uc_privilege_abuse.md

Use Case: Privilege Abuse

Vendor: APC

Product	MITRE ATT&CK® TTP	Content
APC	T1078 - Valid Accounts T1078.002 - T1078.002	10 Rules 6 Models

Vendor: AVI Networks

Product	MITRE ATT&CK® TTP	Content
AVI Networks Software Load Balancer	T1078 - Valid Accounts	2 Rules

Vendor: Abnormal Security

Product	MITRE ATT&CK® TTP	Content
Abnormal Security	T1078 - Valid Accounts	1 Rules

Vendor: Absolute

Product	MITRE ATT&CK® TTP	Content
Absolute DDS	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Accellion

Product	MITRE ATT&CK® TTP	Content
Kiteworks	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models

Vendor: Adaxes

Product	MITRE ATT&CK® TTP	Content
Adaxes	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Admin By Request

Product	MITRE ATT&CK® TTP	Content
Admin By Request	T1078 - Valid Accounts	5 Rules 5 Models

Vendor: Airlock

Product	MITRE ATT&CK® TTP	Content
Airlock Allowlisting	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Airlock Security Access Hub	T1078 - Valid Accounts	3 Rules

Vendor: Akamai

Product	MITRE ATT&CK® TTP	Content
Akamai Guardicore	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Cloud Akamai	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Amazon

Product	MITRE ATT&CK® TTP	Content
AWS Bastion	T1078 - Valid Accounts T1078.002 - T1078.002	12 Rules 7 Models
AWS CloudTrail	T1078 - Valid Accounts T1087 - Account Discovery T1087.004 - T1087.004 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions TA0003 - TA0003 TA0004 - TA0004	11 Rules 7 Models
AWS CloudWatch	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
AWS Elastic Load Balancer	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
AWS WAF	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Anywhere365

Product	MITRE ATT&CK® TTP	Content
Anywhere365	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Apache

Product	MITRE ATT&CK® TTP	Content
Apache	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Apache Guacamole	T1078 - Valid Accounts	2 Rules
Apache Subversion	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Apple

Product	MITRE ATT&CK® TTP	Content
macOS	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models

Vendor: Armorblox

Product	MITRE ATT&CK® TTP	Content
Armorblox	T1078 - Valid Accounts	1 Rules

Vendor: AssetView

Product	MITRE ATT&CK® TTP	Content
AssetView	T1078 - Valid Accounts	1 Rules

Vendor: Atlassian

Product	MITRE ATT&CK® TTP	Content
Atlassian	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Atlassian BitBucket	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Auth0

Product	MITRE ATT&CK® TTP	Content
Auth0	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1531 - Account Access Removal	17 Rules 7 Models

Vendor: Avaya

Product	MITRE ATT&CK® TTP	Content
Avaya VPN	T1078 - Valid Accounts T1133 - External Remote Services	1 Rules

Vendor: Axway

Product	MITRE ATT&CK® TTP	Content
Axway Gateway	T1078 - Valid Accounts T1078.002 - T1078.002	10 Rules 6 Models

Vendor: Banyan Security

Product	MITRE ATT&CK® TTP	Content
Banyan Security	T1078 - Valid Accounts	2 Rules

Vendor: Barracuda

Product	MITRE ATT&CK® TTP	Content
Barracuda Cloudgen Firewall	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	15 Rules 9 Models
Barracuda Email Security Gateway	T1078 - Valid Accounts	1 Rules

Vendor: BeyondTrust

Product	MITRE ATT&CK® TTP	Content
BeyondInsight	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	42 Rules 20 Models
BeyondTrust	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	32 Rules 19 Models
BeyondTrust Privileged Identity	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	14 Rules 7 Models
BeyondTrust Secure Remote Access	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Bitdefender

Product	MITRE ATT&CK® TTP	Content
GravityZone	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002	15 Rules 7 Models

Vendor: Bitglass

Product	MITRE ATT&CK® TTP	Content
Bitglass CASB	T1078 - Valid Accounts	3 Rules

Vendor: BlackBerry

Product	MITRE ATT&CK® TTP	Content
BlackBerry Protect	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Box

Product	MITRE ATT&CK® TTP	Content
Box Cloud Content Management	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Bromium

Product	MITRE ATT&CK® TTP	Content
Bromium Secure Platform	T1078 - Valid Accounts	1 Rules

Vendor: CA Technologies

Product	MITRE ATT&CK® TTP	Content
CA Privileged Access Manager Server Control	T1078 - Valid Accounts	4 Rules

Vendor: CDS

Product	MITRE ATT&CK® TTP	Content
CDS	T1078 - Valid Accounts T1078.002 - T1078.002	12 Rules 7 Models

