor: Halcyon

Product	MITRE ATT&CK® TTP	Content
Halcyon	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: HelpSystems

Product	MITRE ATT&CK® TTP	Content
Powertech Identity and Access Manager	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	101 Rules 37 Models

Vendor: Hornet

Product	MITRE ATT&CK® TTP	Content
Hornetsecurity Cloud Email Security Services	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Huawei

Product	MITRE ATT&CK® TTP	Content
Huawei Unified Security Gateway	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	89 Rules 38 Models

Vendor: IBM

Product	MITRE ATT&CK® TTP	Content
Guardium	T1213 - Data from Information Repositories	36 Rules 19 Models
IBM	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
IBM Datapower	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
IBM Mainframe	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	28 Rules 16 Models
QRadar SIEM	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
Security Access Manager	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Sterling B2B Integrator	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: IMSS

Product	MITRE ATT&CK® TTP	Content
IMSS	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Imperva

Product	MITRE ATT&CK® TTP	Content
Attack Analytics	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
Imperva Incapsula	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models
Imperva SecureSphere	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1213 - Data from Information Repositories	100 Rules 52 Models

Vendor: Imprivata

Product	MITRE ATT&CK® TTP	Content
Imprivata	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Infoblox

Product	MITRE ATT&CK® TTP	Content
BloxOne DDI	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	127 Rules 60 Models
Infoblox NetMRI	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Informatica

Product	MITRE ATT&CK® TTP	Content
Informatica Cloud	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Int64 Software

Product	MITRE ATT&CK® TTP	Content
OVERLAPS	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Ipswitch

Product	MITRE ATT&CK® TTP	Content
MoveIt Transfer	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	61 Rules 31 Models

Vendor: Ironscales

Product	MITRE ATT&CK® TTP	Content
Ironscales	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	28 Rules 16 Models

Vendor: Island

Product	MITRE ATT&CK® TTP	Content
Island Enterprise Browser	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Ivanti

Product	MITRE ATT&CK® TTP	Content
Ivanti Pulse Secure	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	93 Rules 54 Models

Vendor: Jamf

Product	MITRE ATT&CK® TTP	Content
Jamf Protect	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	91 Rules 38 Models

Vendor: Jumpcloud

Product	MITRE ATT&CK® TTP	Content
Jumpcloud	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Juniper Networks

Product	MITRE ATT&CK® TTP	Content
Juniper SRX Series	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	63 Rules 33 Models
Junos OS	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	30 Rules 5 Models

Vendor: Kasada

Product	MITRE ATT&CK® TTP	Content
Kasada	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Kaspersky

Product	MITRE ATT&CK® TTP	Content
Kaspersky Endpoint Security for Business	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: Kemp

Product	MITRE ATT&CK® TTP	Content
Kemp LoadMaster	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: KnowBe4

Product	MITRE ATT&CK® TTP	Content
Security Awareness Training	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Kong

Product	MITRE ATT&CK® TTP	Content
Kong Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: LanScope

Product	MITRE ATT&CK® TTP	Content
LanScope Cat	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	35 Rules 22 Models

Vendor: LastPass

Product	MITRE ATT&CK® TTP	Content
LastPass	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: LiquidFiles

Product	MITRE ATT&CK® TTP	Content
LiquidFiles	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: LogRhythm

Product	MITRE ATT&CK® TTP	Content
LogRhythm	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	103 Rules 43 Models
NetMon	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models

Vendor: Lookout

Product	MITRE ATT&CK® TTP	Content
Lookout	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models

Vendor: Malwarebytes

Product	MITRE ATT&CK® TTP	Content
Malwarebytes Endpoint Protection	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: ManageEngine

Product	MITRE ATT&CK® TTP	Content
ADAuditPlus	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
ADManager Plus	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
ADSSP	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
PAM360	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	74 Rules 39 Models

Vendor: MariaDB

Product	MITRE ATT&CK® TTP	Content
MariaDB	T1213 - Data from Information Repositories	18 Rules 10 Models

Vendor: McAfee

Product	MITRE ATT&CK® TTP	Content
McAfee Web Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Menlo Security

Product	MITRE ATT&CK® TTP	Content
Menlo Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	63 Rules 31 Models

