{
    "contentVersion": "1.0.0.0",
    "parameters": {
      "workspaceName": {
          "type": "string",
          "metadata": {
              "description": "Workspace name for Log Analytics where Sentinel is setup"
          }
      },
      "workbookId": {
        "type": "string",
        "defaultValue": "[newGuid()]",
        "metadata": {
          "description": "The unique guid for this workbook instance"
        }
      }
    },
    "variables": {
      "workbookSourceId": "[concat(subscription().id,'/resourcegroups/',resourceGroup().name,'/providers/microsoft.operationalinsights/workspaces/',parameters('workspaceName'))]"
    },
    "resources": [
      {
        "name": "[parameters('workbookId')]",
        "type": "microsoft.insights/workbooks",
        "location": "[resourceGroup().location]",
        "apiVersion": "2022-04-01",
        "dependsOn": [],
        "kind": "shared",
        "properties": {
          "displayName": "Use Cases Mapper",
          "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# This workbook helps you map your use cases across Content Hub solutions in Microsoft Sentinel\\r\\n\\r\\nIn pills:\\r\\n- **STEP 0** <br>\\r\\nDeploy the solution/ARM template\\r\\n- **STEP 1** <br>\\r\\nSelect the use cases of interest\\r\\n- **STEP 2** <br>\\r\\nSelect the currently active data sources <br>\\r\\n- **STEP 3** <br>\\r\\nExplore the content\\r\\n\\r\\nThis workbook is aligned with solutions available in the official Sentinel Github Repository. You can visit it here https://github.com/Azure/Azure-Sentinel\"},\"name\":\"text - 0\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# 0. Related resources\\r\\n\\r\\nThis workbook uses data stored in the following watchlists:\\r\\n- **\\\\_ucases\\\\_**\\r\\n- **\\\\_arules\\\\_**\\r\\n- **\\\\_wbooks\\\\_**\\r\\n- **\\\\_hqueries\\\\_**\\r\\n- **\\\\_tactec\\\\_**\\r\\n\\r\\n**If you imported this workbook a little while ago, wait a few minutes for the watchlists to be available.**\"},\"name\":\"text - 5 - Copy\"}]},\"name\":\"group - 20\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"bullets\",\"links\":[]},\"name\":\"links - 18\"},{\"type\":1,\"content\":{\"json\":\"# 1. Select Use Cases\\r\\n\\r\\n\"},\"name\":\"text - 5\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f93d9a04-dcbb-4625-9354-6e9651e0b78b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"usecases\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"_GetWatchlist('_ucases_')\\r\\n| distinct usecasename\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":null,\"label\":\"Use Cases\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":1,\"content\":{\"json\":\"The use cases you have selected are intended to protect you against the following tactics and techniques\",\"style\":\"info\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| extend technique = strcat(name, ' (',id,')')\\r\\n| summarize techniques = make_set(technique) by tactics\\r\\n| extend techniques=strcat_array(techniques, \\\" - \\\")\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 16\"},{\"type\":1,\"content\":{\"json\":\"# 2. Select Data Sources\"},\"name\":\"text - 0 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d5680494-689e-497f-a413-db3921b36eb6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"datasource\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"_GetWatchlist('_anrules_')\\r\\n| distinct solution\",\"typeSettings\":{\"additionalResourceOptions\":[]},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":null,\"label\":\"Data Sources\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":1,\"content\":{\"json\":\"# 3. Explore\"},\"name\":\"text - 0 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Use Cases & Solutions\\r\\nBelow is the list of solutions available in Sentinel\"},\"name\":\"text - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\",\"size\":4,\"showExportToExcel\":true,\"queryType\":2,\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Parameter name\",\"formatter\":5},{\"columnMatch\":\"Display name\",\"formatter\":1},{\"columnMatch\":\"Parameter type\",\"formatter\":5},{\"columnMatch\":\"Value\",\"formatter\":1},{\"columnMatch\":\"Formatted\",\"formatter\":5},{\"columnMatch\":\"Label\",\"formatter\":5},{\"columnMatch\":\"Pending\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5}]}},\"name\":\"query - 20\"}]},\"name\":\"group - 21\"},{\"type\":1,\"content\":{\"json\":\"## Analytics Rules\\r\\nThose are the Analytics Rules that you can implement to cover your use cases.<br>\\r\\nIf you are interested to see all the Analytics Rules for the selected data sources, please select _use case=all_\"},\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_anrules_')\\r\\n| where solution in ({datasource})\\r\\n| project techniques = split(techniques,\\\" \\\"), solution, id, name, tactics\\r\\n| mv-expand techniques\\r\\n| where techniques in ( \\r\\n_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| project id\\r\\n)\\r\\n| summarize techniques = make_set(techniques) by tostring(id), name, solution\\r\\n| extend techniques = strcat_array(techniques, \\\" \\\")\\r\\n\\r\\n\\r\\n\",\"size\":0,\"noDataMessage\":\"There are not Analytics Rules for the selected data sources that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"sortBy\":[]},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_anrules_')\\r\\n| where solution in ({datasource})\\r\\n| project techniques = split(techniques,\\\" \\\"), solution, id, name, tactics\\r\\n| mv-expand techniques\\r\\n| where techniques in ( \\r\\n_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| project id\\r\\n)\\r\\n| summarize techniques = make_set(techniques) by tostring(id), name, solution, tactics\\r\\n| extend techniques = strcat_array(techniques, \\\" \\\")\\r\\n| project tactics\\r\\n| summarize count() by tostring(tactics)\\r\\n| render piechart\\r\\n\\r\\n\",\"size\":0,\"title\":\"Analytics Rules Tactics\",\"noDataMessage\":\"There are not Analytics Rules for the selected data sources  that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_anrules_')\\r\\n| where solution in ({datasource})\\r\\n| project techniques = split(techniques,\\\" \\\"), solution, id, name, tactics\\r\\n| mv-expand techniques\\r\\n| where techniques in ( \\r\\n_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| project id\\r\\n)\\r\\n| project techniques\\r\\n| summarize count() by tostring(techniques)\\r\\n| render piechart\",\"size\":0,\"title\":\"Analytics Rules Techniques\",\"noDataMessage\":\"There are not Analytics Rules for the selected data sources  that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"## Hunting Queries\\r\\nThose are the Hunting Queries that you can implement to cover your use cases.