Vendor: CatoNetworks

Product	MITRE ATT&CK® TTP	Content
Cato Cloud	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 2 Models

Vendor: Check Point

Product	MITRE ATT&CK® TTP	Content
Check Point Avanan	T1078 - Valid Accounts	1 Rules
Check Point Identity Awareness	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models
Check Point NGFW	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	19 Rules 9 Models
Check Point Security Gateway	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models
Check Point vSEC Virtual Edition	T1078 - Valid Accounts T1133 - External Remote Services	1 Rules
SmartDefense	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Checkmarx

Product	MITRE ATT&CK® TTP	Content
Checkmarx	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	39 Rules 15 Models

Vendor: Cisco

Product	MITRE ATT&CK® TTP	Content
AnyConnect	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models
Cisco	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Cisco ACS	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	16 Rules 8 Models
Cisco ADC	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Cisco Adaptive Security Appliance	T1047 - Windows Management Instrumentation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services T1136 - Create Account T1136.001 - Create Account: Create: Local Account	28 Rules 15 Models
Cisco Cloud Web Security	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Cisco Firepower	T1047 - Windows Management Instrumentation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services T1136 - Create Account T1136.001 - Create Account: Create: Local Account	15 Rules 8 Models
Cisco IOS	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	19 Rules 12 Models
Cisco ISE	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	21 Rules 10 Models
Cisco Meraki MX appliance	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	4 Rules 2 Models
Cisco Secure Email	T1078 - Valid Accounts	1 Rules
Cisco Secure Network Analytics	T1078 - Valid Accounts	1 Rules
Cisco Secure Web Appliance	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Cisco Umbrella	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Duo Access	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	26 Rules 9 Models
IronPort Email	T1078 - Valid Accounts	1 Rules
IronPort Web Security	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Citrix

Product	MITRE ATT&CK® TTP	Content
Citrix Endpoint Management	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	15 Rules 8 Models
Citrix Gateway	T1021 - Remote Services T1047 - Windows Management Instrumentation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services T1136 - Create Account T1136.001 - Create Account: Create: Local Account	33 Rules 15 Models
Citrix Gateway Connector For Exchange ActiveSync	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Citrix ShareFile	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Citrix Virtual Apps	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	13 Rules 8 Models
Citrix Virtual Desktop	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models

Vendor: Claroty

Product	MITRE ATT&CK® TTP	Content
CTD	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	9 Rules 3 Models

Vendor: Clearsense

Product	MITRE ATT&CK® TTP	Content
Clearsense	T1078 - Valid Accounts	2 Rules

Vendor: Clearswift

Product	MITRE ATT&CK® TTP	Content
Clearswift Secure Email Gateway	T1078 - Valid Accounts	1 Rules

Vendor: Click Studios

Product	MITRE ATT&CK® TTP	Content
Passwordstate	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	31 Rules 16 Models

Vendor: Cloudflare

Product	MITRE ATT&CK® TTP	Content
Cloudflare Insights	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	30 Rules 14 Models
Cloudflare WAF	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Code42

Product	MITRE ATT&CK® TTP	Content
Code42 Incydr	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Cognitas CrossLink

Product	MITRE ATT&CK® TTP	Content
Cognitas CrossLink	T1078 - Valid Accounts T1133 - External Remote Services	1 Rules

Vendor: Cohesity

Product	MITRE ATT&CK® TTP	Content
Cohesity DataPlatform	T1078 - Valid Accounts	2 Rules

Vendor: CrowdStrike

Product	MITRE ATT&CK® TTP	Content
Falcon	T1021 - Remote Services T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1531 - Account Access Removal T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	32 Rules 15 Models
Identity Threat Detection & Response	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models

Vendor: CyberArk

Product	MITRE ATT&CK® TTP	Content
CyberArk Endpoint Privilege Manager	T1078 - Valid Accounts	5 Rules 5 Models
CyberArk Privilege Access Manager	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	22 Rules 9 Models

Vendor: Cylance

Product	MITRE ATT&CK® TTP	Content
Cylance OPTICS	T1078 - Valid Accounts	1 Rules

Vendor: Darktrace

Product	MITRE ATT&CK® TTP	Content
Darktrace	T1078 - Valid Accounts	2 Rules

Vendor: Delinea

Product	MITRE ATT&CK® TTP	Content
Centrify Audit and Monitoring Service	T1078 - Valid Accounts	1 Rules
Centrify Authentication Service	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation	13 Rules 7 Models
Centrify Infrastructure Services	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models
Centrify Zero Trust Privilege Services	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models
Thycotic Software Secret Server	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models