Vendor: Microsoft

Product	MITRE ATT&CK® TTP	Content
Active Directory Federation Services	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	35 Rules 22 Models
Azure	T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1133 - External Remote Services	42 Rules 27 Models
Azure AD Activity Logs	T1003 - OS Credential Dumping T1003.006 - OS Credential Dumping: DCSync T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1133 - External Remote Services T1207 - Rogue Domain Controller T1213 - Data from Information Repositories T1558 - Steal or Forge Kerberos Tickets	67 Rules 38 Models
Azure AD Sign-In Logs	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	28 Rules 16 Models
Azure ATP	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models
Azure Container Registry	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Azure DevOps	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Azure Event Hub	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Azure Key Vault	T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	46 Rules 27 Models
Azure Kubernetes Service	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Azure MFA	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Azure Monitor	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1078.004 - Valid Accounts: Cloud Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1187 - Forced Authentication T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1213 - Data from Information Repositories T1535 - Unused/Unsupported Cloud Regions T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	212 Rules 108 Models
Azure Monitor - VM Insights	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	29 Rules 5 Models
Copilot	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
Event Viewer - ADFS	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	74 Rules 46 Models
Event Viewer - ADWS	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Application	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	128 Rules 58 Models
Event Viewer - Applocker	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
Event Viewer - AzureADPasswordProtection-DCAgent	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - AzureADPasswordProtection-ProxyService	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - BFE Resorce Flows	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - BITS-Client	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - CAPI2	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - CodeIntegrity	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - DFS-Replication	T1003 - OS Credential Dumping T1003.006 - OS Credential Dumping: DCSync T1078 - Valid Accounts T1133 - External Remote Services T1207 - Rogue Domain Controller T1558 - Steal or Forge Kerberos Tickets	46 Rules 25 Models
Event Viewer - DNSServer	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Directory-Service	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - File Replication Service	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - FileShareShadowCopyProvider	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Kerberos-Key-Distribution-Center	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Kernel-IO	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Kernel-PnP	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - KnownFolders	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - LSA	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Licensing-Platform	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - LiveId	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - NPS	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
Event Viewer - NTLM	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	34 Rules 13 Models
Event Viewer - NetworkProfile	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - OpenSSH	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	36 Rules 16 Models
Event Viewer - PowerShell	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	68 Rules 29 Models
Event Viewer - RemoteDesktopServices	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - SMB	T1078 - Valid Accounts T1133 - External Remote Services T1187 - Forced Authentication	40 Rules 24 Models
Event Viewer - Security	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1003.006 - OS Credential Dumping: DCSync T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1078.004 - Valid Accounts: Cloud Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1187 - Forced Authentication T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1207 - Rogue Domain Controller T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	228 Rules 104 Models
Event Viewer - Setup	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - System	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	92 Rules 38 Models
Event Viewer - TaskScheduler	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - TerminalServices	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - TerminalServices-Gateway	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	41 Rules 19 Models
Event Viewer - TerminalServices-RemoteConnectionManager	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	39 Rules 19 Models
Event Viewer - WinNat	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	25 Rules 12 Models
Event Viewer - WinRM	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Event Viewer - Windows Firewall	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
M365 Audit Logs	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
MSSQL	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1213 - Data from Information Repositories T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	94 Rules 57 Models
Microsoft 365	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	138 Rules 69 Models
Microsoft Advanced Threat Analytics	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	80 Rules 42 Models
Microsoft CAS	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	101 Rules 50 Models
Microsoft DHCP Log	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Microsoft Defender	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1003.006 - OS Credential Dumping: DCSync T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1207 - Rogue Domain Controller T1213 - Data from Information Repositories T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	248 Rules 112 Models
Microsoft Defender for Cloud	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
Microsoft Entra	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Microsoft Exchange	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	65 Rules 33 Models
Microsoft IIS	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Microsoft Intune	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Microsoft Network Policy Server	T1021 - Remote Services T1078 - Valid Accounts T1133 - External Remote Services	13 Rules 7 Models
Microsoft RRAS	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	57 Rules 32 Models
Microsoft Sentinel	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	95 Rules 38 Models
Microsoft WMI Log	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	68 Rules 29 Models
NetLogon	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	36 Rules 16 Models
Sysmon	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	105 Rules 44 Models
Windows	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Windows Defender Application Control	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	67 Rules 35 Models
Windows Device registration service	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Mimecast

