Skip to content

Latest commit

 

History

History
980 lines (978 loc) · 513 KB

uc_evasion.md

File metadata and controls

980 lines (978 loc) · 513 KB

Use Case: Evasion

Vendor: APC

Product Event Types MITRE TTP Content
APC
  • app-activity
  • network-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: ASUPIM

Product Event Types MITRE TTP Content
ASUPIM
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Absolute

Product Event Types MITRE TTP Content
Absolute SIEM Connector
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: Accellion

Product Event Types MITRE TTP Content
Kiteworks
  • account-password-change
  • account-password-reset
  • account-unlocked
  • app-activity
  • app-login
  • dlp-email-alert-out
  • failed-app-login
  • file-alert
  • file-delete
  • file-download
  • file-permission-change
  • file-read
  • file-upload
  • file-write
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Adaxes

Product Event Types MITRE TTP Content
Adaxes
  • failed-vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: AirWatch

Product Event Types MITRE TTP Content
AirWatch
  • authentication-failed
  • authentication-successful
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Airlock

Product Event Types MITRE TTP Content
Airlock
  • app-activity-failed
  • app-login
  • database-query
  • failed-app-login
  • file-delete
  • file-download
  • file-upload
  • file-write
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 3 Rules
Airlock Web Application Firewall
  • file-upload
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Akamai

Product Event Types MITRE TTP Content
Akamai Siem
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Cloud Akamai
  • file-delete
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: Alert Logic

Product Event Types MITRE TTP Content
Alert Logic
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Amazon

Product Event Types MITRE TTP Content
AWS Bastion
  • app-activity
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
AWS CloudTrail
  • account-password-change
  • app-activity
  • app-login
  • cloud-admin-activity
  • cloud-admin-activity-failed
  • netflow-connection
  • storage-access
  • storage-activity
  • storage-activity-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 3 Rules
AWS CloudWatch
  • app-activity-failed
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
AWS GuardDuty
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules

Vendor: Anywhere365

Product Event Types MITRE TTP Content
Anywhere365
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Apache

Product Event Types MITRE TTP Content
Apache
  • network-connection-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Apache Guacamole
  • app-login
  • file-permission-change
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Apache Subversion
  • app-activity-failed
  • file-delete
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Armis

Product Event Types MITRE TTP Content
Armis
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: AssetView

Product Event Types MITRE TTP Content
AssetView
  • file-download
  • file-write
  • network-connection-failed
  • print-activity
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: Attivo

Product Event Types MITRE TTP Content
BOTsink
  • database-login
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Auth0

Product Event Types MITRE TTP Content
Auth0
  • account-password-change-failed
  • app-login
  • failed-logon
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 4 Rules

Vendor: Avaya

Product Event Types MITRE TTP Content
Avaya Ethernet Routing Switch
  • authentication-successful
  • nac-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Avaya VPN
  • dns-query
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Axway

Product Event Types MITRE TTP Content
Axway SFTP
  • file-upload
  • process-network-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: Badgepoint

Product Event Types MITRE TTP Content
Badgepoint
  • authentication-failed
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Barracuda

Product Event Types MITRE TTP Content
Barracuda Firewall
  • account-lockout
  • database-query
  • failed-vpn-login
  • network-connection-failed
  • network-connection-successful
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 4 Rules

Vendor: BeyondTrust

Product Event Types MITRE TTP Content
BeyondTrust PowerBroker
  • account-enabled
  • dlp-email-alert-out-failed
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
BeyondTrust Privilege Management
  • dns-response
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules
BeyondTrust Privileged Identity
  • account-switch
  • app-activity
  • app-login
  • authentication-successful
  • dlp-alert
  • failed-app-login
  • failed-physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
BeyondTrust Secure Remote Access
  • app-login
  • failed-app-login
  • failed-physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Bitdefender

Product Event Types MITRE TTP Content
Bitdefender GravityZone
  • authentication-successful
  • process-created
  • web-activity-denied
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 44 Rules

Vendor: Bitglass

Product Event Types MITRE TTP Content
Bitglass CASB
  • app-login
  • authentication-successful
  • dlp-email-alert-out
  • failed-app-login
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: BlackBerry

Product Event Types MITRE TTP Content
BlackBerry Protect
  • app-activity
  • file-delete
  • security-alert
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: BlueCat Networks

Product Event Types MITRE TTP Content
BlueCat Networks DHCP
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Box

Product Event Types MITRE TTP Content
Box Cloud Content Management
  • app-activity
  • app-activity-failed
  • file-delete
  • file-download
  • file-permission-change
  • file-read
  • file-upload
  • file-write
  • print-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: CA Technologies

Product Event Types MITRE TTP Content
CA Privileged Access Manager Server Control
  • app-login
  • authentication-failed
  • authentication-successful
  • failed-app-login
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: CDS

Product Event Types MITRE TTP Content
CDS
  • failed-ds-access
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: CatoNetworks

Product Event Types MITRE TTP Content
Cato Cloud
  • failed-logon
  • network-alert
  • vpn-login
  • web-activity-allowed
  • web-activity-denied
  • workstation-unlocked
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
  • 1 Models

Vendor: Centrify

Product Event Types MITRE TTP Content
Centrify Audit and Monitoring Service
  • authentication-successful
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Centrify Authentication Service
  • account-switch
  • authentication-failed
  • local-logon
  • process-created
  • remote-logon
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules
Centrify Infrastructure Services
  • authentication-failed
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Centrify Zero Trust Privilege Services
  • app-activity
  • app-login
  • failed-app-login
  • file-delete
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Check Point Software

Product Event Types MITRE TTP Content
Check Point Identity Awareness
  • failed-vpn-login
  • network-connection-failed
  • network-connection-successful
  • vpn-login
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 9 Rules
  • 1 Models
Check Point NGFW
  • authentication-successful
  • database-update
  • dlp-email-alert-in
  • failed-vpn-login
  • file-permission-change
  • network-alert
  • network-connection-failed
  • network-connection-successful
  • security-alert
  • vpn-connection
  • vpn-login
  • vpn-logout
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 10 Rules
  • 1 Models
Check Point Security Gateway
  • failed-vpn-login
  • network-connection-failed
  • vpn-login
  • vpn-logout
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
  • 1 Models
Check Point Security Gateway Virtual Edition (vSEC)
  • authentication-failed
  • authentication-successful
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models
Check Point Threat Prevention
  • network-alert
  • network-connection-failed
  • network-connection-successful
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 3 Rules

Vendor: Cisco

Product Event Types MITRE TTP Content
ACI
  • app-activity
  • authentication-failed
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
AnyConnect
  • failed-vpn-login
  • nac-logon
  • process-created
  • vpn-login
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules
Cisco
  • authentication-successful
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Cisco ACS
  • account-lockout
  • app-activity
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Cisco Adaptive Security Appliance
  • authentication-successful
  • dlp-email-alert-out
  • file-download
  • print-activity
  • process-created
  • remote-logon
  • security-alert
  • vpn-login
  • vpn-logout
  • web-activity-allowed
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 45 Rules
  • 1 Models
Cisco Call Manager
  • app-activity
  • authentication-failed
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Cisco Cloud Web Security
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Cisco Console
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Cisco Firepower
  • app-activity
  • app-login
  • authentication-successful
  • config-change
  • dns-query
  • dns-response
  • failed-usb-activity
  • netflow-connection
  • network-connection-failed
  • network-connection-successful
  • print-activity
  • security-alert
  • vpn-login
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 9 Rules
  • 1 Models
Cisco ISE
  • account-lockout
  • app-activity
  • authentication-failed
  • computer-logon
  • nac-failed-logon
  • nac-logon
  • network-alert
  • print-activity
  • remote-logon
  • security-alert
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Cisco Meraki MX appliances
  • network-alert
  • network-connection-failed
  • network-connection-successful
  • vpn-login
  • vpn-logout
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
Cisco NPE
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules
Cisco Netflow
  • netflow-connection
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Cisco Secure Web Appliance
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Cisco TACACS
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Cisco Umbrella
  • dns-query
  • dns-response
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models
Duo Access Security
  • app-login
  • authentication-failed
  • authentication-successful
  • failed-logon
  • file-delete
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
IronPort Email
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • network-alert
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules
IronPort Web Security
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Proxy Umbrella
  • app-activity
  • print-activity
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models

Vendor: Citrix

Product Event Types MITRE TTP Content
Citrix AppFW
  • database-query
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Citrix Endpoint Management
  • privileged-access
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Citrix Gateway ActiveSync Connector
  • account-password-change
  • app-activity-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Citrix Netscaler
  • app-login
  • authentication-successful
  • database-access
  • remote-logon
  • vpn-login
  • vpn-logout
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models
Citrix Netscaler VPN
  • app-login
  • authentication-failed
  • dlp-email-alert-in-failed
  • network-connection-failed
  • vpn-login
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 9 Rules
  • 1 Models
Citrix ShareFile
  • app-login
  • failed-app-login
  • file-download
  • file-upload
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
Citrix XenApp
  • app-login
  • failed-app-login
  • failed-vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Citrix XenDesktop
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Netscaler WAF
  • network-connection-successful
  • print-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Web Logging
  • failed-physical-access
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: Clearsense

Product Event Types MITRE TTP Content
Clearsense
  • app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Cloud Application

Product Event Types MITRE TTP Content
Cloud Application
  • app-activity
  • app-login
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Cloudflare

Product Event Types MITRE TTP Content
Cloudflare CDN
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Cloudflare Insights
  • app-login
  • member-added
  • member-removed
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Cloudflare WAF
  • app-activity
  • network-connection-successful
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 9 Rules
  • 1 Models

Vendor: Cognitas CrossLink

Product Event Types MITRE TTP Content
Cognitas CrossLink
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Contrast Security

Product Event Types MITRE TTP Content
Contrast Security
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: CrowdStrike

Product Event Types MITRE TTP Content
Falcon
  • app-activity
  • app-activity-failed
  • app-login
  • authentication-failed
  • batch-logon
  • computer-logon
  • dlp-alert
  • dlp-email-alert-out-failed
  • failed-app-login
  • file-alert
  • file-delete
  • file-download
  • file-read
  • file-write
  • local-logon
  • network-connection-failed
  • network-connection-successful
  • process-alert
  • process-created
  • process-network
  • remote-access
  • remote-logon
  • security-alert
  • service-logon
  • usb-activity
  • usb-insert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1204 - User Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 44 Rules

Vendor: CyberArk

Product Event Types MITRE TTP Content
CyberArk Vault
  • account-password-change
  • account-password-change-failed
  • account-password-reset
  • account-switch
  • app-activity
  • app-activity-failed
  • app-login
  • computer-logon
  • failed-app-login
  • failed-logon
  • file-delete
  • file-read
  • file-write
  • process-created
  • remote-logon
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 40 Rules
Privileged Session Manager
  • app-activity
  • app-login
  • file-permission-change
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Privileged Threat Analytics
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Darktrace

Product Event Types MITRE TTP Content
Darktrace
  • app-login
  • dlp-email-alert-in-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Dell

Product Event Types MITRE TTP Content
Dell EMC Isilon
  • app-activity
  • file-delete
  • file-permission-change
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
RSA Authentication Manager
  • app-activity
  • app-login
  • authentication-failed
  • authentication-successful
  • dlp-alert
  • failed-vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
SonicWALL Aventail
  • nac-failed-logon
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Digital Arts

Product Event Types MITRE TTP Content
Digital Arts i-FILTER for Business
  • security-alert
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: Digital Guardian

Product Event Types MITRE TTP Content
Digital Guardian Endpoint Protection
  • app-login
  • dlp-email-alert-out
  • failed-app-login
  • file-delete
  • file-download
  • file-read
  • file-upload
  • file-write
  • local-logon
  • network-connection-failed
  • network-connection-successful
  • print-activity
  • usb-insert
  • vpn-connection
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: Dropbox

Product Event Types MITRE TTP Content
Dropbox
  • app-activity
  • app-login
  • file-delete
  • file-download
  • file-permission-change
  • file-read
  • file-write
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 2 Rules

