2_ds_secureauth_secureauth_login.md

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	app-activity ↳secureauth-login-cef-app-activity-appactivity ↳secureauth-login-leef-app-activity ↳secureauth-login-xml-app-activity-catchall-auditeventid app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority authentication-successful ↳secureauth-login-kv-endpoint-login-success-20000 ↳secureauth-login-leef-endpoint-login-success-sessionstart ↳secureauth-login-kv-endpoint-login-20990-1 ↳secureauth-login-xml-endpoint-login-20990 ↳secureauth-login-kv-app-authentication-51170 ↳secureauth-login-kv-app-authentication-24120 ↳secureauth-login-kv-app-authentication-fail-22600 ↳secureauth-login-xml-app-activity-catchall-auditeventid ↳secureauth-login-xml-app-activity-catchall-auditeventid	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	42 Rules 24 Models
Data Access	app-activity ↳secureauth-login-cef-app-activity-appactivity ↳secureauth-login-leef-app-activity ↳secureauth-login-xml-app-activity-catchall-auditeventid app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority	T1078 - Valid Accounts	19 Rules 11 Models
Lateral Movement	app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority authentication-failed ↳secureauth-login-kv-endpoint-login-20990-1 ↳secureauth-login-xml-endpoint-login-20990 ↳secureauth-login-kv-app-authentication-fail-22610 ↳secureauth-login-kv-app-authentication-fail-51150 ↳secureauth-login-kv-app-authentication-fail-41501-1 ↳secureauth-login-kv-app-authentication-fail-41501 ↳secureauth-login-kv-app-authentication-fail-24220 ↳secureauth-login-kv-app-authentication-fail-24210 ↳secureauth-login-kv-app-authentication-fail-22910 ↳secureauth-login-xml-app-activity-catchall-auditeventid authentication-successful ↳secureauth-login-kv-endpoint-login-success-20000 ↳secureauth-login-leef-endpoint-login-success-sessionstart ↳secureauth-login-kv-endpoint-login-20990-1 ↳secureauth-login-xml-endpoint-login-20990 ↳secureauth-login-kv-app-authentication-51170 ↳secureauth-login-kv-app-authentication-24120 ↳secureauth-login-kv-app-authentication-fail-22600 ↳secureauth-login-xml-app-activity-catchall-auditeventid ↳secureauth-login-xml-app-activity-catchall-auditeventid	T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Malware	app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority authentication-successful ↳secureauth-login-kv-endpoint-login-success-20000 ↳secureauth-login-leef-endpoint-login-success-sessionstart ↳secureauth-login-kv-endpoint-login-20990-1 ↳secureauth-login-xml-endpoint-login-20990 ↳secureauth-login-kv-app-authentication-51170 ↳secureauth-login-kv-app-authentication-24120 ↳secureauth-login-kv-app-authentication-fail-22600 ↳secureauth-login-xml-app-activity-catchall-auditeventid ↳secureauth-login-xml-app-activity-catchall-auditeventid	T1078 - Valid Accounts	1 Rules
Privilege Abuse	app-activity ↳secureauth-login-cef-app-activity-appactivity ↳secureauth-login-leef-app-activity ↳secureauth-login-xml-app-activity-catchall-auditeventid app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Privileged Activity	app-activity ↳secureauth-login-cef-app-activity-appactivity ↳secureauth-login-leef-app-activity ↳secureauth-login-xml-app-activity-catchall-auditeventid app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority	T1078 - Valid Accounts	2 Rules 1 Models
Ransomware	app-login ↳secureauth-login-kv-app-login-90010 ↳secureauth-login-xml-app-login-success-priority authentication-failed ↳secureauth-login-kv-endpoint-login-20990-1 ↳secureauth-login-xml-endpoint-login-20990 ↳secureauth-login-kv-app-authentication-fail-22610 ↳secureauth-login-kv-app-authentication-fail-51150 ↳secureauth-login-kv-app-authentication-fail-41501-1 ↳secureauth-login-kv-app-authentication-fail-41501 ↳secureauth-login-kv-app-authentication-fail-24220 ↳secureauth-login-kv-app-authentication-fail-24210 ↳secureauth-login-kv-app-authentication-fail-22910 ↳secureauth-login-xml-app-activity-catchall-auditeventid authentication-successful ↳secureauth-login-kv-endpoint-login-success-20000 ↳secureauth-login-leef-endpoint-login-success-sessionstart ↳secureauth-login-kv-endpoint-login-20990-1 ↳secureauth-login-xml-endpoint-login-20990 ↳secureauth-login-kv-app-authentication-51170 ↳secureauth-login-kv-app-authentication-24120 ↳secureauth-login-kv-app-authentication-fail-22600 ↳secureauth-login-xml-app-activity-catchall-auditeventid ↳secureauth-login-xml-app-activity-catchall-auditeventid	T1078 - Valid Accounts	2 Rules