Vendor: ManageEngine

October 24, 2023 · View on GitHub

Product: ADSSP

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
7533944
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-activity
manageengine-adssp-cef-app-activity-success-selfunlock
manageengine-adssp-cef-app-activity-success-unlockaccountattempt
manageengine-adssp-cef-app-activity-success-enrollment

app-login
manageengine-adssp-cef-app-login-success-passwordloginsuccess

failed-app-login
manageengine-adssp-cef-app-login-fail-passwordlogin
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationapp-activity
manageengine-adssp-cef-app-activity-success-selfunlock
manageengine-adssp-cef-app-activity-success-unlockaccountattempt
manageengine-adssp-cef-app-activity-success-enrollment
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Data Leakapp-activity
manageengine-adssp-cef-app-activity-success-selfunlock
manageengine-adssp-cef-app-activity-success-unlockaccountattempt
manageengine-adssp-cef-app-activity-success-enrollment
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Privilege Escalationapp-activity
manageengine-adssp-cef-app-activity-success-selfunlock
manageengine-adssp-cef-app-activity-success-unlockaccountattempt
manageengine-adssp-cef-app-activity-success-enrollment
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Valid Accounts: Cloud Accounts

Exploit Public Fasing Application

User Execution

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Unused/Unsupported Cloud Regions

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy