Use Case: Account Manipulation

Vendor: Absolute

Product	MITRE ATT&CK® TTP	Content
Absolute DDS	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Accellion

Product	MITRE ATT&CK® TTP	Content
Kiteworks	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: Adaxes

Product	MITRE ATT&CK® TTP	Content
Adaxes	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Airlock

Product	MITRE ATT&CK® TTP	Content
Airlock Allowlisting	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Akamai

Product	MITRE ATT&CK® TTP	Content
Akamai Guardicore	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Amazon

Product	MITRE ATT&CK® TTP	Content
AWS CloudTrail	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Anywhere365

Product	MITRE ATT&CK® TTP	Content
Anywhere365	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Apache

Product	MITRE ATT&CK® TTP	Content
Apache Subversion	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Atlassian

Product	MITRE ATT&CK® TTP	Content
Atlassian	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Atlassian BitBucket	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Auth0

Product	MITRE ATT&CK® TTP	Content
Auth0	T1098 - Account Manipulation T1136 - Create Account T1531 - Account Access Removal	3 Rules 1 Models

Vendor: Barracuda

Product	MITRE ATT&CK® TTP	Content
Barracuda Cloudgen Firewall	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: BeyondTrust

Product	MITRE ATT&CK® TTP	Content
BeyondInsight	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	38 Rules 15 Models
BeyondTrust	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models
BeyondTrust Privileged Identity	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models
BeyondTrust Secure Remote Access	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: BlackBerry

Product	MITRE ATT&CK® TTP	Content
BlackBerry Protect	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Box

Product	MITRE ATT&CK® TTP	Content
Box Cloud Content Management	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: CatoNetworks

Product	MITRE ATT&CK® TTP	Content
Cato Cloud	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Check Point

Product	MITRE ATT&CK® TTP	Content
Check Point Identity Awareness	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
Check Point NGFW	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	10 Rules 7 Models
Check Point Security Gateway	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
SmartDefense	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Checkmarx

Product	MITRE ATT&CK® TTP	Content
Checkmarx	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	39 Rules 15 Models

Vendor: Cisco

Product	MITRE ATT&CK® TTP	Content
AnyConnect	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
Cisco	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Cisco ACS	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models
Cisco Adaptive Security Appliance	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1484 - Group Policy Modification T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	20 Rules 13 Models
Cisco Firepower	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1484 - Group Policy Modification T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	20 Rules 13 Models
Cisco IOS	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Cisco ISE	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	10 Rules 7 Models
Cisco Meraki MX appliance	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
Cisco Umbrella	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Duo Access	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	25 Rules 9 Models

Vendor: Citrix

Product	MITRE ATT&CK® TTP	Content
Citrix Endpoint Management	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Citrix Gateway	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1484 - Group Policy Modification T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	23 Rules 13 Models
Citrix Gateway Connector For Exchange ActiveSync	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Citrix ShareFile	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Citrix Virtual Apps	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Claroty

Product	MITRE ATT&CK® TTP	Content
CTD	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Click Studios

Product	MITRE ATT&CK® TTP	Content
Passwordstate	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	19 Rules 9 Models

Vendor: Cloudflare

Product	MITRE ATT&CK® TTP	Content
Cloudflare Insights	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	27 Rules 13 Models

Vendor: Code42

Product	MITRE ATT&CK® TTP	Content
Code42 Incydr	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: CrowdStrike

Product	MITRE ATT&CK® TTP	Content
Falcon	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	18 Rules 8 Models

Vendor: CyberArk

Product	MITRE ATT&CK® TTP	Content
CyberArk Privilege Access Manager	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: Delinea

Product	MITRE ATT&CK® TTP	Content
Centrify Authentication Service	T1098 - Account Manipulation	1 Rules
Centrify Infrastructure Services	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Centrify Zero Trust Privilege Services	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Thycotic Software Secret Server	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Dell

Product	MITRE ATT&CK® TTP	Content
One Identity Manager	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models
Sonicwall	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Digital Guardian

Product	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models

Vendor: Dropbox

Product	MITRE ATT&CK® TTP	Content
Dropbox	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1484 - Group Policy Modification	34 Rules 19 Models

Vendor: Dtex Systems

Product	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: EMP

Product	MITRE ATT&CK® TTP	Content
EMP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: ESET

Product	MITRE ATT&CK® TTP	Content
ESET Endpoint Security	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Egnyte

Product	MITRE ATT&CK® TTP	Content
Egnyte	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Epic

Product	MITRE ATT&CK® TTP	Content
Epic SIEM	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: Exabeam

Product	MITRE ATT&CK® TTP	Content
Search	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: F5

Product	MITRE ATT&CK® TTP	Content
F5 Access Policy Manager	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
F5 Advanced Web Application Firewall	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
F5 BIG-IP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: FTP

Product	MITRE ATT&CK® TTP	Content
FTP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: FireMon

Product	MITRE ATT&CK® TTP	Content
FireMon	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Forcepoint

Product	MITRE ATT&CK® TTP	Content
Forcepoint CASB	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Fortinet

Product	MITRE ATT&CK® TTP	Content
FortiGate	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	10 Rules 7 Models
Fortinet Enterprise Firewall	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Fortinet UTM	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: GitHub

Product	MITRE ATT&CK® TTP	Content
GitHub	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	50 Rules 21 Models

Vendor: Google

Product	MITRE ATT&CK® TTP	Content
Google Cloud Platform	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Google Workspace	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: HP

Product	MITRE ATT&CK® TTP	Content
Aruba ClearPass Policy Manager	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Aruba Mobility Master	T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	20 Rules 8 Models
HPE Comware	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: HashiCorp

Product	MITRE ATT&CK® TTP	Content
HashiCorp Vault	T1098 - Account Manipulation	1 Rules

Vendor: HelpSystems

Product	MITRE ATT&CK® TTP	Content
Powertech Identity and Access Manager	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: Huawei

Product	MITRE ATT&CK® TTP	Content
Huawei Unified Security Gateway	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: IBM

Product	MITRE ATT&CK® TTP	Content
IBM	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
IBM Resource Access Control Facility	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: ICDB

Product	MITRE ATT&CK® TTP	Content
ICDB	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Imprivata

Product	MITRE ATT&CK® TTP	Content
Imprivata	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Ipswitch

Product	MITRE ATT&CK® TTP	Content
MoveIt Transfer	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	28 Rules 13 Models

Vendor: Ivanti

Product	MITRE ATT&CK® TTP	Content
Ivanti Pulse Secure	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1484 - Group Policy Modification T1531 - Account Access Removal	12 Rules 8 Models

Vendor: Juniper Networks

Product	MITRE ATT&CK® TTP	Content
Junos OS	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: Kemp

Product	MITRE ATT&CK® TTP	Content
Kemp LoadMaster	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LEAP

Product	MITRE ATT&CK® TTP	Content
LEAP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LOGBinder

Product	MITRE ATT&CK® TTP	Content
LOGBinder for SharePoint	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LanScope

Product	MITRE ATT&CK® TTP	Content
LanScope Cat	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models

Vendor: LastPass

Product	MITRE ATT&CK® TTP	Content
LastPass	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	24 Rules 9 Models

Vendor: Lenel

Product	MITRE ATT&CK® TTP	Content
OnGuard	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: LiquidFiles

Product	MITRE ATT&CK® TTP	Content
LiquidFiles	T1098 - Account Manipulation T1136 - Create Account T1531 - Account Access Removal	3 Rules 1 Models

Vendor: LogRhythm

Product	MITRE ATT&CK® TTP	Content
LogRhythm	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models

Vendor: ManageEngine

Product	MITRE ATT&CK® TTP	Content
ADAuditPlus	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1207 - Rogue Domain Controller T1484 - Group Policy Modification	58 Rules 29 Models
ADSSP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
PAM360	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: McAfee

Product	MITRE ATT&CK® TTP	Content
Skyhigh Networks CASB	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Microsoft

Product	MITRE ATT&CK® TTP	Content
Azure	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Azure AD Activity Logs	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1207 - Rogue Domain Controller T1484 - Group Policy Modification	59 Rules 29 Models
Azure AD Sign-In Logs	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Azure ATP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Azure DevOps	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Azure Kubernetes Service	T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1136 - Create Account T1136.003 - Create Account: Create: Cloud Account	5 Rules 3 Models
Azure MFA	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Azure Monitor	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Azure Monitor - VM Insights	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Event Viewer - ADFS	T1098 - Account Manipulation	1 Rules
Event Viewer - AzureADPasswordProtection-DCAgent	T1098 - Account Manipulation	1 Rules
Event Viewer - BITS-Client	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Event Viewer - CAPI2	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Event Viewer - PowerShell	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Event Viewer - RemoteDesktopServices	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Event Viewer - Security	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1207 - Rogue Domain Controller T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1484 - Group Policy Modification T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	91 Rules 41 Models
Event Viewer - Setup	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Event Viewer - System	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Event Viewer - WinNat	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
MSSQL	T1098 - Account Manipulation T1136 - Create Account	24 Rules 12 Models
Microsoft 365	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	41 Rules 19 Models
Microsoft CAS	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models
Microsoft Defender for Endpoint	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	59 Rules 25 Models
Microsoft Exchange	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Microsoft Intune	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Microsoft RRAS	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models
Microsoft Sentinel	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	40 Rules 19 Models
Microsoft WMI Log	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models
Sysmon	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models

Vendor: Mimecast

Product	MITRE ATT&CK® TTP	Content
Mimecast Secure Email Gateway	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Mvision

Product	MITRE ATT&CK® TTP	Content
Mvision	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1207 - Rogue Domain Controller T1484 - Group Policy Modification	34 Rules 17 Models

Vendor: NCP

Product	MITRE ATT&CK® TTP	Content
NCP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Namespace rDirectory

Product	MITRE ATT&CK® TTP	Content
Namespace rDirectory	T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1207 - Rogue Domain Controller T1484 - Group Policy Modification T1531 - Account Access Removal	75 Rules 34 Models

Vendor: NetDocs

Product	MITRE ATT&CK® TTP	Content
NetDocs	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: NetMotion Wireless

Product	MITRE ATT&CK® TTP	Content
NetMotion Wireless	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Netskope

Product	MITRE ATT&CK® TTP	Content
Netskope Security Cloud	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	23 Rules 9 Models

Vendor: Netwrix

Product	MITRE ATT&CK® TTP	Content
Netwrix Auditor	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	28 Rules 13 Models

Vendor: NextDLP

Product	MITRE ATT&CK® TTP	Content
Reveal	T1098 - Account Manipulation T1136 - Create Account	24 Rules 12 Models

Vendor: Nortel Contivity

Product	MITRE ATT&CK® TTP	Content
Nortel Contivity VPN	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Okta

Product	MITRE ATT&CK® TTP	Content
Okta Adaptive MFA	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	46 Rules 19 Models

Vendor: OneLogin

Product	MITRE ATT&CK® TTP	Content
OneLogin	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: OneWelcome

Product	MITRE ATT&CK® TTP	Content
OneWelcome Cloud Identity Platform	T1098 - Account Manipulation	1 Rules

Vendor: Open VPN

Product	MITRE ATT&CK® TTP	Content
Open VPN	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	10 Rules 7 Models

Vendor: OpenLDAP

Product	MITRE ATT&CK® TTP	Content
OpenLDAP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	25 Rules 9 Models

Vendor: OpenText

Product	MITRE ATT&CK® TTP	Content
eDOCS	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Oracle

Product	MITRE ATT&CK® TTP	Content
Oracle Access Management	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Oracle Public Cloud	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	45 Rules 19 Models
Solaris	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: Osquery

Product	MITRE ATT&CK® TTP	Content
Osquery	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Palo Alto Networks

Product	MITRE ATT&CK® TTP	Content
Cortex XDR	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
GlobalProtect	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	10 Rules 7 Models
Palo Alto Aperture	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Password Manager Pro

