2_ds_auth0_auth0.md

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	app-activity ↳auth0-a-json-http-session-success-sapi ↳auth0-a-json-app-activity-success-catchall app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail authentication-successful ↳auth0-a-json-app-authentication-success-startauth ↳auth0-a-json-app-authentication-success-gd_auth_succeed ↳auth0-a-json-endpoint-login-success-verification ↳auth0-a-json-endpoint-login-success-exchange failed-app-login ↳auth0-a-json-app-login-fail-fcpr ↳auth0-a-json-app-login-fail-limitwc ↳auth0-a-json-app-login-fail-apilimit ↳auth0-a-json-app-login-fail-fu ↳auth0-a-json-app-login-fail-fsa failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent file-read ↳dell-emcisilon-str-file-read-success-open-1 remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection security-alert ↳auth0-a-json-alert-trigger-success-pwdleak ↳auth0-a-json-alert-trigger-success-pwdleak web-activity-allowed ↳auth0-a-json-http-session-success-mgmt_api_read ↳forcepoint-wsg-cef-http-session-success-httpurllogged	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.003 - T1003.003 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1102 - Web Service T1133 - External Remote Services T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	164 Rules 85 Models
Data Access	app-activity ↳auth0-a-json-http-session-success-sapi ↳auth0-a-json-app-activity-success-catchall app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail failed-app-login ↳auth0-a-json-app-login-fail-fcpr ↳auth0-a-json-app-login-fail-limitwc ↳auth0-a-json-app-login-fail-apilimit ↳auth0-a-json-app-login-fail-fu ↳auth0-a-json-app-login-fail-fsa file-read ↳dell-emcisilon-str-file-read-success-open-1	T1078 - Valid Accounts T1083 - File and Directory Discovery	44 Rules 24 Models
Lateral Movement	app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail authentication-failed ↳silverfort-s-kv-endpoint-login-fail-request ↳auth0-a-json-app-authentication-fail-warning ↳auth0-a-json-app-authentication-fail-gd_auth_failed authentication-successful ↳auth0-a-json-app-authentication-success-startauth ↳auth0-a-json-app-authentication-success-gd_auth_succeed ↳auth0-a-json-endpoint-login-success-verification ↳auth0-a-json-endpoint-login-success-exchange failed-app-login ↳auth0-a-json-app-login-fail-fcpr ↳auth0-a-json-app-login-fail-limitwc ↳auth0-a-json-app-login-fail-apilimit ↳auth0-a-json-app-login-fail-fu ↳auth0-a-json-app-login-fail-fsa failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection security-alert ↳auth0-a-json-alert-trigger-success-pwdleak ↳auth0-a-json-alert-trigger-success-pwdleak web-activity-allowed ↳auth0-a-json-http-session-success-mgmt_api_read ↳forcepoint-wsg-cef-http-session-success-httpurllogged	T1018 - Remote System Discovery T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy T1110 - Brute Force T1110.003 - T1110.003 T1190 - Exploit Public Fasing Application T1550 - Use Alternate Authentication Material T1550.002 - Use Alternate Authentication Material: Pass the Hash T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting	50 Rules 13 Models
Malware	app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail authentication-successful ↳auth0-a-json-app-authentication-success-startauth ↳auth0-a-json-app-authentication-success-gd_auth_succeed ↳auth0-a-json-endpoint-login-success-verification ↳auth0-a-json-endpoint-login-success-exchange failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection security-alert ↳auth0-a-json-alert-trigger-success-pwdleak ↳auth0-a-json-alert-trigger-success-pwdleak web-activity-allowed ↳auth0-a-json-http-session-success-mgmt_api_read ↳forcepoint-wsg-cef-http-session-success-httpurllogged	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1189 - Drive-by Compromise T1190 - Exploit Public Fasing Application T1204 - User Execution T1204.001 - T1204.001 T1210 - Exploitation of Remote Services T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1566 - Phishing T1566.002 - Phishing: Spearphishing Link T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	30 Rules 9 Models
Privilege Abuse	account-deleted ↳auth0-a-json-user-delete-success-userdeletion account-password-change ↳auth0-a-json-user-password-modify-success-changepassword app-activity ↳auth0-a-json-http-session-success-sapi ↳auth0-a-json-app-activity-success-catchall app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail failed-app-login ↳auth0-a-json-app-login-fail-fcpr ↳auth0-a-json-app-login-fail-limitwc ↳auth0-a-json-app-login-fail-apilimit ↳auth0-a-json-app-login-fail-fu ↳auth0-a-json-app-login-fail-fsa failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent file-read ↳dell-emcisilon-str-file-read-success-open-1 remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection web-activity-allowed ↳auth0-a-json-http-session-success-mgmt_api_read ↳forcepoint-wsg-cef-http-session-success-httpurllogged	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1531 - Account Access Removal	22 Rules 9 Models
Privilege Escalation	app-activity ↳auth0-a-json-http-session-success-sapi ↳auth0-a-json-app-activity-success-catchall failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1210 - Exploitation of Remote Services T1555 - Credentials from Password Stores T1555.005 - T1555.005	6 Rules 2 Models
Privileged Activity	app-activity ↳auth0-a-json-http-session-success-sapi ↳auth0-a-json-app-activity-success-catchall app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail failed-app-login ↳auth0-a-json-app-login-fail-fcpr ↳auth0-a-json-app-login-fail-limitwc ↳auth0-a-json-app-login-fail-apilimit ↳auth0-a-json-app-login-fail-fu ↳auth0-a-json-app-login-fail-fsa failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent file-read ↳dell-emcisilon-str-file-read-success-open-1 remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection security-alert ↳auth0-a-json-alert-trigger-success-pwdleak ↳auth0-a-json-alert-trigger-success-pwdleak web-activity-allowed ↳auth0-a-json-http-session-success-mgmt_api_read ↳forcepoint-wsg-cef-http-session-success-httpurllogged	T1021 - Remote Services T1068 - Exploitation for Privilege Escalation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1102 - Web Service	21 Rules 8 Models
Ransomware	app-login ↳auth0-a-json-app-login-success-s ↳auth0-a-json-app-login-success-seacft ↳auth0-a-json-app-login-success-ss ↳auth0-a-json-app-login-success-ssa ↳auth0-a-json-app-login-success-seccft ↳auth0-a-json-app-login-success-changeemail authentication-failed ↳silverfort-s-kv-endpoint-login-fail-request ↳auth0-a-json-app-authentication-fail-warning ↳auth0-a-json-app-authentication-fail-gd_auth_failed authentication-successful ↳auth0-a-json-app-authentication-success-startauth ↳auth0-a-json-app-authentication-success-gd_auth_succeed ↳auth0-a-json-endpoint-login-success-verification ↳auth0-a-json-endpoint-login-success-exchange failed-app-login ↳auth0-a-json-app-login-fail-fcpr ↳auth0-a-json-app-login-fail-limitwc ↳auth0-a-json-app-login-fail-apilimit ↳auth0-a-json-app-login-fail-fu ↳auth0-a-json-app-login-fail-fsa failed-logon ↳auth0-a-json-endpoint-login-fail-invalidrequest-1 ↳auth0-a-json-endpoint-login-fail-invalidrequest ↳eset-ep-leef-endpoint-login-fail-auditevent remote-logon ↳ca-pamsc-kv-rdp-traffic-success-connection web-activity-allowed ↳auth0-a-json-http-session-success-mgmt_api_read ↳forcepoint-wsg-cef-http-session-success-httpurllogged	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	3 Rules