<br>\\r\\nIf you are interested to see all the Hunting Queries for the selected data sources, please select use _case=all_\\r\\n\\r\\n\\r\\n\"},\"name\":\"text - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_hqueries_')\\r\\n| where solution in ({datasource})\\r\\n| project techniques = split(techniques,\\\" \\\"), solution, id, name, tactics\\r\\n| mv-expand techniques\\r\\n| where techniques in ( \\r\\n_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| project id\\r\\n)\\r\\n| summarize techniques = make_set(techniques) by tostring(id), name, solution\\r\\n| extend techniques = strcat_array(techniques, \\\" \\\")\\r\\n\\r\\n\\r\\n\",\"size\":0,\"noDataMessage\":\"There are not Hunting Queries for the selected data sources  that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"solution\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"solution\",\"sortOrder\":1}]},\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_hqueries_')\\r\\n| where solution in ({datasource})\\r\\n| project techniques = split(techniques,\\\" \\\"), solution, id, name, tactics\\r\\n| mv-expand techniques\\r\\n| where techniques in ( \\r\\n_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| project id\\r\\n)\\r\\n| summarize techniques = make_set(techniques) by tostring(id), name, solution, tactics\\r\\n| extend techniques = strcat_array(techniques, \\\" \\\")\\r\\n| project tactics\\r\\n| summarize count() by tostring(tactics)\\r\\n| render piechart\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hunting Queries Tactics\",\"noDataMessage\":\"There are not Hunting Queries for the selected data sources  that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 3 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_hqueries_')\\r\\n| where solution in ({datasource})\\r\\n| project techniques = split(techniques,\\\" \\\"), solution, id, name, tactics\\r\\n| mv-expand techniques\\r\\n| where techniques in ( \\r\\n_GetWatchlist('_ucases_')\\r\\n| where usecasename in ({usecases})\\r\\n| summarize result = strcat_array(make_list(tactic), \\\" \\\")\\r\\n| project tactics = split(result,\\\" \\\")\\r\\n| mv-expand tactics\\r\\n| where isnotempty(tactics)\\r\\n| distinct tostring(tactics)\\r\\n| join _GetWatchlist('_tactec_') on tactics\\r\\n| project tactics, id, name\\r\\n| project id\\r\\n)\\r\\n| project techniques\\r\\n| summarize count() by tostring(techniques)\\r\\n| render piechart\",\"size\":0,\"title\":\"Hunting Queries Techniques\",\"noDataMessage\":\"There are not Hunting Queries for the selected data sources  that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 4 - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Workbooks\\r\\nThose are the Workbooks that you can implement to cover your use cases for your data sources.<br>\"},\"name\":\"text - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_GetWatchlist('_wbooks_')\\r\\n| where solution in ({datasource})\\r\\n| project name, solution\",\"size\":0,\"noDataMessage\":\"There are not Workbooks for the selected data sources that cover the selected use cases\",\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"sortBy\":[]},\"name\":\"query - 2 - Copy\"}]},\"customWidth\":\"100\",\"name\":\"Select Data Source\"}],\"isLocked\":false,\"fromTemplateId\":\"sentinel-UserWorkbook\"}",
          "version": "1.0",
          "sourceId": "[variables('workbookSourceId')]",
          "category": "sentinel"
        }
      },
      {
        "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/_anrules_')]",
        "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists",
        "kind": "",
        "properties": {
            "displayName": "_anrules_",
            "source": "csv",
            "description": "_anrules_",
            "provider": "Microsoft",
            "isDeleted": false,
            "labels": [
            ],
            "defaultDuration": "P1000Y",
            "contentType": "Text/Csv",
            "numberOfLinesToSkip": 0,
            "itemsSearchKey": "id",
            "rawContent": "solution,id,name,tactics,techniques\r\n\"1Password\",\"9406f5ab-1197-4db9-8042-9f3345be061c\",\"1Password - Changes to SSO configuration\",\"Persistence\",\"T1556\"\r\n\"1Password\",\"54e6bb8e-2935-422f-9387-dba1961abfd7\",\"1Password - Changes to firewall rules\",\"DefenseEvasion\",\"T1562\"\r\n\"1Password\",\"92ab0938-1e7c-4671-9810-392e8b9714da\",\"1Password - Disable MFA factor or type for all user accounts\",\"DefenseEvasion\",\"T1556\"\r\n\"1Password\",\"bf9132c7-9d4d-4244-98c7-7d994703c208\",\"1Password - Log Ingestion Failure\",\"DefenseEvasion\",\"T1562\"\r\n\"1Password\",\"9a264487-bcb8-4c7f-a461-b289a46377b8\",\"1Password - Manual account creation\",\"Persistence\",\"T1136\"\r\n\"1Password\",\"26daed54-cea5-469c-9b6e-0d85a40dc463\",\"1Password - New service account integration created\",\"Persistence\",\"T1136\"\r\n\"1Password\",\"327e0579-7c03-4ec7-acf5-a29dcc4a12b6\",\"1Password - Non-privileged vault user permission change\",\"Persistence\",\"T1098\"\r\n\"1Password\",\"398a1cf1-f56f-4700-912c-9bf4c8409ebc\",\"1Password - Potential insider privilege escalation via group\",\"PrivilegeEscalation\",\"T1078\"\r\n\"1Password\",\"a00ffbd8-1d1c-47a3-b0a6-7d70bd8017ed\",\"1Password - Potential insider privilege escalation via vault\",\"PrivilegeEscalation\",\"T1078\"\r\n\"1Password\",\"76e386eb-f51a-4600-97d1-f0db3b7e41f1\",\"1Password - Privileged vault permission change\",\"Persistence\",\"T1098\"\r\n\"1Password\",\"6711b747-16d7-4df4-9f61-8633617f45d7\",\"1Password - Secret extraction post vault access change by administrator\",\"CredentialAccess\",\"T1555\"\r\n\"1Password\",\"d54a3cf9-6169-449c-83f1-e7def3359702\",\"1Password - Service account integration token adjustment\",\"DefenseEvasion\",\"T1134\"\r\n\"1Password\",\"ceb20a5c-adce-4eba-9728-541361d47d87\",\"1Password - Successful anomalous sign-in\",\"InitialAccess\",\"T1078\"\r\n\"1Password\",\"3c8140eb-e946-4bf2-8c61-03e4df56d400\",\"1Password - User account MFA settings changed\",\"Persistence DefenseEvasion\",\"T1556\"\r\n\"1Password\",\"849ea271-cd9c-4afe-a13b-ddbbac5fc6d3\",\"1Password - User added to privileged group\",\"Persistence\",\"T1098\"\r\n\"1Password\",\"969e2e5c-9cc6-423c-a3de-514f7ad75fe7\",\"1Password - Vault export post account creation\",\"CredentialAccess Persistence\",\"T1555 T1136\"\r\n\"1Password\",\"dae4c601-51c9-47f5-83d3-e6eaef929cf6\",\"1Password - Vault export\",\"CredentialAccess\",\"T1555\"\r\n\"1Password\",\"51617533-cf51-4415-9020-b15bd47d69d2\",\"1Password - Vault export prior to account suspension or deletion\",\"CredentialAccess\",\"T1555\"\r\n\"42Crunch API Protection\",\"d944d564-b6fa-470d-b5ab-41b341878c5e\",\"API - API Scraping\",\"Reconnaissance Collection\",\r\n\"42Crunch API Protection\",\"25c86f99-0a91-4b7f-88f3-599a008e5ab8\",\"API - Account Takeover\",\"CredentialAccess Discovery\",\"T1110 T1087\"\r\n\"42Crunch API Protection\",\"2c59e609-e0a0-4e8e-adc5-ab4224be8a36\",\"API - Anomaly Detection\",\"DefenseEvasion\",\r\n\"42Crunch API Protection\",\"1b047dc3-a879-4f99-949b-d1dc867efc83\",\"API - BOLA\",\"Exfiltration\",\r\n\"42Crunch API Protection\",\"c6258d51-7b82-4942-8293-94c1dcf91595\",\"API - Rate limiting\",\"Discovery InitialAccess\",\r\n\"42Crunch API Protection\",\"28500be7-cfcf-40e1-bad4-bc524e9283e2\",\"API - Invalid host access\",\"Reconnaissance\",\r\n\"42Crunch API Protection\",\"bbd163f4-1f56-434f-9c23-b06713c119c2\",\"API - JWT validation\",\"CredentialAccess\",\r\n\"42Crunch API Protection\",\"421b38ec-4295-4aed-8299-c92e268ad663\",\"API - Kiterunner detection\",\"Reconnaissance Discovery\",\r\n\"42Crunch API Protection\",\"d951d64d-0ecd-4675-8c79-6c870d5f72ac\",\"API - Password Cracking\",\"CredentialAccess\",\"T1110 T1555 T1187\"\r\n\"42Crunch API Protection\",\"b808063b-07d5-432c-95d0-8900da61cce9\",\"API - Rate limiting\",\"DefenseEvasion\",\r\n\"42Crunch API Protection\",\"7bdc10d6-aa24-4ca9-9a93-802cd8761354\",\"API - Suspicious Login\",\"CredentialAccess InitialAccess\",\r\n\"AIShield AI Security Monitoring\",\"76c9e83d-c6f9-4270-ad21-761410f9cc6c\",\"AIShield - Image classification AI Model Evasion high suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"c4bedb3c-4fb8-4b1c-af5b-8229bd25f521\",\"AIShield - Image classification AI Model Evasion low suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"b4cc5396-2a34-45f5-a726-860e476edf15\",\"AIShield - Image classification AI Model extraction high suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"1ed02dcc-0bc9-465e-94b4-bd8969221602\",\"AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"4ec55816-e07b-45fc-b89e-917c93906540\",\"AIShield - Natural language processing AI model extraction high suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"669680fb-91e5-4cbd-9eb6-e5352e0f8af0\",\"AIShield - Tabular classification AI Model Evasion high suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"af245eff-0db9-4df8-82e6-998185cac332\",\"AIShield - Tabular classification AI Model Evasion low suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"8d03e3ff-18eb-497c-a6cb-1c35ccdb0ed3\",\"AIShield - Tabular classification AI Model extraction high suspicious vulnerability detection\",,\r\n\"AIShield AI Security Monitoring\",\"37118ef6-73b4-49aa-b13b-cdeeeea580df\",\"AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection\",,\r\n\"ARGOSCloudSecurity\",\"a9bf1b8c-c761-4840-b9a8-7535ca68ca28\",\"ARGOS Cloud Security - Exploitable Cloud Resources\",\"InitialAccess\",\r\n\"Alsid For AD\",\"9649e203-3cb7-47ff-89a9-42f2a5eefe31\",\"Alsid Active Directory attacks pathways\",\"CredentialAccess\",\"T1110\"\r\n\"Alsid For AD\",\"25e0b2dd-3ad3-4d5b-80dd-720f4ef0f12c\",\"Alsid DCShadow\",\"DefenseEvasion\",\"T1207\"\r\n\"Alsid For AD\",\"d3c658bd-8da9-4372-82e4-aaffa922f428\",\"Alsid DCSync\",\"CredentialAccess\",\"T1003.006\"\r\n\"Alsid For AD\",\"21ab3f52-6d79-47e3-97f8-ad65f2cb29fb\",\"Alsid Golden Ticket\",\"CredentialAccess\",\"T1558.001\"\r\n\"Alsid For AD\",\"3caa67ef-8ed3-4ab5-baf2-3850d3667f3d\",\"Alsid Indicators of Attack\",\"CredentialAccess\",\"T1110\"\r\n\"Alsid For AD\",\"154fde9f-ae00-4422-a8da-ef00b11da3fc\",\"Alsid Indicators of Exposures\",\"CredentialAccess\",\"T1110\"\r\n\"Alsid For AD\",\"3acf5617-7c41-4085-9a79-cc3a425ba83a\",\"Alsid LSASS Memory\",\"CredentialAccess\",\"T1003.001\"\r\n\"Alsid For AD\",\"ba239935-42c2-472d-80ba-689186099ea1\",\"Alsid Password Guessing\",\"CredentialAccess\",\"T1110\"\r\n\"Alsid For AD\",\"472b7cf4-bf1a-4061-b9ab-9fe4894e3c17\",\"Alsid Password issues\",\"CredentialAccess\",\"T1110\"\r\n\"Alsid For AD\",\"9e20eb4e-cc0d-4349-a99d-cad756859dfb\",\"Alsid Password Spraying\",\"CredentialAccess\",\"T1110.003\"\r\n\"Alsid For AD\",\"a5fe9489-cf8b-47ae-a87e-8f3a13e4203e\",\"Alsid privileged accounts issues\",\"CredentialAccess\",\"T1110\"\r\n\"Alsid For AD\",\"fb9e0b51-8867-48d7-86f4-6e76f2176bf8\",\"Alsid user accounts issues\",\"CredentialAccess\",\"T1110\"\r\n\"Amazon Web Services\",\"0adab960-5565-4978-ba6d-044553e4acc4\",\"Successful API executed from a Tor exit node\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"8c2ef238-67a0-497d-b1dd-5c8a0f533e25\",\"Changes to internet facing AWS RDS Database instances\",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"65360bb0-8986-4ade-a89d-af3cf44d28aa\",\"Changes to Amazon VPC settings\",\"PrivilegeEscalation LateralMovement\",\"T1078 T1563\"\r\n\"Amazon Web Services\",\"610d3850-c26f-4f20-8d86-f10fdf2425f5\",\"Changes made to AWS CloudTrail logs\",\"DefenseEvasion\",\r\n\"Amazon Web Services\",\"093fe75e-44f1-4d3e-94dc-6d258a6dd2d2\",\"AWS Config Service Resource Deletion Attempts\",\"DefenseEvasion\",\"T1562 T1562.001\"\r\n\"Amazon Web Services\",\"d25b1998-a592-4bc5-8a3a-92b39eedb1bc\",\"Login to AWS Management Console without MFA\",\"DefenseEvasion PrivilegeEscalation Persistence InitialAccess\",\"T1078\"\r\n\"Amazon Web Services\",\"6f675c17-7a61-440c-abd1-c73ef4d748ec\",\"Creation of CRUD DynamoDB policy and then privilege escalation.