uc_access_to_file_data.md

Use Case: Access to File Data

Vendor: Accellion

Product	Event Types	MITRE TTP	Content
Accellion	account-password-change account-password-reset app-activity app-login dlp-email-alert-out failed-app-login file-delete file-download file-read file-upload	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Airlock

Product	Event Types	MITRE TTP	Content
Airlock	app-activity-failed failed-app-login file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: AssetView

Product	Event Types	MITRE TTP	Content
AssetView	file-download file-write print-activity security-alert usb-insert	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: BeyondTrust

Product	Event Types	MITRE TTP	Content
BeyondTrust PowerBroker	privileged-access process-created	T1003 - OS Credential Dumping	1 Rules
BeyondTrust Privilege Management	local-logon process-created	T1003 - OS Credential Dumping	1 Rules

Vendor: Bitglass

Product	Event Types	MITRE TTP	Content
Bitglass CASB	app-login dlp-alert dlp-email-alert-out failed-app-login file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Box

Product	Event Types	MITRE TTP	Content
Box Cloud Content Management	app-activity app-login file-delete file-download file-permission-change file-read file-upload file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Bromium

Product	Event Types	MITRE TTP	Content
Bromium Secure Platform	file-permission-change file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Centrify

Product	Event Types	MITRE TTP	Content
Centrify Audit and Monitoring Service	file-delete file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models
Centrify Infrastructure Services	process-created	T1003 - OS Credential Dumping	1 Rules

Vendor: Cisco

Product	Event Types	MITRE TTP	Content
Cisco Adaptive Security Appliance	authentication-failed authentication-successful dns-response failed-logon failed-vpn-login file-download file-upload nac-logon network-connection-successful process-created remote-logon vpn-login vpn-logout web-activity-denied	T1003 - OS Credential Dumping	1 Rules
Cisco NPE	process-created	T1003 - OS Credential Dumping	1 Rules
Cisco TACACS	process-created	T1003 - OS Credential Dumping	1 Rules

Vendor: Citrix

Product	Event Types	MITRE TTP	Content
Citrix Netscaler	app-activity app-login authentication-failed failed-vpn-login process-created vpn-login vpn-logout	T1003 - OS Credential Dumping	1 Rules

Vendor: Code42

Product	Event Types	MITRE TTP	Content
Code42 Incydr	dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity usb-activity usb-insert	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: CrowdStrike

Product	Event Types	MITRE TTP	Content
Falcon	app-activity app-activity-failed app-login authentication-failed batch-logon computer-logon config-change dlp-alert dns-query failed-app-login file-alert file-delete file-download file-read file-write local-logon network-connection-successful process-alert process-created process-network remote-access remote-logon security-alert service-logon task-created usb-activity usb-insert	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: CyberArk

Product	Event Types	MITRE TTP	Content
CyberArk Vault	account-password-change account-password-change-failed account-password-reset account-switch app-activity app-activity-failed app-login failed-app-login failed-logon file-delete file-permission-change file-read file-write remote-logon security-alert	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: DTEX InTERCEPT

Product	Event Types	MITRE TTP	Content
DTEX InTERCEPT	file-delete file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Dell

Product	Event Types	MITRE TTP	Content
Dell EMC Isilon	file-delete file-read file-write remote-access	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Digital Guardian

Product	Event Types	MITRE TTP	Content
Digital Guardian Endpoint Protection	app-activity dlp-email-alert-out file-delete file-download file-read file-upload file-write local-logon print-activity process-created usb-insert usb-write	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: Dtex Systems

Product	Event Types	MITRE TTP	Content
DTEX InTERCEPT	file-write local-logon print-activity process-created remote-logon usb-write web-activity-allowed workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: ESector

Product	Event Types	MITRE TTP	Content
ESector DEFESA	file-delete file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Egnyte

Product	Event Types	MITRE TTP	Content
Egnyte	app-activity app-login failed-app-login file-delete file-download file-permission-change file-upload file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: FTP

Product	Event Types	MITRE TTP	Content
FTP	app-activity app-activity-failed app-login failed-app-login file-delete file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: FireEye

Product	Event Types	MITRE TTP	Content
FireEye Endpoint Security (HX)	file-write network-alert process-alert security-alert	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Google

Product	Event Types	MITRE TTP	Content
Google Drive	file-delete file-download file-permission-change file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: HP

Product	Event Types	MITRE TTP	Content
HP Comware	process-created	T1003 - OS Credential Dumping	1 Rules