Vendor: Dtex Systems

Product Event Types MITRE TTP Content
DTEX InTERCEPT
  • file-delete
  • file-read
  • file-write
  • local-logon
  • print-activity
  • process-created
  • remote-logon
  • usb-write
  • workstation-locked
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules

Vendor: EMP

Product Event Types MITRE TTP Content
EMP
  • app-activity
  • dlp-email-alert-in-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: ESET

Product Event Types MITRE TTP Content
ESET Endpoint Security
  • app-login
  • authentication-successful
  • failed-ds-access
  • failed-logon
  • network-alert
  • security-alert
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules

Vendor: ESector

Product Event Types MITRE TTP Content
ESector DEFESA
  • file-read
  • file-write
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: EdgeWave

Product Event Types MITRE TTP Content
EdgeWave iPrism
  • security-alert
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: Egnyte

Product Event Types MITRE TTP Content
Egnyte
  • account-password-reset
  • app-login
  • file-delete
  • file-download
  • file-permission-change
  • file-upload
  • file-write
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Entrust

Product Event Types MITRE TTP Content
IdentityGuard
  • authentication-failed
  • authentication-successful
  • computer-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Epic

Product Event Types MITRE TTP Content
Epic SIEM
  • account-password-change
  • app-activity
  • app-login
  • authentication-successful
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Exabeam

Product Event Types MITRE TTP Content
Exabeam Advanced Analytics
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Exabeam DL
  • account-password-change
  • app-activity
  • app-login
  • dlp-alert
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Extrahop

Product Event Types MITRE TTP Content
Reveal(x)
  • authentication-successful
  • dns-query
  • network-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: F5

Product Event Types MITRE TTP Content
F5 Advanced Web Application Firewall (WAF)
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • network-connection-successful
  • print-activity
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 40 Rules
F5 BIG-IP
  • app-activity
  • failed-vpn-login
  • print-activity
  • process-alert
  • remote-logon
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
F5 BIG-IP Access Policy Manager (APM)
  • app-activity
  • authentication-failed
  • authentication-successful
  • process-alert
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
F5 BIG-IP Advanced Firewall Module (AFM)
  • app-activity
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 3 Rules
F5 BIG-IP Application Security Manager (ASM)
  • app-activity
  • authentication-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 8 Rules
  • 1 Models
F5 Silverline
  • dlp-email-alert-in-failed
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules
WebSafe
  • app-login
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models

Vendor: FTP

Product Event Types MITRE TTP Content
FTP
  • app-activity
  • app-activity-failed
  • app-login
  • failed-app-login
  • file-delete
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Fidelis

Product Event Types MITRE TTP Content
Fidelis Network
  • failed-logon
  • failed-physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: FileAuditor

Product Event Types MITRE TTP Content
FileAuditor
  • failed-app-login
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: FireEye

Product Event Types MITRE TTP Content
FireEye Email Threat Prevention (ETP)
  • authentication-failed
  • dlp-email-alert-in
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
FireEye Endpoint Security (HX)
  • file-write
  • process-alert
  • security-alert
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules
FireEye Network Security (NX)
  • network-alert
  • security-alert
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: Forcepoint

Product Event Types MITRE TTP Content
Forcepoint CASB
  • account-password-change
  • app-activity
  • failed-app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Forcepoint DLP
  • authentication-failed
  • dlp-alert
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • usb-insert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Forcepoint Insider Threat
  • failed-vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Forcepoint NGFW
  • app-login
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 3 Rules
Websense Secure Gateway
  • nac-failed-logon
  • network-connection-failed
  • usb-insert
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models

Vendor: Forescout

Product Event Types MITRE TTP Content
Forescout CounterACT
  • app-activity
  • network-alert
  • network-connection-failed
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 4 Rules

Vendor: Fortinet

Product Event Types MITRE TTP Content
FortiAuthenticator
  • authentication-successful
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Fortinet Enterprise Firewall
  • app-activity
  • computer-logon
  • failed-app-login
  • file-write
  • network-connection-successful
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 4 Rules
Fortinet FortiWeb
  • dlp-email-alert-out-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models
Fortinet UTM
  • app-activity
  • authentication-successful
  • dlp-alert
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • failed-app-login
  • security-alert
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 9 Rules
  • 1 Models
Fortinet VPN
  • failed-vpn-login
  • vpn-login
  • vpn-logout
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 6 Rules

Vendor: GTB

Product Event Types MITRE TTP Content
GTBInspector
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Gemalto

Product Event Types MITRE TTP Content
Gemalto MFA
  • authentication-successful
  • dlp-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: GitHub

Product Event Types MITRE TTP Content
GitHub
  • app-activity
  • app-activity-failed
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: GoAnywhere

Product Event Types MITRE TTP Content
GoAnywhere MFT
  • dlp-email-alert-out-failed
  • failed-logon
  • file-delete
  • file-download
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Google

Product Event Types MITRE TTP Content
GCP Squid Proxy
  • security-alert
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models
Gmail
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Google
  • app-activity
  • app-login
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Google Calendar
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Google Drive
  • app-activity
  • file-delete
  • file-permission-change
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Virtual Private Cloud
  • netflow-connection
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: HP

Product Event Types MITRE TTP Content
Aruba ClearPass Access Control and Policy Management
  • account-password-reset
  • computer-logon
  • nac-logon
  • network-connection-failed
  • vpn-connection
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules
Aruba Mobility Master
  • local-logon
  • nac-failed-logon
  • nac-logon
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Aruba Wireless controller
  • account-password-reset
  • computer-logon
  • nac-failed-logon
  • nac-logon
  • network-connection-failed
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules
HP Comware
  • failed-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: HashiCorp

Product Event Types MITRE TTP Content
Terraform
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models

Vendor: HelpSystems

Product Event Types MITRE TTP Content
Powertech Identity Access Manager (BoKs)
  • account-switch
  • file-delete
  • file-read
  • file-write
  • local-logon
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Huawei

Product Event Types MITRE TTP Content
Enterprise Network Firewall
  • database-query
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Unified Security Gateway
  • authentication-successful
  • network-alert
  • network-connection-failed
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 2 Rules