Product	MITRE ATT&CK® TTP	Content
Password Manager Pro	T1098 - Account Manipulation T1136 - Create Account T1531 - Account Access Removal	3 Rules 1 Models

Vendor: Perforce

Product	MITRE ATT&CK® TTP	Content
Perforce	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Ping Identity

Product	MITRE ATT&CK® TTP	Content
Ping Identity	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: PowerSentry

Product	MITRE ATT&CK® TTP	Content
PowerSentry	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Procad

Product	MITRE ATT&CK® TTP	Content
Pro.File DMS	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Proofpoint

Product	MITRE ATT&CK® TTP	Content
ObserveIT	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models

Vendor: Qualys

Product	MITRE ATT&CK® TTP	Content
Qualys AssetView	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Quest Software

Product	MITRE ATT&CK® TTP	Content
Quest Change Auditor for Active Directory	T1098 - Account Manipulation T1136 - Create Account T1207 - Rogue Domain Controller T1484 - Group Policy Modification	60 Rules 28 Models

Vendor: RSA

Product	MITRE ATT&CK® TTP	Content
SecurID	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: RangerAudit

Product	MITRE ATT&CK® TTP	Content
RangerAudit	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Rubrik

Product	MITRE ATT&CK® TTP	Content
Rubrik Cloud Data Management	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	23 Rules 9 Models

Vendor: SAP

Product	MITRE ATT&CK® TTP	Content
SAP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	25 Rules 9 Models

Vendor: Sailpoint

Product	MITRE ATT&CK® TTP	Content
IdentityNow	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models
SecurityIQ	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Salesforce

Product	MITRE ATT&CK® TTP	Content
Salesforce	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Saviynt

Product	MITRE ATT&CK® TTP	Content
Saviynt	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: SecureAuth

Product	MITRE ATT&CK® TTP	Content
SecureAuth IDP	T1098 - Account Manipulation	1 Rules

Vendor: SecureLink

Product	MITRE ATT&CK® TTP	Content
SecureLink	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models

Vendor: SecureNet

Product	MITRE ATT&CK® TTP	Content
SecureNet	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Semperis

Product	MITRE ATT&CK® TTP	Content
Semperis DSP	T1207 - Rogue Domain Controller T1484 - Group Policy Modification	31 Rules 16 Models

Vendor: SentinelOne

Product	MITRE ATT&CK® TTP	Content
Singularity Platform	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	17 Rules 7 Models
Vigilance	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	23 Rules 9 Models

Vendor: ServiceNow

Product	MITRE ATT&CK® TTP	Content
ServiceNow	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Shibboleth

Product	MITRE ATT&CK® TTP	Content
Shibboleth	T1098 - Account Manipulation	1 Rules

Vendor: SkySea

Product	MITRE ATT&CK® TTP	Content
SkySea ClientView	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models

Vendor: Slack

Product	MITRE ATT&CK® TTP	Content
Slack	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Sophos

Product	MITRE ATT&CK® TTP	Content
Sophos SafeGuard	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Sophos XG Firewall	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor: Specops

Product	MITRE ATT&CK® TTP	Content
Specops Password	T1098 - Account Manipulation	1 Rules

Vendor: StealthBits

Product	MITRE ATT&CK® TTP	Content
StealthIntercept	T1098 - Account Manipulation T1136 - Create Account T1207 - Rogue Domain Controller T1484 - Group Policy Modification	59 Rules 28 Models

Vendor: Swivel

Product	MITRE ATT&CK® TTP	Content
Swivel	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Symantec

Product	MITRE ATT&CK® TTP	Content
Symantec Advanced Threat Protection	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models
Symantec CloudSOC	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Symantec Critical System Protection	T1098 - Account Manipulation T1136 - Create Account	24 Rules 12 Models
Symantec Endpoint Protection	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Symantec VIP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Tanium

Product	MITRE ATT&CK® TTP	Content
Tanium Cloud Platform	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Tanium Core Platform	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Tanium Integrity Monitor	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models

Vendor: TitanFTP

Product	MITRE ATT&CK® TTP	Content
TitanFTP	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Trend Micro

