Vendor: LogRhythm

November 29, 2023 · View on GitHub

Product: LogRhythm

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
6326522
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-activity
microsoft-m365auditlogs-kv-file-share-sharingset
microsoft-m365auditlogs-kv-file-read-success-pageviewed
microsoft-m365auditlogs-kv-file-property-modify-sharinginheritancebroken
microsoft-m365auditlogs-kv-group-member-add-addedtogroup
microsoft-m365auditlogs-kv-group-create-groupadded
microsoft-m365auditlogs-kv-app-notification-success-pageprefetched
microsoft-m365auditlogs-kv-share-link-open-success-companylinkused
microsoft-m365auditlogs-kv-file-unshare-sharingrevoked
microsoft-m365auditlogs-kv-user-modify-changeuserlicense
microsoft-m365auditlogs-kv-user-modify-success-updateserviceprincipal
microsoft-m365auditlogs-kv-user-modify-success-updatestsrefreshtokenvalidfromtimestamp
microsoft-m365auditlogs-kv-user-modify-updateuser
microsoft-m365auditlogs-kv-group-modify-updategroup
microsoft-m365auditlogs-kv-endpoint-modify-success-updatedevice
microsoft-m365auditlogs-kv-user-create-adduser

authentication-failed
microsoft-m365auditlogs-kv-email-send-sendas
microsoft-m365auditlogs-kv-email-send-success-send
microsoft-m365auditlogs-kv-email-send-success-sendonbehalf
microsoft-m365auditlogs-kv-mailbox-item-create-create
microsoft-m365auditlogs-kv-app-login-success-teamssessionstarted
microsoft-m365auditlogs-kv-report-read-success-viewreport
microsoft-m365auditlogs-kv-file-download-success-exportartifact
microsoft-m365auditlogs-kv-file-download-filesyncdownloadedfull
logrhythm-l-csv-network-session-logrhythmdpi
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationapp-activity
microsoft-m365auditlogs-kv-file-share-sharingset
microsoft-m365auditlogs-kv-file-read-success-pageviewed
microsoft-m365auditlogs-kv-file-property-modify-sharinginheritancebroken
microsoft-m365auditlogs-kv-group-member-add-addedtogroup
microsoft-m365auditlogs-kv-group-create-groupadded
microsoft-m365auditlogs-kv-app-notification-success-pageprefetched
microsoft-m365auditlogs-kv-share-link-open-success-companylinkused
microsoft-m365auditlogs-kv-file-unshare-sharingrevoked
microsoft-m365auditlogs-kv-user-modify-changeuserlicense
microsoft-m365auditlogs-kv-user-modify-success-updateserviceprincipal
microsoft-m365auditlogs-kv-user-modify-success-updatestsrefreshtokenvalidfromtimestamp
microsoft-m365auditlogs-kv-user-modify-updateuser
microsoft-m365auditlogs-kv-group-modify-updategroup
microsoft-m365auditlogs-kv-endpoint-modify-success-updatedevice
microsoft-m365auditlogs-kv-user-create-adduser
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy