infosecn1nja
/
DeTTECT
mirror of https://github.com/infosecn1nja/DeTTECT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
DeTTECT/sample-data/techniques-administration-e...

3305 lines
64 KiB
YAML
Raw Normal View History

- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
version: 1.2
initial commit
2019-03-29 14:26:25 +00:00
file_type: technique-administration
Changed name field in techniques administration sample file.
2019-04-23 12:57:11 +00:00
name: example
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
platform: ['Windows', 'Azure', 'Azure AD', 'Office 365']
initial commit
2019-03-29 14:26:25 +00:00
techniques:
# - Note that detection and visibility are independent from each other.
# Meaning that detection could be left blank and only have visibility filled in.
# - Also note that the below serves purely as an example and is therefore not accurate on all areas.
#
# - If desired you are free to add any key-value pairs. This will not impact the functionality of the tool.
- technique_id: T1222
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: File Permissions Modification
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1223
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Compiled HTML File
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1221
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Template Injection
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1220
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: XSL Script Processing
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1217
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Browser Bookmark Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1196
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Control Panel Items
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [client endpoints]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1214
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Credentials in Registry
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1189
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Drive-by Compromise
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [SIEM UC 123, Tool Model Y]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-08-05
score: 3
comment: 'This detection was improved due to the availability of the new log source Process use of network'
- date: 2018-11-01
score: 1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1203
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exploitation for Client Execution
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1210
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exploitation of Remote Services
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1211
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exploitation for Defense Evasion
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1202
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Indirect Command Execution
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1212
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exploitation for Credential Access
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1201
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Password Policy Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [domain controllers]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1191
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: CMSTP
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1219
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Remote Access Tools
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 3
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1198
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: SIP and Trust Provider Hijacking
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1218
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Signed Binary Proxy Execution
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1193
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Spearphishing Attachment
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1216
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Signed Script Proxy Execution
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1192
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Spearphishing Link
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1209
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Time Providers
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1195
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Supply Chain Compromise
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1194
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Spearphishing via Service
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 4
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1204
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: User Execution
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 0
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1182
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: AppCert DLLs
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1176
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Browser Extensions
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1175
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Distributed Component Object Model
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1185
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Man in the Browser
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1174
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Password Filter DLL
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1170
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Mshta
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1171
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: LLMNR/NBT-NS Poisoning
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- applicable_to: [client endpoints]
location:
- Third party product A
comment: |
This comment will be
multiline in
Excel
score_logbook:
- date: 2017-01-01
score: 2
comment: ''
- applicable_to: [servers]
location:
- Model I
comment: ''
score_logbook:
- date: 2019-05-01
Re-added multiple visibilities and detections to T1171
2019-05-01 10:06:39 +00:00
score: 3
comment: ''
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- applicable_to: [client endpoints]
comment: ''
score_logbook:
- date: 2019-03-01
Re-added multiple visibilities and detections to T1171
2019-05-01 10:06:39 +00:00
score: 2
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- applicable_to: [servers]
comment: |
This comment will be
multiline in
Excel
score_logbook:
- date: 2019-03-01
Re-added multiple visibilities and detections to T1171
2019-05-01 10:06:39 +00:00
score: 3
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1173
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Dynamic Data Exchange
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1181
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Extra Window Memory Injection
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1179
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Hooking
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1186
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Process Doppelgänging
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1172
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Domain Fronting
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Model A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-08-01
score: 5
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1183
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Image File Execution Options Injection
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [Tool]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-11-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1177
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: LSASS Driver
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1180
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Screensaver
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1134
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Access Token Manipulation
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1138
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Application Shimming
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [SIEM]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1140
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Deobfuscate/Decode Files or Information
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1136
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Create Account
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1137
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Office Application Startup
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1158
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Hidden Files and Directories
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1135
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Network Share Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1132
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data Encoding
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1131
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Authentication Package
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1129
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Execution through Module Load
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1128
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Netsh Helper DLL
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1127
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Trusted Developer Utilities
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1126
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Network Share Connection Removal
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1125
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Video Capture
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1124
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: System Time Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1123
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Audio Capture
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1122
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Component Object Model Hijacking
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1121
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Regsvcs/Regasm
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1118
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: InstallUtil
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1117
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Regsvr32
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1114
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Email Collection
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1113
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Screen Capture
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1112
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Modify Registry
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1111
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Two-Factor Authentication Interception
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1109
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Component Firmware
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1108
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Redundant Access
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1106
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Execution through API
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1105
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Remote File Copy
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1103
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: AppInit DLLs
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1102
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Web Service
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1101
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Security Support Provider
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [SIEM UC 789]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-11-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1100
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Web Shell
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1099
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Timestomp
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [Tool Model X]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-11-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1095
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Standard Non-Application Layer Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1094
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Custom Command and Control Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1093
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Process Hollowing
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1090
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Connection Proxy
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1089
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Disabling Security Tools
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1088
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Bypass User Account Control
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1087
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Account Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1086
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: PowerShell
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1085
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Rundll32
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1083
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: File and Directory Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1082
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: System Information Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1080
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Taint Shared Content
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1079
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Multilayer Encryption
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1078
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Valid Accounts
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- ''
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1077
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Windows Admin Shares
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-10-01
score: 0
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1076