Vendor: Dell

Product	MITRE ATT&CK® TTP	Content
EMC Isilon	T1021 - Remote Services T1078 - Valid Accounts T1078.002 - T1078.002	7 Rules 3 Models
One Identity Manager	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	9 Rules 2 Models
Sonicwall	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	13 Rules 8 Models

Vendor: Digital Arts

Product	MITRE ATT&CK® TTP	Content
Digital Arts i-FILTER for Business	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Digital Guardian

Product	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	26 Rules 14 Models
Digital Guardian Network DLP	T1078 - Valid Accounts	1 Rules

Vendor: Dropbox

Product	MITRE ATT&CK® TTP	Content
Dropbox	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	33 Rules 15 Models

Vendor: Dtex Systems

Product	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	T1047 - Windows Management Instrumentation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	21 Rules 12 Models

Vendor: EMP

Product	MITRE ATT&CK® TTP	Content
EMP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: ESET

Product	MITRE ATT&CK® TTP	Content
ESET Endpoint Security	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: ESector

Product	MITRE ATT&CK® TTP	Content
ESector DEFESA Logger	T1078 - Valid Accounts	1 Rules

Vendor: EdgeWave

Product	MITRE ATT&CK® TTP	Content
EdgeWave iPrism	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Egnyte

Product	MITRE ATT&CK® TTP	Content
Egnyte	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Epic

Product	MITRE ATT&CK® TTP	Content
Epic SIEM	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Exabeam

Product	MITRE ATT&CK® TTP	Content
Search	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Extreme Networks

Product	MITRE ATT&CK® TTP	Content
Zebra WLAN Management	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: F5

Product	MITRE ATT&CK® TTP	Content
F5 Access Policy Manager	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	6 Rules 3 Models
F5 Advanced Web Application Firewall	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	13 Rules 6 Models
F5 Application Security Manager	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
F5 BIG-IP	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	12 Rules 8 Models
F5 WebSafe	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: FTP

Product	MITRE ATT&CK® TTP	Content
FTP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Fast Enterprises

Product	MITRE ATT&CK® TTP	Content
Fast Enterprises GenTax	T1078 - Valid Accounts	2 Rules

Vendor: Fidelis

Product	MITRE ATT&CK® TTP	Content
Fidelis XPS	T1078 - Valid Accounts	1 Rules

Vendor: FileAuditor

Product	MITRE ATT&CK® TTP	Content
FileAuditor	T1078 - Valid Accounts	1 Rules

Vendor: FireEye

Product	MITRE ATT&CK® TTP	Content
FireEye CMS	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
FireEye ETP	T1078 - Valid Accounts	1 Rules
FireEye Endpoint Security (HX)	T1078 - Valid Accounts	1 Rules
FireEye Network Security (NX)	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002	11 Rules 6 Models

Vendor: FireMon

Product	MITRE ATT&CK® TTP	Content
FireMon	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Forcepoint

Product	MITRE ATT&CK® TTP	Content
Forcepoint CASB	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Forcepoint DLP	T1078 - Valid Accounts	1 Rules
Forcepoint Email Security	T1078 - Valid Accounts	1 Rules
Forcepoint Email Security Gateway	T1078 - Valid Accounts	1 Rules
Websense Security Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Forescout

Product	MITRE ATT&CK® TTP	Content
EyeInspect	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: Fortinet

Product	MITRE ATT&CK® TTP	Content
FortiGate	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	10 Rules 3 Models
FortiSIEM	T1078 - Valid Accounts	1 Rules
Fortinet Enterprise Firewall	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Fortinet UTM	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Fortiweb Web Application Firewall	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: GitHub

Product	MITRE ATT&CK® TTP	Content
GitHub	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	47 Rules 21 Models

Vendor: GoAnywhere

Product	MITRE ATT&CK® TTP	Content
GoAnywhere MFT	T1078 - Valid Accounts T1078.002 - T1078.002	13 Rules 7 Models

Vendor: Google

Product	MITRE ATT&CK® TTP	Content
GCP CloudAudit	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Google Cloud Platform	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.003 - Create Account: Create: Cloud Account	8 Rules 3 Models
Google Workspace	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models

Vendor: HP

Product	MITRE ATT&CK® TTP	Content
Aruba ClearPass Policy Manager	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	15 Rules 8 Models
Aruba Mobility Master	T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	17 Rules 7 Models
HP Virtual Connect Enterprise Manager	T1078 - Valid Accounts	2 Rules
HP iLO	T1078 - Valid Accounts	2 Rules
HPE Comware	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models

Vendor: HashiCorp

Product	MITRE ATT&CK® TTP	Content
HashiCorp Vault	T1078 - Valid Accounts T1098 - Account Manipulation	3 Rules
Terraform	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: HelpSystems

Product	MITRE ATT&CK® TTP	Content
Powertech Identity and Access Manager	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	22 Rules 12 Models

Vendor: Hornet

Product	MITRE ATT&CK® TTP	Content
Hornetsecurity Cloud Email Security Services	T1078 - Valid Accounts	2 Rules

Vendor: Huawei

Product	MITRE ATT&CK® TTP	Content
Huawei Unified Security Gateway	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1133 - External Remote Services T1136 - Create Account T1136.001 - Create Account: Create: Local Account	21 Rules 12 Models

Vendor: IBM

Product	MITRE ATT&CK® TTP	Content
DB2	T1078 - Valid Accounts T1078.002 - T1078.002	10 Rules 6 Models
IBM	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
IBM Mainframe	T1078 - Valid Accounts	2 Rules
IBM Mobile Connect	T1078 - Valid Accounts T1133 - External Remote Services	1 Rules
IBM Resource Access Control Facility	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Sametime	T1078 - Valid Accounts	2 Rules
Security Access Manager	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Sterling B2B Integrator	T1078 - Valid Accounts T1078.002 - T1078.002	12 Rules 7 Models

Vendor: ICDB

Product	MITRE ATT&CK® TTP	Content
ICDB	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: IMSVA

Product	MITRE ATT&CK® TTP	Content
IMSVA	T1078 - Valid Accounts	1 Rules

Vendor: Imperva

Product	MITRE ATT&CK® TTP	Content
Imperva File Activity Monitoring	T1078 - Valid Accounts	1 Rules
Imperva Incapsula	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Imperva SecureSphere	T1078 - Valid Accounts	2 Rules

Vendor: Imprivata

Product	MITRE ATT&CK® TTP	Content
Imprivata	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: InfoWatch

Product	MITRE ATT&CK® TTP	Content
InfoWatch DLP	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	3 Rules

Vendor: Infoblox

Product	MITRE ATT&CK® TTP	Content
BloxOne DDI	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002	11 Rules 6 Models

Vendor: Ipswitch

Product	MITRE ATT&CK® TTP	Content
MoveIt Transfer	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	35 Rules 14 Models

Vendor: Ivanti

Product	MITRE ATT&CK® TTP	Content
Ivanti Pulse Secure	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services T1531 - Account Access Removal	11 Rules 4 Models

Vendor: JH

Product	MITRE ATT&CK® TTP	Content
JH	T1078 - Valid Accounts	1 Rules

Vendor: Jumpcloud

Product	MITRE ATT&CK® TTP	Content
Jumpcloud	T1078 - Valid Accounts	2 Rules

Vendor: Juniper Networks

Product	MITRE ATT&CK® TTP	Content
Juniper SRX Series	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	2 Rules
Junos OS	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models

Vendor: Kasada

Product	MITRE ATT&CK® TTP	Content
Kasada	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Kaspersky

Product	MITRE ATT&CK® TTP	Content
Kaspersky AV	T1078 - Valid Accounts	1 Rules
Kaspersky Secure Mail Gateway	T1078 - Valid Accounts	1 Rules

Vendor: Kemp

Product	MITRE ATT&CK® TTP	Content
Kemp LoadMaster	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	15 Rules 8 Models

Vendor: LEAP

Product	MITRE ATT&CK® TTP	Content
LEAP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: LOGBinder

Product	MITRE ATT&CK® TTP	Content
LOGBinder for SharePoint	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: LanScope

Product	MITRE ATT&CK® TTP	Content
LanScope Cat	T1047 - Windows Management Instrumentation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	27 Rules 14 Models

Vendor: LastPass

Product	MITRE ATT&CK® TTP	Content
LastPass	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	24 Rules 9 Models

Vendor: Lenel

Product	MITRE ATT&CK® TTP	Content
OnGuard	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: LiquidFiles

Product	MITRE ATT&CK® TTP	Content
LiquidFiles	T1078 - Valid Accounts T1098 - Account Manipulation T1531 - Account Access Removal	5 Rules 1 Models

Vendor: LogMeIn

Product	MITRE ATT&CK® TTP	Content
RemotelyAnywhere	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models

Vendor: LogRhythm

Product	MITRE ATT&CK® TTP	Content
LogRhythm	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	16 Rules 8 Models

Vendor: Malwarebytes

Product	MITRE ATT&CK® TTP	Content
Malwarebytes Endpoint Detection and Response	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: ManageEngine