Product	MITRE ATT&CK® TTP	Content
Deep Discovery Inspector	T1098 - Account Manipulation	1 Rules
Deep Security	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Vision One	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	24 Rules 9 Models

Vendor: Tyco

Product	MITRE ATT&CK® TTP	Content
CCURE Building Management System	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Unix

Product	MITRE ATT&CK® TTP	Content
Auditbeat	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	16 Rules 7 Models
Unix	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	60 Rules 25 Models
Unix Auditd	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	57 Rules 24 Models

Vendor: VMware

Product	MITRE ATT&CK® TTP	Content
Carbon Black App Control	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Carbon Black CES	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
Carbon Black EDR	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	13 Rules 6 Models
VMware Identity Manager	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
VMware View	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	4 Rules 1 Models
vCenter	T1098 - Account Manipulation	1 Rules

Vendor: Vectra

Product	MITRE ATT&CK® TTP	Content
Vectra Cognito Detect	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Veeam

Product	MITRE ATT&CK® TTP	Content
Veeam	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Venafi

Product	MITRE ATT&CK® TTP	Content
TLS Protect	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Watchguard

Product	MITRE ATT&CK® TTP	Content
Watchguard	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Wiz

Product	MITRE ATT&CK® TTP	Content
Wiz	T1136 - Create Account T1531 - Account Access Removal	2 Rules 1 Models

Vendor: Workday

Product	MITRE ATT&CK® TTP	Content
Workday	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zeek

Product	MITRE ATT&CK® TTP	Content
Zeek	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zendesk

Product	MITRE ATT&CK® TTP	Content
Zendesk	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zlock

Product	MITRE ATT&CK® TTP	Content
Zlock	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: Zscaler

Product	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Zscaler Private Access	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	7 Rules 7 Models

Vendor:

Vendor: iManage

Product	MITRE ATT&CK® TTP	Content
iManage	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Vendor: oVirt

Product	MITRE ATT&CK® TTP	Content
oVirt	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models

Files

uc_account_manipulation.md

Latest commit

History

uc_account_manipulation.md

File metadata and controls

Use Case: Account Manipulation

Vendor: Absolute

Vendor: Accellion

Vendor: Adaxes

Vendor: Airlock

Vendor: Akamai

Vendor: Amazon

Vendor: Anywhere365

Vendor: Apache

Vendor: Atlassian

Vendor: Auth0

Vendor: Barracuda

Vendor: BeyondTrust

Vendor: BlackBerry

Vendor: Box

Vendor: CatoNetworks

Vendor: Check Point

Vendor: Checkmarx

Vendor: Cisco

Vendor: Citrix

Vendor: Claroty

Vendor: Click Studios

Vendor: Cloudflare

Vendor: Code42

Vendor: CrowdStrike

Vendor: CyberArk

Vendor: Delinea

Vendor: Dell

Vendor: Digital Guardian

Vendor: Dropbox

Vendor: Dtex Systems

Vendor: EMP

Vendor: ESET

Vendor: Egnyte

Vendor: Epic

Vendor: Exabeam

Vendor: F5

Vendor: FTP

Vendor: FireMon

Vendor: Forcepoint

Vendor: Fortinet

Vendor: GitHub

Vendor: Google

Vendor: HP

Vendor: HashiCorp

Vendor: HelpSystems

Vendor: Huawei

Vendor: IBM

Vendor: ICDB

Vendor: Imprivata

Vendor: Ipswitch

Vendor: Ivanti

Vendor: Juniper Networks

Vendor: Kemp

Vendor: LEAP

Vendor: LOGBinder

Vendor: LanScope

Vendor: LastPass

Vendor: Lenel

Vendor: LiquidFiles

Vendor: LogRhythm

Vendor: ManageEngine

Vendor: McAfee

Vendor: Microsoft

Vendor: Mimecast

Vendor: Mvision

Vendor: NCP

Vendor: Namespace rDirectory

Vendor: NetDocs

Vendor: NetMotion Wireless

Vendor: Netskope

Vendor: Netwrix

Vendor: NextDLP

Vendor: Nortel Contivity