Product	MITRE ATT&CK® TTP	Content
Code42 Incydr	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	94 Rules 47 Models
Mimecast Secure Email Gateway	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Mimecast Targeted Threat Protection - URL	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Monday.com

Product	MITRE ATT&CK® TTP	Content
Monday.com	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Mvision

Product	MITRE ATT&CK® TTP	Content
Mvision	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Mysql

Product	MITRE ATT&CK® TTP	Content
Mysql	T1213 - Data from Information Repositories	18 Rules 10 Models

Vendor: Nasuni

Product	MITRE ATT&CK® TTP	Content
Nasuni	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services	70 Rules 38 Models

Vendor: NetApp

Product	MITRE ATT&CK® TTP	Content
NetApp	T1083 - File and Directory Discovery	24 Rules 13 Models
NetApp Ontap	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: NetMotion Wireless

Product	MITRE ATT&CK® TTP	Content
NetMotion Wireless	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: Netskope

Product	MITRE ATT&CK® TTP	Content
Netskope CASB	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Netskope Security Cloud	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	138 Rules 69 Models
Netskope Webtx	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Netwrix

Product	MITRE ATT&CK® TTP	Content
Netwrix Auditor	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	61 Rules 31 Models

Vendor: NextDLP

Product	MITRE ATT&CK® TTP	Content
Reveal	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	107 Rules 54 Models

Vendor: Nozomi Networks

Product	MITRE ATT&CK® TTP	Content
Nozomi Networks Guardian	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models

Vendor: OSSEC

Product	MITRE ATT&CK® TTP	Content
OSSEC	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Obsidian Security

Product	MITRE ATT&CK® TTP	Content
SaaS Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Okta

Product	MITRE ATT&CK® TTP	Content
Okta Adaptive MFA	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: Onapsis

Product	MITRE ATT&CK® TTP	Content
Onapsis	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: OneLogin

Product	MITRE ATT&CK® TTP	Content
OneLogin	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: OneSpan

Product	MITRE ATT&CK® TTP	Content
Digipass for Apps	T1021 - Remote Services T1078 - Valid Accounts	6 Rules 3 Models

Vendor: OneWelcome

Product	MITRE ATT&CK® TTP	Content
OneWelcome Cloud Identity Platform	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: Open Shift

Product	MITRE ATT&CK® TTP	Content
OpenShift	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Open VPN

Product	MITRE ATT&CK® TTP	Content
Open VPN	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	58 Rules 32 Models

Vendor: OpenAI

Product	MITRE ATT&CK® TTP	Content
ChatGPT	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: OpenDJ

Product	MITRE ATT&CK® TTP	Content
OpenDJ	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: OpenLDAP

Product	MITRE ATT&CK® TTP	Content
OpenLDAP	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Oracle

Product	MITRE ATT&CK® TTP	Content
Oracle Cloud Infrastructure	T1078 - Valid Accounts T1133 - External Remote Services T1213 - Data from Information Repositories	49 Rules 29 Models
Oracle Database	T1078 - Valid Accounts T1213 - Data from Information Repositories	19 Rules 10 Models
Oracle Public Cloud	T1046 - Network Service Scanning T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	44 Rules 25 Models
Solaris	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	29 Rules 5 Models

Vendor: Ordr

Product	MITRE ATT&CK® TTP	Content
Ordr SCE	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Osquery

Product	MITRE ATT&CK® TTP	Content
Osquery	T1078 - Valid Accounts T1133 - External Remote Services T1213 - Data from Information Repositories	57 Rules 34 Models

Vendor: PagerDuty

Product	MITRE ATT&CK® TTP	Content
PagerDuty	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Palo Alto Networks

Product	MITRE ATT&CK® TTP	Content
Cortex XDR	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	70 Rules 35 Models
Cortex XSOAR	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
GlobalProtect	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	99 Rules 50 Models
Palo Alto Aperture	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services	71 Rules 38 Models
Palo Alto NGFW	T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	162 Rules 83 Models
Palo Alto WildFire	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Prisma Access	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	109 Rules 59 Models
Prisma Cloud	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	102 Rules 55 Models