Product	MITRE ATT&CK® TTP	Content
ADAuditPlus	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1484 - Group Policy Modification	32 Rules 16 Models
ADSSP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
PAM360	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	15 Rules 8 Models

Vendor: McAfee

Product	MITRE ATT&CK® TTP	Content
McAfee DLP Endpoint	T1078 - Valid Accounts	1 Rules
McAfee DLP Prevent	T1078 - Valid Accounts	1 Rules
McAfee Email Protection	T1078 - Valid Accounts	1 Rules
McAfee Endpoint Security	T1078 - Valid Accounts T1078.002 - T1078.002	10 Rules 6 Models
McAfee Enterprise Security Manager	T1078 - Valid Accounts	6 Rules 3 Models
McAfee Network Security Platform	T1078 - Valid Accounts	2 Rules
McAfee Web Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Skyhigh Networks CASB	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Menlo Security

Product	MITRE ATT&CK® TTP	Content
Menlo Security	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Microsoft

Product	MITRE ATT&CK® TTP	Content
Azure	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Azure AD Activity Logs	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1484 - Group Policy Modification	33 Rules 16 Models
Azure AD Sign-In Logs	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Azure ATP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Azure Container Registry	T1078 - Valid Accounts	2 Rules
Azure DevOps	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Azure Key Vault	T1078 - Valid Accounts	2 Rules
Azure Kubernetes Service	T1078 - Valid Accounts T1078.004 - Valid Accounts: Cloud Accounts T1530 - Data from Cloud Storage Object	3 Rules 2 Models
Azure MFA	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Azure Monitor	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models
Azure Monitor - VM Insights	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models
Event Viewer - ADFS	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation	13 Rules 7 Models
Event Viewer - Application	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models
Event Viewer - AzureADPasswordProtection-DCAgent	T1098 - Account Manipulation	1 Rules
Event Viewer - BITS-Client	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Event Viewer - CAPI2	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Event Viewer - NTLM	T1078 - Valid Accounts	6 Rules 3 Models
Event Viewer - OpenSSH	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models
Event Viewer - PowerShell	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models
Event Viewer - RemoteDesktopServices	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Event Viewer - Security	T1021 - Remote Services T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1484 - Group Policy Modification T1531 - Account Access Removal T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	84 Rules 38 Models
Event Viewer - Setup	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Event Viewer - System	T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	7 Rules 3 Models
Event Viewer - TaskScheduler	T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	1 Rules 1 Models
Event Viewer - TerminalServices-Gateway	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models
Event Viewer - TerminalServices-RemoteConnectionManager	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models
Event Viewer - WinNat	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models
MSSQL	T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account	25 Rules 12 Models
Microsoft 365	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	42 Rules 20 Models
Microsoft CAS	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models
Microsoft Defender for Endpoint	T1021 - Remote Services T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	74 Rules 31 Models
Microsoft Exchange	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Microsoft IIS	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Microsoft Intune	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Microsoft RRAS	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models
Microsoft Sentinel	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	40 Rules 20 Models
Microsoft WMI Log	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	16 Rules 8 Models
Microsoft Web Application Proxy	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Sysmon	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	17 Rules 8 Models
Web Application Proxy-TLS Gateway	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Mimecast

Product	MITRE ATT&CK® TTP	Content
Mimecast Secure Email Gateway	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Mimecast Targeted Threat Protection - URL	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Mvision

Product	MITRE ATT&CK® TTP	Content
Mvision	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1484 - Group Policy Modification	8 Rules 4 Models

Vendor: NCP

Product	MITRE ATT&CK® TTP	Content
NCP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models

Vendor: NNT

Product	MITRE ATT&CK® TTP	Content
NNT ChangeTracker	T1078 - Valid Accounts	2 Rules

Vendor: Namespace rDirectory

Product	MITRE ATT&CK® TTP	Content
Namespace rDirectory	T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1484 - Group Policy Modification T1531 - Account Access Removal	43 Rules 19 Models

Vendor: Nasuni

Product	MITRE ATT&CK® TTP	Content
Nasuni	T1078 - Valid Accounts	1 Rules

Vendor: NetApp

Product	MITRE ATT&CK® TTP	Content
NetApp	T1078 - Valid Accounts	1 Rules

Vendor: NetDocs

Product	MITRE ATT&CK® TTP	Content
NetDocs	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: NetIQ

Product	MITRE ATT&CK® TTP	Content
Micro Focus NetIQ Identity Manager	T1078 - Valid Accounts	2 Rules

Vendor: NetMotion Wireless

Product	MITRE ATT&CK® TTP	Content
NetMotion Wireless	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models

Vendor: Netskope

Product	MITRE ATT&CK® TTP	Content
Netskope Security Cloud	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	25 Rules 9 Models
Netskope Webtx	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Netwrix

Product	MITRE ATT&CK® TTP	Content
Netwrix Auditor	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account	35 Rules 14 Models
Netwrix Threat Prevention	T1078 - Valid Accounts	2 Rules 1 Models

Vendor: NextDLP

Product	MITRE ATT&CK® TTP	Content
Reveal	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account	35 Rules 18 Models

Vendor: Nortel Contivity

Product	MITRE ATT&CK® TTP	Content
Nortel Contivity VPN	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models

Vendor: Nutanix

Product	MITRE ATT&CK® TTP	Content
Nutanix Unified Storage	T1078 - Valid Accounts	1 Rules

Vendor: Okta

Product	MITRE ATT&CK® TTP	Content
Okta Adaptive MFA	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	46 Rules 19 Models

Vendor: Onapsis

Product	MITRE ATT&CK® TTP	Content
Onapsis	T1078 - Valid Accounts	2 Rules

Vendor: OneLogin

Product	MITRE ATT&CK® TTP	Content
OneLogin	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: OneSpan

Product	MITRE ATT&CK® TTP	Content
Digipass for Apps	T1078 - Valid Accounts	1 Rules
OneSpan Sign	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: OneWelcome

Product	MITRE ATT&CK® TTP	Content
OneWelcome Cloud Identity Platform	T1078 - Valid Accounts T1098 - Account Manipulation	3 Rules

Vendor: Open VPN

Product	MITRE ATT&CK® TTP	Content
Open VPN	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	9 Rules 3 Models

Vendor: OpenLDAP

Product	MITRE ATT&CK® TTP	Content
OpenLDAP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	25 Rules 9 Models

Vendor: OpenText

Product	MITRE ATT&CK® TTP	Content
eDOCS	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Oracle

Product	MITRE ATT&CK® TTP	Content
Oracle Access Management	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Oracle Public Cloud	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	45 Rules 19 Models
Solaris	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models

Vendor: Osirium

Product	MITRE ATT&CK® TTP	Content
Osirium	T1078 - Valid Accounts	2 Rules

Vendor: Osquery

Product	MITRE ATT&CK® TTP	Content
Osquery	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Palo Alto Networks

Product	MITRE ATT&CK® TTP	Content
Cortex XDR	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
GlobalProtect	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	21 Rules 10 Models
Palo Alto Aperture	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Palo Alto NGFW	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1133 - External Remote Services	12 Rules 6 Models
Prisma Access	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1133 - External Remote Services	2 Rules
Prisma Cloud	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Password Manager Pro

Product	MITRE ATT&CK® TTP	Content
Password Manager Pro	T1078 - Valid Accounts T1098 - Account Manipulation T1531 - Account Access Removal	6 Rules 1 Models

Vendor: Perforce

Product	MITRE ATT&CK® TTP	Content
Perforce	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Phantom

Product	MITRE ATT&CK® TTP	Content
Phantom	T1078 - Valid Accounts	1 Rules

Vendor: Ping Identity

Product	MITRE ATT&CK® TTP	Content
Ping Access	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Ping Identity	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	8 Rules 2 Models
PingOne	T1078 - Valid Accounts	2 Rules

Vendor: Postfix

Product	MITRE ATT&CK® TTP	Content
Postfix	T1078 - Valid Accounts	1 Rules

Vendor: PowerSentry

Product	MITRE ATT&CK® TTP	Content
PowerSentry	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Procad

Product	MITRE ATT&CK® TTP	Content
Pro.File DMS	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Progress

Product	MITRE ATT&CK® TTP	Content
Progress Database	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models

Vendor: Proofpoint

Product	MITRE ATT&CK® TTP	Content
ObserveIT	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	25 Rules 14 Models
Proofpoint Email Protection	T1078 - Valid Accounts	1 Rules
Targeted Attack Platform	T1078 - Valid Accounts	1 Rules

Vendor: Qualys

Product	MITRE ATT&CK® TTP	Content
Qualys AssetView	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Quest Software

Product	MITRE ATT&CK® TTP	Content
Quest Change Auditor for Active Directory	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account T1484 - Group Policy Modification	42 Rules 20 Models

Vendor: RSA

Product	MITRE ATT&CK® TTP	Content
RSA Authentication Manager	T1078 - Valid Accounts	2 Rules
RSA DLP	T1078 - Valid Accounts	1 Rules
RSA NetWitness Platform	T1078 - Valid Accounts	2 Rules
SecurID	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	2 Rules 2 Models

