r_m_cisco_npe_Privileged_Activity.md

Vendor: Cisco

Product: NPE

Use-Case: Privileged Activity

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
2	0	1	1	1

Event Type	Rules	Models
process-created	T1482 - Domain Trust Discovery ↳ A-Trickbot-Recon: Trickbot malware domain recon activity on this asset ↳ Trickbot-Recon: Trickbot malware domain recon activity