Vendor: Password Manager Pro

Product	MITRE ATT&CK® TTP	Content
Password Manager Pro	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	70 Rules 38 Models

Vendor: Perforce

Product	MITRE ATT&CK® TTP	Content
Perforce	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Ping Identity

Product	MITRE ATT&CK® TTP	Content
ForgeRock	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models
Ping Access	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Ping Identity	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
PingFederate	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
PingOne	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Portkey

Product	MITRE ATT&CK® TTP	Content
Portkey	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Portnox

Product	MITRE ATT&CK® TTP	Content
Portnox Cloud	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: PostgreSQL

Product	MITRE ATT&CK® TTP	Content
PostgreSQL	T1213 - Data from Information Repositories	18 Rules 10 Models

Vendor: PowerSentry

Product	MITRE ATT&CK® TTP	Content
PowerSentry	T1078 - Valid Accounts	1 Rules

Vendor: Progress

Product	MITRE ATT&CK® TTP	Content
Progress ShareFile	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	74 Rules 38 Models

Vendor: Proofpoint

Product	MITRE ATT&CK® TTP	Content
ObserveIT	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
Proofpoint CASB	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Proofpoint Enterprise Protection	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Qualys

Product	MITRE ATT&CK® TTP	Content
Qualys AssetView	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: Quest Software

Product	MITRE ATT&CK® TTP	Content
Quest Change Auditor for Active Directory	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Quest Change Auditor for SQL Server	T1213 - Data from Information Repositories	18 Rules 10 Models

Vendor: RSA

Product	MITRE ATT&CK® TTP	Content
RSA Authentication Manager	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
SecurID	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: Radware

Product	MITRE ATT&CK® TTP	Content
Alteon	T1078 - Valid Accounts	1 Rules
Radware WAF	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Rapid7

Product	MITRE ATT&CK® TTP	Content
Rapid7 InsightVM	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: RedShield

Product	MITRE ATT&CK® TTP	Content
RedShield WAF	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models

Vendor: Rubrik

Product	MITRE ATT&CK® TTP	Content
Rubrik Cloud Data Management	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: SAP

Product	MITRE ATT&CK® TTP	Content
SAP	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: SIGSCI

Product	MITRE ATT&CK® TTP	Content
SIGSCI	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models

Vendor: Sailpoint

Product	MITRE ATT&CK® TTP	Content
IdentityNow	T1078 - Valid Accounts T1133 - External Remote Services	40 Rules 24 Models
SecurityIQ	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Salesforce

Product	MITRE ATT&CK® TTP	Content
Salesforce	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	111 Rules 60 Models

Vendor: Sangfor

Product	MITRE ATT&CK® TTP	Content
Sangfor NGAF	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: Saviynt

Product	MITRE ATT&CK® TTP	Content
Saviynt	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Secomea

Product	MITRE ATT&CK® TTP	Content
Secomea	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	27 Rules 16 Models

Vendor: SecureAuth

Product	MITRE ATT&CK® TTP	Content
SecureAuth IDP	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	50 Rules 25 Models
SecureAuth Login	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: SecureLink

Product	MITRE ATT&CK® TTP	Content
SecureLink	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models

Vendor: SecureNet

Product	MITRE ATT&CK® TTP	Content
SecureNet	T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services	25 Rules 12 Models

Vendor: Semperis

Product	MITRE ATT&CK® TTP	Content
Semperis DSP	T1003 - OS Credential Dumping T1003.006 - OS Credential Dumping: DCSync T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1207 - Rogue Domain Controller T1558 - Steal or Forge Kerberos Tickets	57 Rules 26 Models

Vendor: SentinelOne

Product	MITRE ATT&CK® TTP	Content
Singularity Platform	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	200 Rules 91 Models
Vigilance	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: ServiceNow

Product	MITRE ATT&CK® TTP	Content
ServiceNow	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	109 Rules 61 Models

Vendor: Shibboleth

Product	MITRE ATT&CK® TTP	Content
Shibboleth	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	27 Rules 16 Models