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Remote Desktop Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1074
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data Staged
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1073
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: DLL Side-Loading
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1072
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Third-party Software
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1071
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Standard Application Layer Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [SIEM UC 123]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-11-01
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1070
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Indicator Removal on Host
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1069
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Permission Groups Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1068
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exploitation for Privilege Escalation
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1066
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Indicator Removal from Tools
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1065
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Uncommonly Used Port
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Model B
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-10-01
score: 5
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1064
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Scripting
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR, AV Product]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1063
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Security Software Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1061
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Graphical User Interface
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1060
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Registry Run Keys / Startup Folder
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1059
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Command-Line Interface
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1058
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Service Registry Permissions Weakness
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1057
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Process Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1056
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Input Capture
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [client endpoints]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1055
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Process Injection
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1054
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Indicator Blocking
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1053
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Scheduled Task
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Fixed some errors
2019-05-17 12:05:48 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- ''
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1051
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Shared Webroot
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1050
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: New Service
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
comment: Model G
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1049
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: System Network Connections Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1048
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exfiltration Over Alternative Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1047
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Windows Management Instrumentation
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1043
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Commonly Used Port
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-10-01
score: 0
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1042
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Change Default File Association
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1041
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exfiltration Over Command and Control Channel
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1040
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Network Sniffing
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1039
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data from Network Shared Drive
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1038
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: DLL Search Order Hijacking
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1037
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Logon Scripts
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Model F
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-05-07
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1036
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Masquerading
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [Model C]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-02-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1035
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Service Execution
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 4
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1034
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Path Interception
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1033
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: System Owner/User Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1032
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Standard Cryptographic Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1031
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Modify Existing Service
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1030
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data Transfer Size Limits
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- ''
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1029
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Scheduled Transfer
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1028
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Windows Remote Management
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Fixed some errors
2019-05-17 12:05:48 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- ''
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1027
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Obfuscated Files or Information
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1026
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Multiband Communication
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1025
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data from Removable Media
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1024
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Custom Cryptographic Protocol
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 0
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1023
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Shortcut Modification
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1022
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data Encrypted
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Model D
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-10-10
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1020
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Automated Exfiltration
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1018
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Remote System Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party product A
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-01-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1017
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Application Deployment Software
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1016
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: System Network Configuration Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1015
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Accessibility Features
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1013
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Port Monitors
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1012
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Query Registry
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1011
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Exfiltration Over Other Network Medium
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1010
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Application Window Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1008
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Fallback Channels
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1007
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: System Service Discovery
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1005
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data from Local System
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1004
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Winlogon Helper DLL
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1003
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Credential Dumping
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location: [EDR]
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2018-12-01
score: 3
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1002
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data Compressed
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Model E
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2017-10-10
score: 2
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
initial commit
2019-03-29 14:26:25 +00:00
- technique_id: T1001
Updated to version 1.1
2019-04-23 11:51:46 +00:00
technique_name: Data Obfuscation
initial commit
2019-03-29 14:26:25 +00:00
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
initial commit
2019-03-29 14:26:25 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
initial commit
2019-03-29 14:26:25 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1485
technique_name: Data Destruction
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1486
technique_name: Data Encrypted for Impact
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Model J
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2015-01-01
score: 4
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 3
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1488
technique_name: Disk Content Wipe
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1499
technique_name: Endpoint Denial of Service
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [websites]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2015-01-01
score: 5
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [websites]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 4
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1490
technique_name: Inhibit System Recovery
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1498
technique_name: Network Denial of Service
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [websites]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
- Third party
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2015-01-01
score: 5
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [websites]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 4
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1496
technique_name: Resource Hijacking
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1494
technique_name: Runtime Data Manipulation
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1489
technique_name: Service Stop
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1500
technique_name: Compile After Delivery
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1483
technique_name: Domain Generation Algorithms
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 1
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1482
technique_name: Domain Trust Discovery
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1480
technique_name: Execution Guardrails
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
- date: 2019-03-01
score: 4
comment: ''
auto_generated: true
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
- technique_id: T1497
technique_name: Virtualization/Sandbox Evasion
detection:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
location:
- ''
comment: ''
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
Added new examples for the new tactic "Impact"
2019-05-01 10:04:59 +00:00
visibility:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
applicable_to: [all]
comment: ''
score_logbook:
- date: 2019-03-01
score: 2
comment: ''
auto_generated: true
- technique_id: T1187
technique_name: Forced Authentication
detection:
applicable_to:
- all
location:
- ''
comment: ''
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
visibility:
applicable_to:
- all
comment: ''
score_logbook:
- date: 2019-07-30
score: 1
comment: 'New data source: Process use of network'
auto_generated: true
- technique_id: T1141
technique_name: Input Prompt
detection:
applicable_to:
- all
location:
- ''
comment: ''
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
visibility:
applicable_to:
- all
comment: ''
score_logbook:
- date: 2019-07-30
score: 2
comment: 'New data source: Process use of network'
auto_generated: true
- technique_id: T1104
technique_name: Multi-Stage Channels
detection:
applicable_to:
- all
location:
- ''
comment: ''
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
visibility:
applicable_to:
- all
comment: ''
score_logbook:
- date: 2019-07-30
score: 1
comment: 'New data source: Process use of network'
auto_generated: true
- technique_id: T1046
technique_name: Network Service Scanning
detection:
applicable_to:
- all
location:
- ''
comment: ''
score_logbook:
Changed the platform and/or added some comments
2020-02-10 06:39:11 +00:00
- date:
- Updated to version 1.2 of the tech. administration file. - Improved visibility scores due to the new data source: Process use of network.
2019-07-31 08:05:44 +00:00
score: -1
comment: ''
visibility:
applicable_to:
- all
comment: ''
score_logbook:
- date: 2019-07-30
score: 1
comment: 'New data source: Process use of network'
auto_generated: true