Vendor: IBM

Product Event Types MITRE TTP Content
IBM
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
IBM DB2
  • authentication-failed
  • failed-physical-access
  • file-read
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
IBM Endpoint Manager
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules
IBM Lotus Notes
  • file-upload
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
IBM Racf
  • app-login
  • authentication-successful
  • database-access
  • failed-app-login
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
IBM Sametime
  • app-login
  • dlp-email-alert-out-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
IBM Security Access Manager
  • usb-insert
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models
IBM Sense
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
IBM Sterling B2B Integrator
  • app-activity
  • failed-logon
  • member-added
  • member-removed
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Lotus Mobile Connect
  • authentication-failed
  • authentication-successful
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
QRadar Network Security
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: IMSVA

Product Event Types MITRE TTP Content
IMSVA
  • dlp-email-alert-in
  • dlp-email-alert-out
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: IPTables

Product Event Types MITRE TTP Content
IPTables
  • network-connection-successful
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules

Vendor: IXIA

Product Event Types MITRE TTP Content
IXIA ThreatArmor
  • app-activity
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 2 Rules

Vendor: Illumio

Product Event Types MITRE TTP Content
Illumio
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Imperva

Product Event Types MITRE TTP Content
Imperva SecureSphere
  • app-login
  • database-alert
  • database-delete
  • database-failed-login
  • database-login
  • database-query
  • database-update
  • network-alert
  • print-activity
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Incapsula
  • authentication-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models

Vendor: Imprivata

Product Event Types MITRE TTP Content
Imprivata
  • app-activity
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: InfoWatch

Product Event Types MITRE TTP Content
InfoWatch
  • app-login
  • dlp-email-alert-in
  • dlp-email-alert-out
  • file-permission-change
  • print-activity
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models

Vendor: Infoblox

Product Event Types MITRE TTP Content
Infoblox
  • computer-logon
  • dlp-email-alert-out-failed
  • network-connection-failed
  • network-connection-successful
  • process-created
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 41 Rules

Vendor: Ipswitch

Product Event Types MITRE TTP Content
IPswitch MoveIt
  • app-activity
  • app-login
  • failed-app-login
  • file-download
  • file-read
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
MoveIt DMZ
  • account-password-change
  • authentication-failed
  • failed-logon
  • file-delete
  • file-download
  • file-upload
  • file-write
  • member-added
  • process-created-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: JH

Product Event Types MITRE TTP Content
JH
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: Juniper Networks

Product Event Types MITRE TTP Content
Juniper Networks
  • account-deleted
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Juniper Networks ATP
  • app-activity-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Juniper Networks Pulse Secure
  • app-activity
  • authentication-failed
  • authentication-successful
  • failed-app-login
  • failed-vpn-login
  • network-connection-successful
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 4 Rules
Juniper SRX
  • authentication-successful
  • config-change
  • failed-vpn-login
  • network-connection-failed
  • network-connection-successful
  • security-alert
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 10 Rules
  • 1 Models
Juniper VPN
  • app-activity
  • authentication-failed
  • authentication-successful
  • failed-vpn-login
  • security-alert
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Kaspersky

Product Event Types MITRE TTP Content
Kaspersky AV
  • app-activity
  • file-alert
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Kemp

Product Event Types MITRE TTP Content
Kemp LoadMaster
  • app-activity
  • remote-logon
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Load Balancer
  • failed-app-login
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: LEAP

Product Event Types MITRE TTP Content
LEAP
  • app-activity
  • file-download
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: LanScope

Product Event Types MITRE TTP Content
LanScope Cat
  • app-activity
  • dlp-alert
  • failed-usb-activity
  • file-write
  • local-logon
  • print-activity
  • process-created
  • process-created-failed
  • process-network
  • usb-activity
  • usb-write
  • web-activity-allowed
  • workstation-locked
  • workstation-unlocked
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1204 - User Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 47 Rules
  • 1 Models

Vendor: LastPass

Product Event Types MITRE TTP Content
LastPass
  • app-activity
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Linux

Product Event Types MITRE TTP Content
Linux CentOs
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules
Linux DHCP
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
SSH
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: LogMeIn

Product Event Types MITRE TTP Content
RemotelyAnywhere
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: LogRhythm

Product Event Types MITRE TTP Content
LogRhythm
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: Lyrix

Product Event Types MITRE TTP Content
Lyrix
  • app-activity
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: MasterSAM

Product Event Types MITRE TTP Content
MasterSAM PAM
  • authentication-failed
  • authentication-successful
  • failed-physical-access
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: McAfee

Product Event Types MITRE TTP Content
McAfee NSM
  • app-login
  • dlp-alert
  • process-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
McAfee Web Gateway
  • alert-iot
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Mcafee EPO
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Skyhigh Networks CASB
  • account-creation
  • app-activity
  • app-login
  • dlp-alert
  • failed-app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Microsoft

Product Event Types MITRE TTP Content
Advanced Threat Analytics (ATA)
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules
Exchange
  • app-activity
  • app-activity-failed
  • app-login
  • dlp-alert
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • failed-app-login
  • member-removed
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
IIS
  • network-connection-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Microsoft Azure
  • account-password-change
  • account-password-reset
  • app-activity
  • app-activity-failed
  • app-login
  • authentication-failed
  • authentication-successful
  • cloud-admin-activity
  • cloud-admin-activity-failed
  • database-query
  • dlp-email-alert-in-failed
  • dns-response
  • failed-app-login
  • failed-logon
  • failed-usb-activity
  • file-delete
  • file-download
  • file-read
  • file-write
  • member-added
  • member-removed
  • network-connection-failed
  • network-connection-successful
  • privileged-access
  • process-created
  • security-alert
  • storage-activity
  • storage-activity-failed
  • usb-activity
  • usb-insert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 43 Rules
Microsoft Azure Active Directory
  • account-password-change
  • account-unlocked
  • app-activity
  • app-activity-failed
  • app-login
  • dlp-email-alert-out
  • failed-app-login
  • member-added
  • process-created
  • security-alert
  • usb-insert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 40 Rules
Microsoft Azure MFA
  • account-password-reset
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Microsoft Azure Security Center
  • app-activity-failed
  • process-alert
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Microsoft Azure Sentinel
  • app-activity-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Microsoft Cloud App Security (MCAS)
  • account-password-change
  • app-activity
  • app-activity-failed
  • app-login
  • failed-app-login
  • file-delete
  • file-download
  • file-read
  • file-upload
  • file-write
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Microsoft Defender ATP
  • app-login
  • batch-logon
  • file-delete
  • file-write
  • local-logon
  • member-removed
  • network-alert
  • process-alert
  • process-created
  • process-network
  • process-network-failed
  • remote-access
  • remote-logon
  • security-alert
  • usb-write
  • web-activity-denied
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1204 - User Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 47 Rules
Microsoft DirectAccess
  • security-alert
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Microsoft Office 365
  • account-disabled
  • app-activity
  • app-activity-failed
  • app-login
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • failed-app-login
  • failed-logon
  • file-delete
  • file-download
  • file-permission-change
  • file-read
  • file-upload
  • file-write
  • ntlm-logon
  • process-created
  • remote-logon
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 40 Rules
Microsoft OneDrive
  • app-activity
  • file-read
  • file-upload
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Microsoft RRA
  • authentication-successful
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Microsoft SQL Server
  • database-access
  • database-failed-login
  • database-login
  • database-query
  • failed-app-login
  • file-read
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 6 Rules
Microsoft Sysmon
  • app-activity
  • dns-response
  • file-delete
  • process-created
  • process-network
  • web-activity-denied
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1204 - User Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 47 Rules
Microsoft Windows
  • account-creation
  • account-deleted
  • account-disabled
  • account-enabled
  • account-lockout
  • account-password-change
  • account-password-reset
  • account-switch
  • account-unlocked
  • app-activity
  • app-login
  • audit-log-clear
  • audit-policy-change
  • authentication-failed
  • authentication-successful
  • computer-logon
  • database-query
  • dcom-activation-failed
  • dlp-alert
  • dlp-email-alert-out-failed
  • dns-query
  • dns-response
  • ds-access
  • failed-app-login
  • failed-logon
  • failed-vpn-login
  • file-close
  • file-delete
  • file-read
  • file-write
  • kerberos-logon
  • local-logon
  • logout-remote
  • member-added
  • member-removed
  • nac-logon
  • netflow-connection
  • network-alert
  • network-connection-failed
  • privileged-access
  • privileged-object-access
  • process-created
  • process-network
  • process-network-failed
  • remote-access
  • remote-logon
  • security-alert
  • service-created
  • service-logon
  • share-access
  • task-created
  • usb-activity
  • usb-write
  • vpn-login
  • vpn-logout
  • web-activity-denied
  • winsession-disconnect
  • workstation-locked
  • workstation-unlocked
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1204 - User Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 49 Rules
Web Application Proxy
  • failed-logon
  • network-connection-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
  • 1 Models
Web Application Proxy-TLS Gateway
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Windows Defender
  • computer-logon
  • file-alert
  • process-created
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules

Vendor: Mimecast

Product Event Types MITRE TTP Content
Mimecast
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Mimecast Email Security
  • account-password-change
  • app-activity
  • app-login
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • failed-app-login
  • network-alert
  • process-alert
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
Targeted Threat Protection - URL
  • physical-access
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: Morphisec

Product Event Types MITRE TTP Content
Morphisec EPTP
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Mysql

Product Event Types MITRE TTP Content
Mysql
  • database-activity-failed
  • database-delete
  • database-query
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: NCP

Product Event Types MITRE TTP Content
NCP
  • authentication-successful
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Namespace rDirectory

Product Event Types MITRE TTP Content
Namespace rDirectory
  • account-deleted
  • account-disabled
  • account-enabled
  • account-password-change-failed
  • app-login
  • member-added
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Nasuni

Product Event Types MITRE TTP Content
Nasuni
  • authentication-failed
  • file-delete
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: NetApp

Product Event Types MITRE TTP Content
NetApp
  • app-activity
  • file-delete
  • file-read
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: NetDocs

Product Event Types MITRE TTP Content
NetDocs
  • app-activity
  • authentication-failed
  • failed-app-login
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: NetIQ

Product Event Types MITRE TTP Content
NetIQ
  • app-login
  • failed-physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: NetMotion Wireless

Product Event Types MITRE TTP Content
NetMotion Wireless
  • nac-logon
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Netskope

Product Event Types MITRE TTP Content
Netskope Security Cloud
  • app-activity
  • app-login
  • dlp-alert
  • dlp-email-alert-in
  • dlp-email-alert-out
  • failed-app-login
  • file-delete
  • file-download
  • file-permission-change
  • file-read
  • file-upload
  • file-write
  • network-connection-failed
  • network-connection-successful
  • process-created
  • security-alert
  • web-activity-allowed
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 48 Rules
  • 1 Models

Vendor: Netwrix

Product Event Types MITRE TTP Content
Netwrix Auditor
  • account-disabled
  • account-lockout
  • account-password-reset
  • account-unlocked
  • app-activity
  • app-login
  • database-access
  • database-failed-login
  • dns-query
  • ds-access
  • file-write
  • member-added
  • member-removed
  • nac-logon
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Nokia VitalQIP

Product Event Types MITRE TTP Content
Nokia VitalQIP
  • app-login
  • computer-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Nortel Contivity

Product Event Types MITRE TTP Content
Nortel Contivity VPN
  • computer-logon
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Novell

Product Event Types MITRE TTP Content
eDirectory
  • account-disabled
  • account-enabled
  • account-password-change
  • account-unlocked
  • app-activity
  • authentication-failed
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: ObserveIT

Product Event Types MITRE TTP Content
ObserveIT
  • app-activity
  • app-login
  • dlp-alert
  • failed-app-login
  • member-added
  • process-created
  • remote-logon
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 40 Rules

Vendor: Okta

Product Event Types MITRE TTP Content
Okta Adaptive MFA
  • account-creation
  • account-enabled
  • account-lockout
  • app-activity
  • app-activity-failed
  • app-login
  • authentication-failed
  • failed-app-login
  • failed-logon
  • nac-logon
  • network-alert
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Onapsis

Product Event Types MITRE TTP Content
Onapsis
  • app-login
  • dns-query
  • security-alert
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: OneLogin

