| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 61 | 24 | 17 | 3 | 3 |
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts |
User Execution |
Valid Accounts Boot or Logon Autostart Execution |
Valid Accounts Process Injection Boot or Logon Autostart Execution |
Obfuscated Files or Information: Indicator Removal from Tools Indicator Removal on Host: File Deletion Valid Accounts Indicator Removal on Host Obfuscated Files or Information Process Injection Signed Binary Proxy Execution Signed Binary Proxy Execution: Rundll32 |
OS Credential Dumping Input Capture |
File and Directory Discovery Query Registry |
Email Collection Input Capture Archive Collected Data |
Data Encrypted for Impact |