Vendor: Silverfort

Product	MITRE ATT&CK® TTP	Content
Silverfort Authentication Platform	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	28 Rules 16 Models

Vendor: SiteMinder

Product	MITRE ATT&CK® TTP	Content
Symantec SiteMinder	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: SkySea

Product	MITRE ATT&CK® TTP	Content
SkySea ClientView	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1187 - Forced Authentication T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	164 Rules 74 Models

Vendor: Skyformation

Product	MITRE ATT&CK® TTP	Content
Skyformation	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	27 Rules 16 Models

Vendor: Skyhigh Security

Product	MITRE ATT&CK® TTP	Content
Secure Web Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	68 Rules 38 Models
Skyhigh CASB	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	65 Rules 33 Models
Skyhigh Security Cloud	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	106 Rules 55 Models

Vendor: Slack

Product	MITRE ATT&CK® TTP	Content
Slack	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: SmartSuite

Product	MITRE ATT&CK® TTP	Content
SmartSuite	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Snort

Product	MITRE ATT&CK® TTP	Content
Snort	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models

Vendor: Snowflake

Product	MITRE ATT&CK® TTP	Content
Snowflake	T1213 - Data from Information Repositories	18 Rules 10 Models

Vendor: Sophos

Product	MITRE ATT&CK® TTP	Content
Sophos Endpoint Protection	T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	54 Rules 25 Models
Sophos UTM	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Sophos XG Firewall	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	68 Rules 38 Models
Sophos XGS Firewall	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1110 - Brute Force T1133 - External Remote Services T1190 - Exploit Public Fasing Application	61 Rules 29 Models

Vendor: Splunk

Product	MITRE ATT&CK® TTP	Content
Splunk ES	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Squid

Product	MITRE ATT&CK® TTP	Content
Squid	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models

Vendor: StealthBits

Product	MITRE ATT&CK® TTP	Content
StealthIntercept	T1003 - OS Credential Dumping T1003.006 - OS Credential Dumping: DCSync T1207 - Rogue Domain Controller T1558 - Steal or Forge Kerberos Tickets	7 Rules 1 Models

Vendor: SunOne

Product	MITRE ATT&CK® TTP	Content
SunOne	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models

Vendor: Suricata

Product	MITRE ATT&CK® TTP	Content
Suricata	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models

Vendor: Swift

Product	MITRE ATT&CK® TTP	Content
Swift	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	68 Rules 37 Models

Vendor: Swimlane

Product	MITRE ATT&CK® TTP	Content
Swimlane Turbine	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Swivel

Product	MITRE ATT&CK® TTP	Content
Swivel	T1078 - Valid Accounts	1 Rules

Vendor: Symantec

Product	MITRE ATT&CK® TTP	Content
Symantec Advanced Threat Protection	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	67 Rules 35 Models
Symantec CloudSOC	T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	67 Rules 37 Models
Symantec Content Analysis System	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Symantec DLP	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
Symantec Email Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Symantec Endpoint Protection	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application TA0002 - TA0002	84 Rules 44 Models
Symantec VIP	T1078 - Valid Accounts T1133 - External Remote Services	7 Rules 4 Models
Symantec Web Security Service	T1021 - Remote Services T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 41 Models

Vendor: Synology NAS

Product	MITRE ATT&CK® TTP	Content
Synology NAS	T1187 - Forced Authentication	1 Rules

Vendor: Sysdig

Product	MITRE ATT&CK® TTP	Content
Sysdig Monitor	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools TA0002 - TA0002	7 Rules 2 Models

Vendor: TXOne Networks

Product	MITRE ATT&CK® TTP	Content
StellarOne	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
StellarProtect	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: Tanium

Product	MITRE ATT&CK® TTP	Content
Tanium Cloud Platform	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	27 Rules 16 Models
Tanium Core Platform	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
Tanium Integrity Monitor	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1083 - File and Directory Discovery	31 Rules 14 Models
Tanium Threat Response	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Tenable

Product	MITRE ATT&CK® TTP	Content
Tenable Cloud Security	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Tenable Identity Exposure	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Tenable Vulnerability Management	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models
Tenable Web App Scanning	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Teradata