Product Event Types MITRE TTP Content
OneLogin
  • app-login
  • failed-app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: OneSpan

Product Event Types MITRE TTP Content
Digipass
  • account-password-reset
  • app-login
  • nac-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
OneSpan
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: OpenDJ

Product Event Types MITRE TTP Content
OpenDJ LDAP
  • authentication-failed
  • network-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Oracle

Product Event Types MITRE TTP Content
Oracle AVDF
  • database-login
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Oracle Access Manager
  • app-activity
  • app-login
  • authentication-successful
  • failed-app-login
  • failed-physical-access
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Oracle Solaris
  • computer-logon
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules

Vendor: Osirium

Product Event Types MITRE TTP Content
Osirium
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Palo Alto Networks

Product Event Types MITRE TTP Content
Cortex XDR
  • app-login
  • authentication-failed
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
GlobalProtect
  • authentication-failed
  • authentication-successful
  • failed-vpn-login
  • network-alert
  • physical-access
  • remote-logon
  • security-alert
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
NGFW
  • account-password-change
  • app-activity
  • authentication-successful
  • config-change
  • dlp-email-alert-out
  • file-alert
  • local-logon
  • network-connection-successful
  • security-alert
  • vpn-login
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 9 Rules
  • 1 Models
Palo Alto Aperture
  • app-login
  • dlp-email-alert-out
  • file-delete
  • file-read
  • file-write
  • network-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Traps
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Password Manager Pro

Product Event Types MITRE TTP Content
Password Manager Pro
  • account-switch
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Paxton

Product Event Types MITRE TTP Content
NET2DOOR
  • netflow-connection
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Perforce

Product Event Types MITRE TTP Content
Perforce
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Ping Identity

Product Event Types MITRE TTP Content
Ping Identity
  • app-activity
  • app-activity-failed
  • app-login
  • authentication-failed
  • authentication-successful
  • dlp-email-alert-in-failed
  • failed-app-login
  • service-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
PingID
  • account-password-change
  • account-password-change-failed
  • authentication-failed
  • authentication-successful
  • dlp-email-alert-in-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
PingOne
  • app-login
  • dns-response
  • network-alert
  • service-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: PostScript

Product Event Types MITRE TTP Content
PostScript
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Postfix

Product Event Types MITRE TTP Content
Postfix
  • app-activity-failed
  • dlp-email-alert-in
  • dlp-email-alert-out
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: PowerSentry

Product Event Types MITRE TTP Content
PowerSentry
  • app-login
  • failed-app-login
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 3 Rules

Vendor: Prisma Cloud

Product Event Types MITRE TTP Content
Prisma Cloud
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Proofpoint

Product Event Types MITRE TTP Content
ObserveIT
  • app-activity
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: ProxySG

Product Event Types MITRE TTP Content
ProxySG
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Qualys

Product Event Types MITRE TTP Content
Qualys
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: Quest Software

Product Event Types MITRE TTP Content
Change Auditor
  • account-lockout
  • account-unlocked
  • ds-access
  • failed-app-login
  • file-delete
  • file-write
  • local-logon
  • member-added
  • member-removed
  • nac-failed-logon
  • physical-access
  • remote-logon
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: RS2

Product Event Types MITRE TTP Content
RS2
  • app-login
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
RS2 Technologies
  • authentication-failed
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: RSA

Product Event Types MITRE TTP Content
RSA
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
SecurID
  • authentication-successful
  • dlp-email-alert-in
  • task-created
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: RUID

Product Event Types MITRE TTP Content
RUID
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Radius

Product Event Types MITRE TTP Content
Radius
  • authentication-successful
  • nac-logon
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: RangerAudit

Product Event Types MITRE TTP Content
RangerAudit
  • app-activity
  • app-login
  • database-activity-failed
  • database-query
  • dlp-alert
  • file-read
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Rapid7

Product Event Types MITRE TTP Content
InsightVM
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules
Nexpose
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules

Vendor: Red Canary

Product Event Types MITRE TTP Content
Red Canary
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: RightCrowd

Product Event Types MITRE TTP Content
RightCrowd
  • authentication-failed
  • failed-physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Ruckus

Product Event Types MITRE TTP Content
Ruckus
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SAP

Product Event Types MITRE TTP Content
SAP
  • account-creation
  • account-deleted
  • account-lockout
  • account-unlocked
  • app-login
  • authentication-failed
  • authentication-successful
  • failed-app-login
  • file-download
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: SFTP

Product Event Types MITRE TTP Content
SFTP
  • app-activity
  • app-login
  • file-delete
  • file-download
  • file-read
  • file-upload
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SIGSCI

Product Event Types MITRE TTP Content
SIGSCI
  • file-download
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models

Vendor: SSL Open VPN

Product Event Types MITRE TTP Content
SSL Open VPN
  • app-activity
  • authentication-failed
  • authentication-successful
  • failed-app-login
  • failed-vpn-login
  • network-alert
  • vpn-login
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Sailpoint

Product Event Types MITRE TTP Content
IdentityNow
  • account-password-change
  • account-password-change-failed
  • app-activity
  • app-login
  • authentication-successful
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Salesforce

Product Event Types MITRE TTP Content
Salesforce
  • account-password-change
  • app-activity
  • app-login
  • failed-app-login
  • file-upload
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Sangfor

Product Event Types MITRE TTP Content
NGAF
  • network-alert
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models

Vendor: Secure Computing

Product Event Types MITRE TTP Content
Secure Computing SafeWord
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Secure Envoy

Product Event Types MITRE TTP Content
Secure Envoy
  • authentication-successful
  • network-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SecureAuth

Product Event Types MITRE TTP Content
SecureAuth Login
  • authentication-failed
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SecureLink

Product Event Types MITRE TTP Content
SecureLink
  • app-login
  • file-download
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SecureNet

Product Event Types MITRE TTP Content
SecureNet
  • failed-app-login
  • vpn-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SecureWorks

Product Event Types MITRE TTP Content
iSensor IPS
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: SecurityExpert

Product Event Types MITRE TTP Content
SecurityExpert
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: SentinelOne