Vendor: HelpSystems

Product	Event Types	MITRE TTP	Content
Powertech Identity Access Manager (BoKs)	account-switch file-delete file-read file-write local-logon process-created remote-logon	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: Huawei

Product	Event Types	MITRE TTP	Content
Unified Security Gateway	authentication-successful process-created vpn-login	T1003 - OS Credential Dumping	1 Rules

Vendor: IBM

Product	Event Types	MITRE TTP	Content
IBM DB2	authentication-failed file-read remote-logon security-alert	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Imperva

Product	Event Types	MITRE TTP	Content
Imperva File Activity Monitoring (FAM)	file-delete file-permission-change file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Ipswitch

Product	Event Types	MITRE TTP	Content
IPswitch MoveIt	app-activity app-login failed-app-login file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models
MoveIt DMZ	account-password-change authentication-failed authentication-successful failed-logon file-delete file-download file-upload file-write member-added	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Kiteworks

Product	Event Types	MITRE TTP	Content
Kiteworks	account-password-change app-activity app-login dlp-email-alert-out file-delete file-download file-permission-change file-read file-upload file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: LOGBinder

Product	Event Types	MITRE TTP	Content
SharePoint	app-activity file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: LanScope Cat

Product	Event Types	MITRE TTP	Content
LanScope Cat	app-activity file-delete file-write process-created process-created-failed process-network	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: LogRhythm

Product	Event Types	MITRE TTP	Content
LogRhythm	process-created	T1003 - OS Credential Dumping	1 Rules

Vendor: McAfee

Product	Event Types	MITRE TTP	Content
McAfee Endpoint Security	dlp-alert failed-app-login file-write print-activity process-alert process-created-failed remote-logon security-alert usb-insert usb-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Microsoft

Product	Event Types	MITRE TTP	Content
Microsoft Azure	app-activity app-activity-failed app-login authentication-failed authentication-successful cloud-admin-activity cloud-admin-activity-failed failed-app-login file-delete file-download file-read file-upload file-write network-alert process-created storage-access storage-activity storage-activity-failed	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models
Microsoft Cloud App Security (MCAS)	app-activity app-login failed-app-login file-upload file-write security-alert	T1083 - File and Directory Discovery	3 Rules 3 Models
Microsoft Defender ATP	process-created security-alert	T1003 - OS Credential Dumping	1 Rules
Microsoft Office 365	account-disabled account-password-change account-unlocked app-activity app-activity-failed app-login database-query dlp-alert dlp-email-alert-in dlp-email-alert-out dns-query failed-app-login file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed network-connection-failed network-connection-successful process-created remote-logon security-alert usb-activity usb-insert	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models
Microsoft OneDrive	file-read	T1083 - File and Directory Discovery	3 Rules 3 Models
Microsoft Sysmon	dns-query file-delete file-write image-loaded process-created process-network registry-write	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models
Microsoft Windows	account-creation account-deleted account-disabled account-enabled account-lockout account-password-change account-password-change-failed account-password-reset account-switch account-unlocked app-login audit-log-clear audit-policy-change authentication-failed authentication-successful batch-logon computer-logon database-failed-login database-query dcom-activation-failed dns-query dns-response ds-access failed-app-login failed-logon failed-vpn-login file-close file-delete file-read file-write kerberos-logon local-logon logout-remote member-added member-removed nac-failed-logon nac-logon network-connection-successful ntlm-logon privileged-access privileged-object-access process-created process-network process-network-failed registry-write remote-access remote-logon security-alert service-created service-logon share-access share-access-denied task-created usb-activity usb-insert vpn-login winsession-disconnect workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: Nasuni

Product	Event Types	MITRE TTP	Content
Nasuni	file-delete file-permission-change file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: NetApp

Product	Event Types	MITRE TTP	Content
NetApp	file-alert file-delete file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: NetDocs

Product	Event Types	MITRE TTP	Content
NetDocs	app-activity file-delete file-read file-upload file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Netskope

Product	Event Types	MITRE TTP	Content
Netskope Security Cloud	app-activity app-login dlp-alert dlp-email-alert-out file-delete file-download file-permission-change file-read file-upload file-write network-connection-failed network-connection-successful security-alert web-activity-allowed web-activity-denied	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Netwrix

Product	Event Types	MITRE TTP	Content
Netwrix Auditor	account-disabled account-lockout account-password-reset account-unlocked app-activity app-login database-access database-failed-login ds-access failed-app-login failed-logon file-delete file-write member-added member-removed	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: ObserveIT