\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"8a607285-d95c-473d-8aab-59920de63af6\",\"Creation of new CRUD IAM policy and then privilege escalation.\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"8e15998e-1e32-4b6d-abd1-e8482e8f3def\",\"Creation of CRUD KMS policy and then privilege escalation\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"467cbe7e-e6d4-4f4e-8e44-84dd01932c32\",\"Created CRUD S3 policy and then privilege escalation\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"22115d3c-e87c-485a-9130-33797d619124\",\"Creation of CRUD Lambda policy and then privilege escalation\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"efdc3cff-f006-426f-97fd-4657862f7b9a\",\"CloudFormation policy created then used for privilege escalation\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"6009c632-94e9-4ffb-a11a-b4b99f457f88\",\"Creation of DataPipeline policy and then privilege escalation.\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"a694e977-740c-4578-9f8f-5e39029f1d23\",\"Creation of EC2 policy and then privilege escalation\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"aaa2c05e-fdd4-4fa0-9072-6cffe3641b34\",\"Creation of SSM policy and then privilege escalation\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"454133a7-5427-4a7c-bdc4-0adfa84dda16\",\"Creating keys with encrypt policy without MFA\",\"Impact\",\"T1485\"\r\n\"Amazon Web Services\",\"32555639-b639-4c2b-afda-c0ae0abefa55\",\"Monitor AWS Credential abuse or hijacking\",\"Discovery\",\"T1087\"\r\n\"Amazon Web Services\",\"f6928301-56da-4d2c-aabe-e1a552bc8892\",\"ECR image scan findings high or critical\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"19602494-94af-43c8-90ba-eb0e14999612\",\"Automatic image scanning disabled for ECR\",\"DefenseEvasion\",\"T1562\"\r\n\"Amazon Web Services\",\"826bb2f8-7894-4785-9a6b-a8a855d8366f\",\"Full Admin policy created and then attached to Roles Users or Groups\",\"PrivilegeEscalation\",\r\n\"Amazon Web Services\",\"9da99021-d318-4711-a78a-6dea76129b3a\",\"GuardDuty detector disabled or suspended\",\"DefenseEvasion\",\"T1562\"\r\n\"Amazon Web Services\",\"4f19d4e3-ec5f-4abc-9e61-819eb131758c\",\"Changes to AWS Security Group ingress and egress settings\",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"c7bfadd4-34a6-4fa5-82f8-3691a32261e8\",\"Changes to AWS Elastic Load Balancer security groups\",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"633a91df-d031-4b6e-a413-607a61540559\",\"Changes made to AWS CloudTrail logs\",\"DefenseEvasion\",\r\n\"Amazon Web Services\",\"f8ea7d50-e33b-4b9d-9c3e-a59fcbcee281\",\"Network ACL with all the open ports to a specified CIDR\",\"DefenseEvasion\",\"T1562\"\r\n\"Amazon Web Services\",\"60dfc193-0f73-4279-b43c-110ade02b201\",\"Suspicious overly permissive KMS key policy created\",\"Impact\",\"T1486\"\r\n\"Amazon Web Services\",\"49ce5322-60d7-4b02-ad79-99f650aa5790\",\"Privilege escalation with admin managed policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"139e7116-3884-4246-9978-c8f740770bdf\",\"Privilege escalation with AdministratorAccess managed policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"afb4191b-a142-4065-a0da-f721ee3d006c\",\"Privilege escalation with FullAccess managed policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"e20d35a3-4fec-4c8b-81b1-fc33b41990b0\",\"Privilege escalation via CRUD IAM policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"d7c39e15-997f-49e5-a782-73bf07db8aa5\",\"Privilege escalation via CRUD KMS policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"d0953d50-3dc1-4fa3-80fa-4d3e973a0959\",\"Privilege escalation via CRUD Lambda policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"fc3061bb-319c-4fe9-abe2-f59899a6d907\",\"Privilege escalation via CRUD S3 policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"719d5204-10ab-4b1f-aee1-da7326750260\",\"Privilege escalation via CloudFormation policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"48896551-1c28-4a09-8388-e51e5a927d23\",\"Privilege escalation via DataPipeline policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"a2b2a984-c820-4d93-830e-139bffd81fa3\",\"Privilege escalation via EC2 policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"370f0e5e-da1d-4a14-8ced-d1d7ab66a8d7\",\"Privilege escalation via Glue policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"8e01c41d-bd4c-4bbe-aed5-18592735052d\",\"Privilege escalation via Lambda policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"c668c09f-5a49-43f9-b249-6b89a31ec8fb\",\"Privilege escalation via SSM policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"b9be2aa6-911d-4131-8658-d2a537ed49f4\",\"Privilege escalation via CRUD DynamoDB policy\",\"PrivilegeEscalation\",\"T1484\"\r\n\"Amazon Web Services\",\"8f1630c2-2e45-4df2-be43-50fba90f601d\",\"RDS instance publicly exposed\",\"Exfiltration\",\"T1537\"\r\n\"Amazon Web Services\",\"31b9e94b-0df6-4a3d-a297-3457b53c5d86\",\"Successful brute force attack on S3 Bucket.\",\"DefenseEvasion\",\"T1562\"\r\n\"Amazon Web Services\",\"b7a44e0d-ae4c-4fb2-be1b-aa0e45f2327b\",\"S3 bucket access point publicly exposed\",\"Exfiltration\",\"T1537\"\r\n\"Amazon Web Services\",\"6b9b4ee6-f4c1-4b86-8c8c-beb0bb59ae44\",\"S3 bucket exposed via ACL\",\"Exfiltration\",\"T1537\"\r\n\"Amazon Web Services\",\"44a5b65e-b0a9-4591-aabc-388fd92a28c4\",\"S3 bucket exposed via policy\",\"Exfiltration\",\"T1537\"\r\n\"Amazon Web Services\",\"09f2a28b-3286-4268-9e2f-33805f104e5d\",\"S3 object publicly exposed\",\"Exfiltration\",\"T1537\"\r\n\"Amazon Web Services\",\"b442b9e2-5cc4-4129-a85b-a5ef38a9e5f0\",\"S3 bucket suspicious ransomware activity\",\"Impact\",\"T1486\"\r\n\"Amazon Web Services\",\"bce1dcba-4948-414d-8838-6385afb9d496\",\"SAML update identity provider\",\"Persistence\",\"T1078\"\r\n\"Amazon Web Services\",\"75647b58-bcc8-4eb5-9658-46698d3fa153\",\"SSM document is publicly exposed\",\"Discovery\",\"T1526\"\r\n\"Amazon Web Services\",\"874a1762-3fd7-4489-b411-6d4a9e9e8a59\",\"Policy version set to default\",\"InitialAccess\",\"T1078\"\r\n\"Amazon Web Services\",\"21702832-aff3-4bd6-a8e1-663b6818503d\",\"Suspicious command sent to EC2\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"0ee2aafb-4500-4e36-bcb1-e90eec2f0b9b\",\"NRT Login to AWS Management Console without MFA\",\"DefenseEvasion PrivilegeEscalation Persistence InitialAccess\",\"T1078\"\r\n\"Amazon Web Services\",\"8c2dc344-9352-4ca1-8863-b1b7a5e09e59\",\"Suspicious AWS CLI Command Execution\",\"Reconnaissance\",\"T1595 T1592.004 T1589.002 T1589.003 T1590 T1591 T1596\"\r\n\"Amazon Web Services\",\"9e457dc4-81f0-4d25-bc37-a5fa4a17946a\",\"Suspicious AWS EC2 Compute Resource Deployments\",\"Impact\",\"T1496\"\r\n\"Apache Log4j Vulnerability Detection\",\"2de8abd6-a613-450e-95ed-08e503369fb3\",\"Azure WAF matching for Log4j vuln(CVE-2021-44228)\",\"InitialAccess\",\"T1190\"\r\n\"Apache Log4j Vulnerability Detection\",\"6e575295-a7e6-464c-8192-3e1d8fd6a990\",\"Log4j vulnerability exploit aka Log4Shell IP IOC\",\"CommandAndControl\",\r\n\"Apache Log4j Vulnerability Detection\",\"3d71fc38-f249-454e-8479-0a358382ef9a\",\"Vulnerable Machines related to log4j CVE-2021-44228\",\"InitialAccess Execution\",\"T1190 T1203\"\r\n\"Apache Log4j Vulnerability Detection\",\"29283b22-a1c0-4d16-b0a9-3460b655a46a\",\"User agent search for log4j exploitation attempt\",\"InitialAccess\",\"T1190\"\r\n\"ApacheHTTPServer\",\"767f9dc4-3b01-11ec-8d3d-0242ac130003\",\"Apache - Apache 2.4.49 flaw CVE-2021-41773\",\"InitialAccess LateralMovement\",\"T1190 T1133 T1210\"\r\n\"ApacheHTTPServer\",\"54da6a42-3b00-11ec-8d3d-0242ac130003\",\"Apache - Command in URI\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"e9edfe1c-3afd-11ec-8d3d-0242ac130003\",\"Apache - Known malicious user agent\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"15f5a956-3af9-11ec-8d3d-0242ac130003\",\"Apache - Multiple client errors from single IP\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"1bf246a2-3af9-11ec-8d3d-0242ac130003\",\"Apache - Multiple server errors from single IP\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"ApacheHTTPServer\",\"db5f16f0-3afe-11ec-8d3d-0242ac130003\",\"Apache - Private IP in URL\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"c5d69e46-3b00-11ec-8d3d-0242ac130003\",\"Apache - Put suspicious file\",\"InitialAccess Exfiltration\",\"T1190 T1133 T1048\"\r\n\"ApacheHTTPServer\",\"a0077556-3aff-11ec-8d3d-0242ac130003\",\"Apache - Request from private IP\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"ApacheHTTPServer\",\"14d7e15e-3afb-11ec-8d3d-0242ac130003\",\"Apache - Requests to rare files\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"d1c52578-3afc-11ec-8d3d-0242ac130003\",\"Apache - Request to sensitive files\",\"InitialAccess\",\"T1189\"\r\n\"AristaAwakeSecurity\",\"90b7ac11-dd6c-4ba1-a99b-737061873859\",\"Awake Security - High Match Counts By Device\",,\r\n\"AristaAwakeSecurity\",\"d5e012c2-29ba-4a02-a813-37b928aafe2d\",\"Awake Security - High Severity Matches By Device\",,\r\n\"AristaAwakeSecurity\",\"dfa3ec92-bdae-410f-b675-fe1814e4d43e\",\"Awake Security - Model With Multiple Destinations\",,\r\n\"Armorblox\",\"322d4765-be6b-4868-9e3f-138a4f339dd6\",\"Armorblox Needs Review Alert\",,\r\n\"AtlassianJiraAudit\",\"5b0cec45-4a91-4f08-bb1b-392427e8f440\",\"Jira - Global permission added\",\"PrivilegeEscalation\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"5b0cec45-4a91-4f08-bb1b-392427e8f440\",\"Jira - Global permission added\",\"PrivilegeEscalation\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"b894593a-2b4c-4573-bc47-78715224a6f5\",\"Jira - New site admin user\",\"Persistence PrivilegeEscalation\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"8c90f30f-c612-407c-91a0-c6a6b41ac199\",\"Jira - New user created\",\"Persistence\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"72592618-fa57-45e1-9f01-ca8706a5e3f5\",\"Jira - Permission scheme updated\",\"Impact\",\"T1531\"\r\n\"AtlassianJiraAudit\",\"6bf42891-b54d-4b4e-8533-babc5b3ea4c5\",\"Jira - New site admin user\",\"InitialAccess\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"fb6a8001-fe87-4177-a8f3-df2302215c4f\",\"Jira - Project roles changed\",\"Impact\",\"T1531\"\r\n\"AtlassianJiraAudit\",\"943176e8-b979-45c0-8ad3-58ba6cfd41f0\",\"Jira - User's password changed multiple times\",\"Persistence\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"c13ecb19-4317-4d87-9a1c-52660dd44a7d\",\"Jira - User removed from group\",\"Impact\",\"T1531\"\r\n\"AtlassianJiraAudit\",\"5d3af0aa-833e-48ed-a29a-8cfd2705c953\",\"Jira - User removed from project\",\"Impact\",\"T1531\"\r\n\"AtlassianJiraAudit\",\"398aa0ca-45a2-4f79-bc21-ee583bbb63bc\",\"Jira - Workflow scheme copied\",\"Collection\",\"T1213\"\r\n\"Attacker Tools Threat Protection Essentials\",\"c63ae777-d5e0-4113-8c9a-c2c9d3d09fcd\",\"Probable AdFind Recon Tool Usage\",\"Discovery\",\"T1016 T1018 T1069.002 T1087.002 T1482\"\r\n\"Attacker Tools Threat Protection Essentials\",\"4ebbb5c2-8802-11ec-a8a3-0242ac120002\",\"Credential Dumping Tools - Service Installation\",\"CredentialAccess\",\"T1003.001\"\r\n\"Attacker Tools Threat Protection Essentials\",\"32ffb19e-8ed8-40ed-87a0-1adb4746b7c4\",\"Credential Dumping Tools - File Artifacts\",\"CredentialAccess\",\"T1003.001\"\r\n\"Attacker Tools Threat Protection Essentials\",\"ef88eb96-861c-43a0-ab16-f3835a97c928\",\"Powershell Empire Cmdlets Executed in Command Line\",\"Collection CommandAndControl CredentialAccess DefenseEvasion Discovery Execution Exfiltration LateralMovement Persistence PrivilegeEscalation\",\"T1548.002 T1134 T1134.002 T1134.005 T1087.001 T1087.002 T1557.001 T1071.001 T1560 T1547.001 T1547.005 T1547.009 T1217 T1115 T1059 T1059.001 T1059.003 T1136.001 T1136.002 T1543.003 T1555.003 T1484.001 T1482 T1114.001 T1573.002 T1546.008 T1041 T1567.001 T1567.002 T1068 T1210 T1083 T1615 T1574.001 T1574.004 T1574.007 T1574.008 T1574.009 T1070.006 T1105 T1056.001 T1056.004 T1106 T1046 T1135 T1040 T1027 T1003.001 T1057 T1055 T1021.003 T1021.004 T1053.005 T1113 T1518.001 T1558.002 T1558.003 T1082 T1016 T1049 T1569.002 T1127.001 T1552.001 T1552.004 T1550.002 T1125 T1102.002 T1047\"\r\n\"Authomize\",\"734c00a0-a95b-44dd-9b69-d926ed44256d\",\"AWS role with admin privileges\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"2526079b-3355-4756-a2d1-21e9cd957261\",\"AWS role with shadow admin privileges\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"48a9478b-440a-4330-b42c-94bd84dc904c\",\"Access to AWS without MFA\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"87419138-d75f-450d-aca4-1dc802e32540\",\"Admin SaaS account detected\",\"InitialAccess PrivilegeEscalation\",\"T1078 T1078\"\r\n\"Authomize\",\"63d87fcb-d197-48d2-a642-de4813f0219a\",\"Admin password not updated in 30 days\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"25bef734-4399-4c55-9579-4ebabd9cccf6\",\"Lateral Movement Risk - Role Chain Length\",\"PrivilegeEscalation\",\r\n\"Authomize\",\"077eb06a-c011-47f7-8d92-dfc2b1e1d71b\",\"Detect AWS IAM Users\",\"PrivilegeEscalation\",\"T1078\"  \r\n\"Authomize\",\"c4d442a8-8227-4735-ac13-d84704e1b371\",\"Empty group with entitlements\",\"PrivilegeEscalation\",\r\n\"Authomize\",\"dc728ba1-5204-4fde-ab48-eda19c8fad3a\",\"IaaS admin detected\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"57bae0c4-50b7-4552-9de9-19dfecddbace\",\"IaaS policy not attached to any identity\",\"PrivilegeEscalation\",\r\n\"Authomize\",\"31f43e9d-1839-4baf-a668-54c28b98af3e\",\"IaaS shadow admin detected\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"d7ee7bb5-d712-4d44-b201-b13379924934\",\"New direct access policy was granted against organizational policy\",\"InitialAccess PrivilegeEscalation\",\"T1078 T1078\"\r\n\"Authomize\",\"6c17f270-cd56-48cc-9196-1728ffea6538\",\"New service account gained access to IaaS resource\",\"InitialAccess\",\r\n\"Authomize\",\"2e3c4ad5-8cb3-4b46-88ff-a88367ee7eaa\",\"Password Exfiltration over SCIM application\",\"CredentialAccess InitialAccess\",\"T1555 T1040 T1552\"\r\n\"Authomize\",\"72891de4-da70-44e4-9984-35fcea98d000\",\"Privileged Machines Exposed to the Internet\",\"Discovery Impact\",\"T1580\"\r\n\"Authomize\",\"642de064-c67b-4eb7-98bd-3f8cd51f282c\",\"Refactor AWS policy based on activities in the last 60 days\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Authomize\",\"766a3b1b-0d5b-4a8d-b0d6-7dd379e73567\",\"Stale AWS policy attachment to identity\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"ccdf3f87-7890-4549-9d0f-8f43c1d2751d\",\"Stale IAAS policy attachment to role\",\"PrivilegeEscalation\",\r\n\"Authomize\",\"e0ae5f9e-865b-41f5-98bb-c04113888e85\",\"Unused IaaS Policy\",\"InitialAccess PrivilegeEscalation\",\"T1078 T1068 T1078\"\r\n\"Authomize\",\"c04ed74c-3b23-48cd-9c11-fd10cffddc64\",\"User assigned to a default admin role\",\"InitialAccess\",\"T1078\"\r\n\"Authomize\",\"71a7b0de-f13d-44b9-9caa-668f1bad0ce6\",\"User without MFA\",\"InitialAccess\",\"T1078\"\r\n\"Azure Activity\",\"88f453ff-7b9e-45bb-8c12-4058ca5e44ee\",\"Microsoft Entra ID Hybrid Health AD FS New Server\",\"DefenseEvasion\",\"T1578\"\r\n\"Azure Activity\",\"88f453ff-7b9e-45bb-8c12-4058ca5e44ee\",\"Microsoft Entra ID Hybrid Health AD FS New Server\",\"DefenseEvasion\",\"T1578\"\r\n\"Azure Activity\",\"86a036b2-3686-42eb-b417-909fc0867771\",\"Microsoft Entra ID Hybrid Health AD FS Service Delete\",\"DefenseEvasion\",\"T1578.003\"\r\n\"Azure Activity\",\"d9938c3b-16f9-444d-bc22-ea9a9110e0fd\",\"Microsoft Entra ID Hybrid Health AD FS Suspicious Application\",\"CredentialAccess DefenseEvasion\",\"T1528 T1550\"\r\n\"Azure Activity\",\"361dd1e3-1c11-491e-82a3-bb2e44ac36ba\",\"Suspicious number of resource creation or deployment activities\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"9736e5f1-7b6e-4bfb-a708-e53ff1d182c3\",\"Creation of expensive computes in Azure\",\"DefenseEvasion\",\"T1578\"\r\n\"Azure Activity\",\"b2c15736-b9eb-4dae-8b02-3016b6a45a32\",\"Suspicious granting of permissions to an account\",\"Persistence PrivilegeEscalation\",\"T1098 T1548\"\r\n\"Azure Activity\",\"ec491363-5fe7-4eff-b68e-f42dcb76fcf6\",\"NRT Microsoft Entra ID Hybrid Health AD FS New Server\",\"DefenseEvasion\",\"T1578\"\r\n\"Azure Activity\",\"56fe0db0-6779-46fa-b3c5-006082a53064\",\"NRT Creation of expensive computes in Azure\",\"DefenseEvasion\",\"T1578\"\r\n\"Azure Activity\",\"6d7214d9-4a28-44df-aafb-0910b9e6ae3e\",\"New CloudShell User\",\"Execution\",\"T1059\"\r\n\"Azure Activity\",\"9fb57e58-3ed8-4b89-afcf-c8e786508b1c\",\"Suspicious Resource deployment\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"23de46ea-c425-4a77-b456-511ae4855d69\",\"Rare subscription-level operations in Azure\",\"CredentialAccess Persistence\",\"T1003 T1098\"\r\n\"Azure Activity\",\"48c026d8-7f36-4a95-9568-6f1420d66e37kind Scheduled\",\"Subscription moved to another tenant\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"ed43bdb7-eaab-4ea4-be52-6951fcfa7e3b\",\"Mass Cloud resource deletions Time Series Anomaly\",\"Impact\",\"T1485\"\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"f0be259a-34ac-4946-aa15-ca2b115d5feb\",\"Palo Alto - potential beaconing detected\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"5b72f527-e3f6-4a00-9908-8e4fee14da9f\",\"CloudNGFW By Palo Alto Networks - possible internal to external port scanning\",\"Discovery\",\"T1046\"\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"89a86f70-615f-4a79-9621-6f68c50f365f\",\"CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses\",\"Discovery Exfiltration CommandAndControl\",\"T1046 T1030 T1071.001\"\r\n\"Azure DDoS Protection\",\"6e76fd9d-8104-41eb-bad3-26054a3ad5f0kind Scheduled\",\"DDoS Attack IP Addresses - PPS Threshold\",\"Impact\",\"T1498\"\r\n\"Azure DDoS Protection\",\"402a42ad-f31c-48d1-8f80-0200846b7f25kind Scheduled\",\"DDoS Attack IP Addresses - Percent Threshold\",\"Impact\",\"T1498\"\r\n\"Azure Firewall\",\"d36bb1e3-5abc-4037-ad9a-24ba3469819e\",\"Abnormal Deny Rate for Source IP\",\"InitialAccess Exfiltration CommandAndControl\",\r\n\"Azure Firewall\",\"826f930c-2f25-4508-8e75-a95b809a4e15\",\"Abnormal Port to Protocol\",\"DefenseEvasion Exfiltration CommandAndControl\",\r\n\"Azure Firewall\",\"4644baf7-3464-45dd-bd9d-e07687e25f81\",\"Multiple Sources Affected by the Same TI Destination\",\"Exfiltration CommandAndControl\",\r\n\"Azure Firewall\",\"b2c5907b-1040-4692-9802-9946031017e8\",\"Port Scan\",\"Discovery\",\"T1046\"\r\n\"Azure Firewall\",\"720335f4-ee8c-4270-9424-d0859222168c\",\"Port Sweep\",\"Discovery\",\"T1046\"\r\n\"Azure Firewall\",\"f8dad4e9-3f19-4d70-ab7f-8f19ccd43a3e\",\"Several deny actions registered\",\"Discovery LateralMovement CommandAndControl\",\"T1046 T1071 T1210\"\r\n\"Azure Key Vault\",\"d6491be0-ab2d-439d-95d6-ad8ea39277c5\",\"Sensitive Azure Key Vault operations\",\"Impact\",\"T1485\"\r\n\"Azure Key Vault\",\"24f8c234-d1ff-40ec-8b73-96b17a3a9c1c\",\"Mass secret retrieval from Azure Key Vault\",\"CredentialAccess\",\"T1003\"\r\n\"Azure Key Vault\",\"884ead54-cb3f-4676-a1eb-b26532d6cbfd\",\"NRT Sensitive Azure Key Vault operations\",\"Impact\",\"T1485\"\r\n\"Azure Key Vault\",\"0914adab-90b5-47a3-a79f-7cdcac843aa7\",\"Azure Key Vault access TimeSeries anomaly\",\"CredentialAccess\",\"T1003\"\r\n\"Azure SQL Database solution for sentinel\",\"daa32afa-b5b6-427d-93e9-e32f3f359dd7\",\"Credential errors stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"20f87813-3de0-4a9f-a8c0-6aaa3187be08\",\"Firewall errors stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"c815008d-f4d1-4645-b13b-8b4bc188d5de\",\"Syntax errors stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"237c3855-138c-4588-a68f-b870abd3bfc9\",\"Drop attempts stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"3367fd5e-44b3-4746-a9a5-dc15c8202490\",\"Execution attempts stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"05030ca6-ef66-42ca-b672-2e84d4aaf5d7\",\"Firewall rule manipulation attempts stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"dabd7284-004b-4237-b5ee-a22acab19eb2\",\"OLE object manipulation attempts stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"c105513d-e398-4a02-bd91-54b9b2d6fa7d\",\"Outgoing connection attempts stateful anomaly on database\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"2a632013-379d-4993-956f-615063d31e10\",\"Affected rows stateful anomaly on database\",\"Impact\",\"T1485  T1565  T1491\"\r\n\"Azure SQL Database solution for sentinel\",\"9851c360-5fd5-4bae-a117-b66d8476bf5e\",\"Response rows stateful anomaly on database\",\"Exfiltration\",\"T1537  T1567\"\r\n\"Azure Web Application Firewall (WAF)\",\"16da3a2a-af29-48a0-8606-d467c180fe18\",\"Front Door Premium WAF - SQLi Detection\",\"DefenseEvasion Execution InitialAccess PrivilegeEscalation\",\"T1211 T1059 T1190 T0890\"\r\n\"Azure Web Application Firewall (WAF)\",\"16da3a2a-af29-48a0-8606-d467c180fe18\",\"Front Door Premium WAF - SQLi Detection\",\"DefenseEvasion Execution InitialAccess PrivilegeEscalation\",\"T1211 T1059 T1190 T0890\"\r\n\"Azure Web Application Firewall (WAF)\",\"b7643904-5081-4920-917e-a559ddc3448f\",\"Front Door Premium WAF - XSS Detection\",\"InitialAccess Execution\",\"T1189 T1203 T0853\"\r\n\"Azure Web Application Firewall (WAF)\",\"ded8168e-c806-4772-af30-10576e0a7529\",\"AFD WAF - Code Injection\",\"DefenseEvasion Execution InitialAccess PrivilegeEscalation\",\"T1548  T1203  T1190 T1548\"\r\n\"Azure Web Application Firewall (WAF)\",\"a4d99328-e4e6-493d-b0d5-57e6f9ddae77\",\"AFD WAF - Path Traversal Attack\",\"DefenseEvasion Execution InitialAccess PrivilegeEscalation Discovery\",\"T1548 T1203 T1190 T1548 T1087\"\r\n\"Azure Web Application Firewall (WAF)\",\"912a18fc-6165-446b-8740-81ae6c3f75ee\",\"App GW WAF - Code Injection\",\"DefenseEvasion  Execution  InitialAccess  PrivilegeEscalation\",\"T1548  T1203 T1190 T1548\"\r\n\"Azure Web Application Firewall (WAF)\",\"b6c3a8a6-d22c-4882-9c57-abc01690938b\",\"App GW WAF - Path Traversal Attack\",\"DefenseEvasion Execution  InitialAccess  PrivilegeEscalation  Discovery\",\"T1548  T1203 T1190  T1548  T1087\"\r\n\"Azure Web Application Firewall (WAF)\",\"bdb2cd63-99f2-472e-b1b9-acba473b6744\",\"App Gateway WAF - SQLi Detection\",\"DefenseEvasion Execution InitialAccess PrivilegeEscalation\",\"T1211 T1059 T1190 T0890\"\r\n\"Azure Web Application Firewall (WAF)\",\"9b8dd8fd-f192-42eb-84f6-541920400a7a\",\"App Gateway WAF - Scanner Detection\",\"DefenseEvasion  Execution  InitialAccess Reconnaissance Discovery\",\"T1548 T1203  T1190  T1595  T1046\"\r\n\"Azure Web Application Firewall (WAF)\",\"1c7ff502-2ad4-4970-9d29-9210c6753138\",\"App Gateway WAF - XSS Detection\",\"InitialAccess Execution\",\"T1189 T1203 T0853\"\r\n\"Azure Web Application Firewall (WAF)\",\"46ac55ae-47b8-414a-8f94-89ccd1962178\",\"A potentially malicious web request was executed against a web server\",\"InitialAccess\",\"T1190\"\r\n\"AzureDevOpsAuditing\",\"acfdee3f-b794-404a-aeba-ef6a1fa08ad1\",\"Azure DevOps Agent Pool Created Then Deleted\",\"DefenseEvasion\",\"T1578.002\"\r\n\"AzureDevOpsAuditing\",\"4e8238bd-ff4f-4126-a9f6-09b3b6801b3d\",\"Azure DevOps Audit Stream Disabled\",\"DefenseEvasion\",\"T1562.008\"\r\n\"AzureDevOpsAuditing\",\"bc71cf84-c02c-4c0a-a64c-306d84f9ff89\",\"Azure DevOps Audit Detection for known malicious tooling\",\"Collection\",\"T1119\"\r\n\"AzureDevOpsAuditing\",\"bf07ca9c-e408-443a-8939-6860a45a929e\",\"Azure DevOps New Extension Added\",\"Persistence\",\"T1505\"\r\n\"AzureDevOpsAuditing\",\"5f0d80db-3415-4265-9d52-8466b7372e3a\",\"Azure DevOps PAT used with Browser\",\"CredentialAccess\",\r\n\"AzureDevOpsAuditing\",\"155e9134-d5ad-4a6f-88f3-99c220040b66\",\"Azure DevOps