Product Event Types MITRE TTP Content
SentinelOne
  • app-activity
  • dns-query
  • dns-response
  • file-alert
  • file-delete
  • file-read
  • file-write
  • network-connection-failed
  • network-connection-successful
  • process-created
  • security-alert
  • web-activity-allowed
  • web-activity-denied
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 47 Rules
  • 1 Models

Vendor: ServiceNow

Product Event Types MITRE TTP Content
ServiceNow
  • account-switch
  • app-login
  • file-delete
  • file-download
  • file-read
  • file-upload
  • file-write
  • security-alert
  • storage-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Shibboleth

Product Event Types MITRE TTP Content
Shibboleth IdP
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Shibboleth SSO
  • app-login
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Siemens

Product Event Types MITRE TTP Content
Siemens
  • authentication-successful
  • failed-physical-access
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Silverfort

Product Event Types MITRE TTP Content
Silverfort
  • app-login
  • authentication-successful
  • failed-app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: SiteMinder

Product Event Types MITRE TTP Content
SiteMinder
  • authentication-failed
  • authentication-successful
  • database-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: SkySea

Product Event Types MITRE TTP Content
ClientView
  • app-activity
  • app-login
  • computer-logon
  • dlp-email-alert-out
  • dns-query
  • file-delete
  • file-read
  • file-upload
  • file-write
  • security-alert
  • usb-activity
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models

Vendor: Slack

Product Event Types MITRE TTP Content
Slack
  • app-login
  • failed-vpn-login
  • file-download
  • file-upload
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Snort

Product Event Types MITRE TTP Content
Snort
  • app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Snowflake

Product Event Types MITRE TTP Content
Snowflake
  • authentication-failed
  • database-query
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Sonicwall

Product Event Types MITRE TTP Content
Sonicwall
  • failed-logon
  • failed-vpn-login
  • network-alert
  • vpn-login
  • vpn-logout
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models

Vendor: Sophos

Product Event Types MITRE TTP Content
Sophos Endpoint Protection
  • app-activity-failed
  • dlp-alert
  • failed-app-login
  • network-connection-successful
  • security-alert
  • usb-insert
  • usb-write
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
Sophos Firewall
  • authentication-successful
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 3 Rules
Sophos Invincea
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Sophos SafeGuard
  • app-activity
  • database-delete
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Sophos UTM
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Sophos XG Firewall
  • authentication-successful
  • failed-vpn-login
  • network-connection-failed
  • network-connection-successful
  • vpn-login
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 10 Rules
  • 1 Models

Vendor: Specops

Product Event Types MITRE TTP Content
Specops Password Reset
  • account-unlocked
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Squid

Product Event Types MITRE TTP Content
Squid
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models

Vendor: StealthBits

Product Event Types MITRE TTP Content
StealthIntercept
  • account-disabled
  • account-enabled
  • authentication-successful
  • ds-access
  • file-read
  • file-write
  • member-added
  • member-removed
  • network-connection-failed
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
  • 1 Models

Vendor: Sun One

Product Event Types MITRE TTP Content
LDAP
  • authentication-successful
  • usb-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Suricata

Product Event Types MITRE TTP Content
Suricata
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Suricata IDS
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Swivel

Product Event Types MITRE TTP Content
Swivel
  • app-login
  • file-upload
  • vpn-logout
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Symantec

Product Event Types MITRE TTP Content
Symantec
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec Advanced Threat Protection
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec Blue Coat Content Analysis System
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec Blue Coat ProxySG Appliance
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Symantec CloudSOC
  • app-login
  • dlp-alert
  • failed-app-login
  • file-delete
  • file-download
  • file-upload
  • usb-insert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Symantec Critical System Protection
  • account-switch
  • config-change
  • dlp-alert
  • failed-logon
  • local-logon
  • member-added
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec DLP
  • dlp-alert
  • dlp-email-alert-in
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • ds-access
  • failed-logon
  • security-alert
  • usb-activity
  • usb-read
  • usb-write
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec EDR
  • failed-logon
  • file-alert
  • file-delete
  • file-write
  • remote-logon
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 6 Rules
Symantec Email Security.cloud
  • app-activity
  • dlp-email-alert-in
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • process-created-failed
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec Endpoint Protection
  • authentication-successful
  • config-change
  • failed-logon
  • network-connection-failed
  • network-connection-successful
  • process-alert
  • remote-logon
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules
Symantec Endpoint Protection Mobile
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Symantec Fireglass
  • failed-physical-access
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models
Symantec Secure Web Gateway
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules
  • 1 Models
Symantec VIP
  • app-activity
  • authentication-failed
  • authentication-successful
  • dns-query
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Symantec WSS
  • process-created
  • web-activity-allowed
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 44 Rules
  • 1 Models

Vendor: Tanium

Product Event Types MITRE TTP Content
Endpoint Platform
  • authentication-failed
  • authentication-successful
  • file-write
  • process-created
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules

Vendor: Tenable.io

Product Event Types MITRE TTP Content
Tenable.io
  • network-connection-failed
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: Thycotic Secret Server

Product Event Types MITRE TTP Content
Thycotic Secret Server
  • account-switch
  • app-login
  • failed-app-login
  • file-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: TitanFTP

Product Event Types MITRE TTP Content
TitanFTP
  • file-delete
  • file-read
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: Trend Micro

Product Event Types MITRE TTP Content
Apex One
  • app-login
  • dlp-email-alert-in
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Deep Discovery Inspector
  • app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Deep Security Agent
  • network-connection-successful
  • privileged-object-access
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
InterScan Web Security
  • account-password-change
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 6 Rules
  • 1 Models
OfficeScan
  • account-password-change
  • dlp-alert
  • dlp-email-alert-out
  • security-alert
  • usb-insert
  • usb-read
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules
TippingPoint NGIPS
  • app-activity
  • database-delete
  • network-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Trend Micro
  • network-alert
  • network-connection-successful
  • privileged-object-access
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Tripwire Enterprise

Product Event Types MITRE TTP Content
Tripwire Enterprise
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Tufin

Product Event Types MITRE TTP Content
SecureTrack
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Tyco

Product Event Types MITRE TTP Content
CCURE Building Management System
  • app-activity
  • app-login
  • dns-response
  • failed-physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: USB