Product	Event Types	MITRE TTP	Content
ObserveIT	app-activity app-login database-access dlp-alert failed-app-login process-created remote-logon security-alert	T1003 - OS Credential Dumping	1 Rules

Vendor: Oracle

Product	Event Types	MITRE TTP	Content
Oracle Solaris	process-created process-created-failed	T1003 - OS Credential Dumping	1 Rules

Vendor: Palo Alto Networks

Product	Event Types	MITRE TTP	Content
Palo Alto Aperture	app-activity app-login dlp-alert file-delete file-download file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: RangerAudit

Product	Event Types	MITRE TTP	Content
RangerAudit	app-activity app-login database-activity-failed database-query failed-app-login file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Sailpoint

Product	Event Types	MITRE TTP	Content
SecurityIQ	account-creation account-deleted account-lockout account-password-reset file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: SentinelOne

Product	Event Types	MITRE TTP	Content
SentinelOne	app-activity dns-query dns-response file-alert file-delete file-read file-write network-alert network-connection-failed network-connection-successful process-created security-alert task-created web-activity-allowed	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: ServiceNow

Product	Event Types	MITRE TTP	Content
ServiceNow	app-activity file-delete file-download file-read file-upload file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: SkySea

Product	Event Types	MITRE TTP	Content
ClientView	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity process-created security-alert share-access usb-activity web-activity-allowed web-activity-denied	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: StealthBits

Product	Event Types	MITRE TTP	Content
StealthIntercept	account-disabled account-enabled ds-access failed-ds-access file-permission-change file-read file-write member-added member-removed	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Symantec

Product	Event Types	MITRE TTP	Content
Symantec CloudSOC	app-activity app-login dlp-alert failed-app-login file-delete file-download file-upload	T1083 - File and Directory Discovery	3 Rules 3 Models
Symantec DLP	config-change dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon failed-usb-activity file-alert file-delete file-write member-added member-removed network-alert process-alert security-alert usb-insert usb-read usb-write	T1083 - File and Directory Discovery	3 Rules 3 Models
Symantec EDR	process-created security-alert	T1003 - OS Credential Dumping	1 Rules

Vendor: Tanium

Product	Event Types	MITRE TTP	Content
Endpoint Platform	authentication-failed authentication-successful dns-response process-created security-alert	T1003 - OS Credential Dumping	1 Rules

Vendor: Unix

Product	Event Types	MITRE TTP	Content
Auditbeat	app-activity app-activity-failed authentication-successful process-created process-network process-network-failed	T1003 - OS Credential Dumping	1 Rules
Unix	account-creation account-deleted account-lockout account-password-change account-switch authentication-failed authentication-successful batch-logon computer-logon dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon file-delete file-read file-write kerberos-logon local-logon member-added member-removed process-created process-created-failed remote-access remote-logon security-alert task-created	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models
Unix Auditd	account-deleted account-password-change account-switch app-activity-failed authentication-failed authentication-successful failed-logon file-read file-write local-logon member-added member-removed process-created process-created-failed remote-logon security-alert	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models

Vendor: VMware

Product	Event Types	MITRE TTP	Content
VMware Carbon Black App Control	app-login file-alert file-delete file-download file-read file-write local-logon network-connection-failed network-connection-successful process-alert process-created process-network security-alert usb-insert workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models
VMware Carbon Black Cloud Endpoint Standard	file-write process-created security-alert	T1003 - OS Credential Dumping T1083 - File and Directory Discovery	4 Rules 3 Models
VMware Carbon Black EDR	process-created security-alert	T1003 - OS Credential Dumping	1 Rules

Vendor: Varonis

Product	Event Types	MITRE TTP	Content
Data Security Platform	dlp-alert file-delete file-permission-change file-read file-write	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Vormetric

Product	Event Types	MITRE TTP	Content
Vormetric	file-alert file-read	T1083 - File and Directory Discovery	3 Rules 3 Models

Vendor: Zeek

Product	Event Types	MITRE TTP	Content
Zeek Network Security Monitor	app-activity authentication-failed authentication-successful computer-logon dlp-email-alert-in dlp-email-alert-out dns-query dns-response failed-logon file-delete file-read file-write kerberos-logon nac-failed-logon nac-logon network-alert network-connection-failed network-connection-successful ntlm-logon remote-access remote-logon share-access web-activity-allowed web-activity-denied	T1083 - File and Directory Discovery	3 Rules 3 Models