Vendor: RangerAudit

Product	MITRE ATT&CK® TTP	Content
RangerAudit	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Rubrik

Product	MITRE ATT&CK® TTP	Content
Rubrik Cloud Data Management	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	23 Rules 9 Models

Vendor: SAP

Product	MITRE ATT&CK® TTP	Content
SAP	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	35 Rules 15 Models

Vendor: SIGSCI

Product	MITRE ATT&CK® TTP	Content
SIGSCI	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: SafeSend

Product	MITRE ATT&CK® TTP	Content
SafeSend	T1078 - Valid Accounts	1 Rules

Vendor: Sailpoint

Product	MITRE ATT&CK® TTP	Content
IdentityNow	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	8 Rules 2 Models
SecurityIQ	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Salesforce

Product	MITRE ATT&CK® TTP	Content
Salesforce	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	9 Rules 2 Models

Vendor: Sangfor

Product	MITRE ATT&CK® TTP	Content
Sangfor NGAF	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Saviynt

Product	MITRE ATT&CK® TTP	Content
Saviynt	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Secomea

Product	MITRE ATT&CK® TTP	Content
Secomea	T1078 - Valid Accounts	2 Rules

Vendor: SecureAuth

Product	MITRE ATT&CK® TTP	Content
SecureAuth IDP	T1078 - Valid Accounts T1098 - Account Manipulation	3 Rules
SecureAuth Login	T1078 - Valid Accounts	2 Rules

Vendor: SecureLink

Product	MITRE ATT&CK® TTP	Content
SecureLink	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: SecureNet

Product	MITRE ATT&CK® TTP	Content
SecureNet	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	3 Rules 2 Models

Vendor: Semperis

Product	MITRE ATT&CK® TTP	Content
Semperis DSP	T1078 - Valid Accounts T1484 - Group Policy Modification	4 Rules 2 Models

Vendor: SentinelOne

Product	MITRE ATT&CK® TTP	Content
Singularity Platform	T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	29 Rules 14 Models
Vigilance	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	23 Rules 9 Models

Vendor: ServiceNow

Product	MITRE ATT&CK® TTP	Content
ServiceNow	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Shibboleth

Product	MITRE ATT&CK® TTP	Content
Shibboleth	T1078 - Valid Accounts T1098 - Account Manipulation	3 Rules

Vendor: Silverfort

Product	MITRE ATT&CK® TTP	Content
Silverfort Authentication Platform	T1078 - Valid Accounts	2 Rules

Vendor: SkySea

Product	MITRE ATT&CK® TTP	Content
SkySea ClientView	T1047 - Windows Management Instrumentation T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	18 Rules 8 Models

Vendor: Skyformation

Product	MITRE ATT&CK® TTP	Content
Skyformation	T1078 - Valid Accounts	2 Rules

Vendor: Skyhigh Security

Product	MITRE ATT&CK® TTP	Content
Skyhigh Security Cloud	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Slack

Product	MITRE ATT&CK® TTP	Content
Slack	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Sophos

Product	MITRE ATT&CK® TTP	Content
Sophos Endpoint Protection	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	3 Rules
Sophos SafeGuard	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Sophos UTM	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Sophos XG Firewall	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	6 Rules 2 Models

Vendor: Specops

Product	MITRE ATT&CK® TTP	Content
Specops Password	T1098 - Account Manipulation	1 Rules

Vendor: Squid

Product	MITRE ATT&CK® TTP	Content
Squid	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: StealthBits

Product	MITRE ATT&CK® TTP	Content
StealthIntercept	T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1484 - Group Policy Modification	27 Rules 14 Models

Vendor: Swift

Product	MITRE ATT&CK® TTP	Content
Swift	T1078 - Valid Accounts	2 Rules

Vendor: Swivel

Product	MITRE ATT&CK® TTP	Content
Swivel	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Symantec

Product	MITRE ATT&CK® TTP	Content
Symantec Advanced Threat Protection	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	17 Rules 8 Models
Symantec CloudSOC	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Symantec Critical System Protection	T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account	29 Rules 12 Models
Symantec DLP	T1078 - Valid Accounts	1 Rules
Symantec Email Security	T1078 - Valid Accounts	1 Rules
Symantec Endpoint Protection	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Symantec Fireglass	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules
Symantec VIP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Symantec Web Security Service	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002	10 Rules 6 Models

Vendor: Tanium

Product	MITRE ATT&CK® TTP	Content
Tanium Cloud Platform	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Tanium Core Platform	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	10 Rules 6 Models
Tanium Integrity Monitor	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	11 Rules 6 Models