Product Event Types MITRE TTP Content
USB
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: Unix

Product Event Types MITRE TTP Content
Auditbeat
  • app-activity
  • app-activity-failed
  • app-login
  • process-created-failed
  • process-network
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1204 - User Execution
  • 10 Rules
Unix
  • account-creation
  • account-deleted
  • account-password-reset
  • app-activity-failed
  • authentication-failed
  • authentication-successful
  • batch-logon
  • config-change
  • database-access
  • database-query
  • dlp-alert
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
  • dlp-email-alert-out-failed
  • failed-app-login
  • failed-logon
  • file-permission-change
  • file-read
  • kerberos-logon
  • local-logon
  • member-added
  • member-removed
  • netflow-connection
  • network-alert
  • process-created
  • process-created-failed
  • remote-logon
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 41 Rules
Unix Auditd
  • account-creation
  • account-deleted
  • app-activity
  • app-activity-failed
  • authentication-failed
  • authentication-successful
  • config-change
  • database-login
  • dlp-alert
  • failed-logon
  • local-logon
  • member-added
  • member-removed
  • process-created
  • process-created-failed
  • remote-logon
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 40 Rules
Unix Sendmail
  • authentication-failed
  • dlp-email-alert-in
  • dlp-email-alert-in-failed
  • dlp-email-alert-out
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
Unix dhcpd
  • computer-logon
  • failed-app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: VBCorp

Product Event Types MITRE TTP Content
VBCorp
  • authentication-failed
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: VMware

Product Event Types MITRE TTP Content
Carbon Black
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules
Carbon Black EDR
  • file-read
  • file-write
  • process-created
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 38 Rules
NSX FW
  • network-connection-successful
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 7 Rules
  • 1 Models
VMWare ID Manager (VIDM)
  • app-activity
  • app-login
  • remote-logon
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
VMware Carbon Black App Control
  • app-activity
  • batch-logon
  • dlp-email-alert-out-failed
  • failed-physical-access
  • file-alert
  • file-delete
  • file-write
  • local-logon
  • process-alert
  • process-created
  • security-alert
  • usb-write
  • workstation-locked
  • workstation-unlocked
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules
VMware Carbon Black Cloud Endpoint Standard
  • config-change
  • file-write
  • network-connection-failed
  • network-connection-successful
  • process-created
  • process-created-failed
  • security-alert
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 41 Rules
VMware Carbon Black EDR
  • app-activity
  • config-change
  • workstation-unlocked
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
VMware ESXi
  • computer-logon
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
VMware Horizon
  • authentication-failed
  • authentication-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
VMware NSX
  • app-activity-failed
  • network-connection-successful
T1090.003 - Proxy: Multi-hop Proxy
  • 3 Rules
VMware VCenter
  • account-password-change
  • app-activity-failed
  • ds-access
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules
VMware View
  • account-password-change
  • app-login
  • authentication-failed
  • failed-app-login
  • remote-logon
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: Vectra

Product Event Types MITRE TTP Content
Vectra Cognito Detect
  • network-connection-failed
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 1 Rules

Vendor: Visma

Product Event Types MITRE TTP Content
Megaflex
  • app-activity-failed
  • physical-access
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Watchguard

Product Event Types MITRE TTP Content
Watchguard
  • app-activity-failed
  • network-alert
  • network-connection-successful
  • web-activity-allowed
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
  • 8 Rules
  • 1 Models

Vendor: Workday

Product Event Types MITRE TTP Content
Workday
  • account-password-change
  • app-login
  • failed-app-login
  • file-write
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: XPS

Product Event Types MITRE TTP Content
XPS
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Xceedium

Product Event Types MITRE TTP Content
Xceedium
  • app-activity
  • app-login
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Xerox

Product Event Types MITRE TTP Content
Xerox
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Zeek

Product Event Types MITRE TTP Content
Zeek Network Security Monitor
  • app-activity
  • app-login
  • authentication-failed
  • authentication-successful
  • computer-logon
  • dlp-alert
  • dlp-email-alert-in
  • dns-query
  • dns-response
  • failed-logon
  • file-delete
  • file-read
  • file-write
  • kerberos-logon
  • nac-failed-logon
  • nac-logon
  • network-alert
  • network-connection-successful
  • ntlm-logon
  • remote-logon
  • share-access
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 10 Rules
  • 1 Models

Vendor: Zlock

Product Event Types MITRE TTP Content
Zlock
  • app-activity
T1090.003 - Proxy: Multi-hop Proxy
  • 1 Rules

Vendor: Zscaler

Product Event Types MITRE TTP Content
Zscaler Internet Access
  • database-update
  • dlp-alert
  • image-loaded
  • network-connection-failed
  • network-connection-successful
  • web-activity-allowed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 8 Rules
  • 1 Models
Zscaler Private Access
  • process-created
  • vpn-login
T1027 - Obfuscated Files or Information
T1036 - Masquerading
T1036.003 - Masquerading: Rename System Utilities
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1064 - Scripting
T1070 - Indicator Removal on Host
T1090.003 - Proxy: Multi-hop Proxy
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1132.001 - Data Encoding: Standard Encoding
T1140 - Deobfuscate/Decode Files or Information
T1202 - Indirect Command Execution
T1211 - Exploitation for Defense Evasion
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm
T1542.003 - T1542.003
T1543.003 - Create or Modify System Process: Windows Service
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1564.004 - Hide Artifacts: NTFS File Attributes
  • 39 Rules

Vendor: eDocs

Product Event Types MITRE TTP Content
eDocs
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules

Vendor: iManage

Product Event Types MITRE TTP Content
iManage
  • app-activity
  • authentication-failed
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 7 Rules

Vendor: oVirt

Product Event Types MITRE TTP Content
oVirt
  • app-activity
  • app-login
  • failed-app-login
  • security-alert
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules

Vendor: xsuite

Product Event Types MITRE TTP Content
xsuite
  • web-activity-denied
T1071.001 - Application Layer Protocol: Web Protocols
T1090.003 - Proxy: Multi-hop Proxy
T1090.004 - T1090.004
  • 5 Rules