Product	MITRE ATT&CK® TTP	Content
Teradata RDBMS	T1213 - Data from Information Repositories	10 Rules 5 Models

Vendor: ThoughtSpot

Product	MITRE ATT&CK® TTP	Content
ThoughtSpot	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Trellix

Product	MITRE ATT&CK® TTP	Content
Trellix Central Management	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Trellix Database Security	T1213 - Data from Information Repositories	36 Rules 19 Models
Trellix Email Security	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Trellix Endpoint Security	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	125 Rules 62 Models
Trellix Endpoint Security (HX)	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Trellix Helix	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
Trellix Network Security (NX)	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1213 - Data from Information Repositories T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	150 Rules 72 Models
Trellix Network Security Platform	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
Trellix Web MPS	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Trend Micro

Product	MITRE ATT&CK® TTP	Content
Apex One	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Deep Discovery Inspector	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	50 Rules 25 Models
Deep Security	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	113 Rules 48 Models
OfficeScan	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
TippingPoint NGIPS	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	41 Rules 18 Models
Trend Micro ScanMail	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models
Vision One	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: Unix

Product	MITRE ATT&CK® TTP	Content
Auditbeat	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	67 Rules 23 Models
Unix	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1213 - Data from Information Repositories T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	181 Rules 77 Models
Unix Auditd	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	103 Rules 45 Models
Unix Named	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: VBCorp

Product	MITRE ATT&CK® TTP	Content
VBCorp	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: VMware

Product	MITRE ATT&CK® TTP	Content
Carbon Black App Control	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	126 Rules 53 Models
Carbon Black CES	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	122 Rules 52 Models
Carbon Black EDR	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	109 Rules 44 Models
VMware AirWatch	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
VMware ESXi	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1021 - Remote Services T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	128 Rules 66 Models
VMware Horizon	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	62 Rules 32 Models
VMware NSX	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models
VMware View	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	75 Rules 39 Models
vCenter	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets	77 Rules 40 Models

Vendor: Varonis

Product	MITRE ATT&CK® TTP	Content
Varonis Data Security Platform	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1190 - Exploit Public Fasing Application	55 Rules 23 Models

Vendor: Vectra

Product	MITRE ATT&CK® TTP	Content
Vectra Cognito Detect	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: Veeam

Product	MITRE ATT&CK® TTP	Content
Veeam	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	62 Rules 33 Models

Vendor: Venafi

Product	MITRE ATT&CK® TTP	Content
TLS Protect	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Vormetric

Product	MITRE ATT&CK® TTP	Content
Vormetric	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services	71 Rules 38 Models

Vendor: Wallix

Product	MITRE ATT&CK® TTP	Content
Wallix Bastion	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: Watchguard

Product	MITRE ATT&CK® TTP	Content
Watchguard	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	79 Rules 46 Models

Vendor: Wiz

Product	MITRE ATT&CK® TTP	Content
Wiz	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	66 Rules 33 Models

Vendor: Workday

Product	MITRE ATT&CK® TTP	Content
Workday	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models

Vendor: Zeek

Product	MITRE ATT&CK® TTP	Content
Zeek	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1187 - Forced Authentication T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	195 Rules 97 Models

Vendor: Zero Networks

Product	MITRE ATT&CK® TTP	Content
Zero Networks	T1078 - Valid Accounts T1133 - External Remote Services	39 Rules 24 Models

Vendor: ZeroFox

Product	MITRE ATT&CK® TTP	Content
ZeroFox Protection	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Zimperium

Product	MITRE ATT&CK® TTP	Content
Zimperium MTD	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	23 Rules 9 Models

Vendor: Zscaler

Product	MITRE ATT&CK® TTP	Content
Zscaler Breach Predictor	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models
Zscaler Deception	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models
Zscaler Internet Access	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	138 Rules 69 Models
Zscaler Private Access	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1110 - Brute Force T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	101 Rules 54 Models

Vendor: Zyxel Networks

Product	MITRE ATT&CK® TTP	Content
Zyxel USG FLEX	T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1190 - Exploit Public Fasing Application	21 Rules 9 Models

Vendor:

Vendor: iBoss

Product	MITRE ATT&CK® TTP	Content
Iboss Cloud	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	40 Rules 22 Models