Vendor: Tessian

Product	MITRE ATT&CK® TTP	Content
Tessian Cloud Email Security	T1078 - Valid Accounts	1 Rules

Vendor: TitanFTP

Product	MITRE ATT&CK® TTP	Content
TitanFTP	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Trend Micro

Product	MITRE ATT&CK® TTP	Content
Apex One	T1078 - Valid Accounts	1 Rules
Deep Discovery Inspector	T1078 - Valid Accounts T1098 - Account Manipulation	3 Rules
Deep Security	T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	14 Rules 8 Models
OfficeScan	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	2 Rules
Trend Micro Email Security	T1078 - Valid Accounts	1 Rules
Vision One	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	24 Rules 9 Models

Vendor: Tripwire Enterprise

Product	MITRE ATT&CK® TTP	Content
Tripwire Enterprise	T1078 - Valid Accounts	1 Rules

Vendor: Tyco

Product	MITRE ATT&CK® TTP	Content
CCURE Building Management System	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Unix

Product	MITRE ATT&CK® TTP	Content
Auditbeat	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account	16 Rules 8 Models
Unix	T1021 - Remote Services T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	76 Rules 31 Models
Unix Auditd	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	67 Rules 29 Models
Unix Privilege Management	T1078 - Valid Accounts	2 Rules
Unix Sendmail	T1078 - Valid Accounts	1 Rules

Vendor: VMS Software

Product	MITRE ATT&CK® TTP	Content
OpenVMS	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: VMware

Product	MITRE ATT&CK® TTP	Content
Carbon Black App Control	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	22 Rules 12 Models
Carbon Black CES	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	13 Rules 6 Models
Carbon Black EDR	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1136 - Create Account T1136.001 - Create Account: Create: Local Account	11 Rules 6 Models
VMware ESXi	T1078 - Valid Accounts T1078.002 - T1078.002	11 Rules 6 Models
VMware Horizon	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models
VMware Identity Manager	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
VMware View	T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	16 Rules 8 Models
vCenter	T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	16 Rules 7 Models

Vendor: Varonis

Product	MITRE ATT&CK® TTP	Content
Varonis Data Security Platform	T1078 - Valid Accounts	1 Rules

Vendor: Vectra

Product	MITRE ATT&CK® TTP	Content
Vectra Cognito Detect	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models
Vectra Cognito Stream	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	6 Rules 2 Models

Vendor: Veeam

Product	MITRE ATT&CK® TTP	Content
Veeam	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Venafi

Product	MITRE ATT&CK® TTP	Content
TLS Protect	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Vormetric

Product	MITRE ATT&CK® TTP	Content
Vormetric	T1078 - Valid Accounts	1 Rules

Vendor: Watchguard

Product	MITRE ATT&CK® TTP	Content
Watchguard	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models

Vendor: Wazuh

Product	MITRE ATT&CK® TTP	Content
Wazuh	T1078 - Valid Accounts	3 Rules 1 Models

Vendor: Weblogin

Product	MITRE ATT&CK® TTP	Content
Weblogin	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: Wiz

Product	MITRE ATT&CK® TTP	Content
Wiz	T1078 - Valid Accounts T1531 - Account Access Removal	3 Rules 1 Models

Vendor: Workday

Product	MITRE ATT&CK® TTP	Content
Workday	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Xceedium

Product	MITRE ATT&CK® TTP	Content
Xceedium	T1078 - Valid Accounts	2 Rules

Vendor: Xiting

Product	MITRE ATT&CK® TTP	Content
XAMS	T1078 - Valid Accounts	2 Rules

Vendor: Zeek

Product	MITRE ATT&CK® TTP	Content
Zeek	T1021 - Remote Services T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	24 Rules 9 Models

Vendor: Zendesk

Product	MITRE ATT&CK® TTP	Content
Zendesk	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Zlock

Product	MITRE ATT&CK® TTP	Content
Zlock	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: Zscaler

Product	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Zscaler Private Access	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1133 - External Remote Services	6 Rules 2 Models

Vendor:

Vendor: iBoss

Product	MITRE ATT&CK® TTP	Content
Iboss Cloud	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	1 Rules

Vendor: iManage

Product	MITRE ATT&CK® TTP	Content
iManage	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: oVirt

Product	MITRE ATT&CK® TTP	Content
oVirt	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	6 Rules 2 Models

Vendor: xsuite

Product	MITRE ATT&CK® TTP	Content
xsuite	T1078 - Valid Accounts T1078.002 - T1078.002	9 Rules 6 Models