Pipeline modified by a new user\",\"Execution  DefenseEvasion\",\"T1578 T1569\"\r\n\"AzureDevOpsAuditing\",\"71d374e0-1cf8-4e50-aecd-ab6c519795c2\",\"Azure DevOps Retention Reduced\",\"DefenseEvasion\",\"T1564\"\r\n\"AzureDevOpsAuditing\",\"4ca74dc0-8352-4ac5-893c-73571cc78331\",\"Azure DevOps Variable Secret Not Secured\",\"CredentialAccess\",\"T1552\"\r\n\"AzureDevOpsAuditing\",\"3b9a44d7-c651-45ed-816c-eae583a6f2f1\",\"Azure DevOps Build Variable Modified by New User\",\"DefenseEvasion\",\"T1578\"\r\n\"AzureDevOpsAuditing\",\"89e6adbd-612c-4fbe-bc3d-32f81baf3b6c\",\"Azure DevOps Administrator Group Monitoring\",\"Persistence\",\"T1098\"\r\n\"AzureDevOpsAuditing\",\"4d8de9e6-263e-4845-8618-cd23a4f58b70\",\"Azure DevOps Pull Request Policy Bypassing - Historic allow list\",\"Persistence\",\"T1098\"\r\n\"AzureDevOpsAuditing\",\"5efb0cfd-063d-417a-803b-562eae5b0301\",\"Azure DevOps Service Connection Addition/Abuse - Historic allow list\",\"Persistence Impact\",\"T1098 T1496\"\r\n\"AzureDevOpsAuditing\",\"ac891683-53c3-4f86-86b4-c361708e2b2b\",\"Azure DevOps Personal Access Token (PAT) misuse\",\"Execution Impact\",\"T1496 T1559\"\r\n\"AzureDevOpsAuditing\",\"17f23fbe-bb73-4324-8ecf-a18545a5dc26\",\"Azure DevOps Pipeline Created and Deleted on the Same Day\",\"Execution\",\"T1072\"\r\n\"AzureDevOpsAuditing\",\"d564ff12-8f53-41b8-8649-44f76b37b99f\",\"Azure DevOps Service Connection Abuse\",\"Persistence Impact\",\"T1098 T1496\"\r\n\"AzureDevOpsAuditing\",\"adc32a33-1cd6-46f5-8801-e3ed8337885f\",\"External Upstream Source Added to Azure DevOps Feed\",\"InitialAccess\",\"T1199\"\r\n\"AzureDevOpsAuditing\",\"74ed028d-e392-40b7-baef-e69627bf89d1\",\"NRT Azure DevOps Audit Stream Disabled\",\"DefenseEvasion\",\"T1562.008\"\r\n\"AzureDevOpsAuditing\",\"4ce177b3-56b1-4f0e-b83e-27eed4cb0b16\",\"New Agent Added to Pool by New User or Added to a New OS Type\",\"Execution\",\"T1053\"\r\n\"AzureDevOpsAuditing\",\"35ce9aff-1708-45b8-a295-5e9a307f5f17\",\"New PA PCA or PCAS added to Azure DevOps\",\"InitialAccess\",\"T1078.004\"\r\n\"AzureSecurityBenchmark\",\"0610e72f-ceaf-42d1-879e-952a1bd8d07a\",\"Azure Security Benchmark Posture Changed\",\"Discovery\",\"T1082\"\r\n\"BitSight\",\"d68b758a-b117-4cb8-8e1d-dcab5a4a2f21\",\"BitSight - compromised systems detected\",\"Execution\",\r\n\"BitSight\",\"161ed3ac-b242-4b13-8c6b-58716e5e9972\",\"BitSight - diligence risk category detected\",\"Execution\",\r\n\"BitSight\",\"d8844f11-3a36-4b97-9062-1e6d57c00e37\",\"BitSight - drop in company ratings\",\"CommandAndControl\",\r\n\"BitSight\",\"b11fdc35-6368-4cc0-8128-52cd2e2cdda0\",\"BitSight - drop in the headline rating\",\"CommandAndControl\",\r\n\"BitSight\",\"a1275c5e-0ff4-4d15-a7b7-96018cd979f5\",\"BitSight - new alert found\",\"Impact\",\r\n\"BitSight\",\"a5526ba9-5997-47c6-bf2e-60a08b681e9b\",\"BitSight - new breach found\",\"Impact\",\r\n\"Bitglass\",\"09690f9b-33d1-4372-a6aa-eb7d3b3cdebc\",\"Bitglass - Multiple files shared with external entity\",\"Exfiltration\",\"T1567\"\r\n\"Bitglass\",\"cdb6e4a4-b9bd-4c30-94b9-ecce5a72d528\",\"Bitglass - Impossible travel distance\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"7c570bfc-9f20-490e-80e8-b898c7ce4bda\",\"Bitglass - Multiple failed logins\",\"CredentialAccess\",\"T1110\"\r\n\"Bitglass\",\"8c8602e6-315d-400f-9d1e-23bbdee1dbfe\",\"Bitglass - New admin user\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Bitglass\",\"bfca0251-1581-4185-906b-4805099e3216\",\"Bitglass - Login from new device\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"a123668c-d907-41b9-bf3f-8cb4cd7b163a\",\"Bitglass - New risky user\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"40f69a27-8c68-4c8c-bb7c-7eb0f0a8a1fa\",\"Bitglass - The SmartEdge endpoint agent was uninstalled\",\"DefenseEvasion\",\"T1070\"\r\n\"Bitglass\",\"4b272e82-19f1-40d1-bfdf-74fbb6353e8b\",\"Bitglass - Suspicious file uploads\",\"Exfiltration\",\"T1567\"\r\n\"Bitglass\",\"34401e66-9fe9-476b-a443-3a3f89e4f3b0\",\"Bitglass - User login from new geo location\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"4dd61530-859f-49e7-bd27-a173cb1a4589\",\"Bitglass - User Agent string has changed for user\",\"InitialAccess\",\"T1078\"\r\n\"BloodHound Enterprise\",\"df292d06-f348-41ad-b780-0abb5acfe9ab\",\"BloodHound Enterprise - Number of critical attack paths increase\",,\r\n\"BloodHound Enterprise\",\"b1f6aed2-ebb9-4fe4-bd7c-6657d02a0cc8\",\"BloodHound Enterprise - Exposure increase\",,\r\n\"BloodHound Enterprise\",\"13424be6-aed7-448b-afe5-c03d8b29b4fe\",\"BloodHound Enterprise - Number of Tier Zero assets increase\",,\r\n\"Box\",\"1139230c-cf10-45db-b616-fed0d1415c05\",\"Box - Abmormal user activity\",\"Collection\",\"T1530\"\r\n\"Box\",\"b91ec98d-5747-45c8-b2f6-a07bf47068f0\",\"Box - Executable file in folder\",\"InitialAccess\",\"T1189\"\r\n\"Box\",\"8889e69c-2161-412a-94a6-76c1b2d9daa7\",\"Box - Forbidden file type downloaded\",\"InitialAccess\",\"T1189\"\r\n\"Box\",\"edbf38d7-e170-4af2-ad50-1a05b374611b\",\"Box - Inactive user login\",\"InitialAccess\",\"T1078\"\r\n\"Box\",\"3b803560-f8a6-4db4-89cb-617d89724ba1\",\"Box - Item shared to external entity\",\"Exfiltration\",\"T1537\"\r\n\"Box\",\"1b212329-6f2c-46ca-9071-de3464f3d88d\",\"Box - Many items deleted by user\",\"Impact\",\"T1485\"\r\n\"Box\",\"fd36ac88-cd92-4137-aa23-37a3648621fa\",\"Box - New external user\",\"InitialAccess  Persistence\",\"T1078\"\r\n\"Box\",\"266746ae-5eaf-4068-a980-5d630f435c46\",\"Box - File containing sensitive data\",\"Exfiltration\",\"T1048\"\r\n\"Box\",\"b2197d7f-4731-483c-89de-d48606b872da\",\"Box - User logged in as admin\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Box\",\"174c31c9-22ec-42e5-8226-814391c08200\",\"Box - User role changed to owner\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"c1c66f0b-5531-4a3e-a619-9d2f770ef730\",\"Account Elevated to New Role\",\"Persistence\",\"T1078.004\"\r\n\"Business Email Compromise - Financial Fraud\",\"feb0a2fb-ae75-4343-8cbc-ed545f1da289\",\"Authentication Method Changed for Privileged Account\",\"Persistence\",\"T1098\"\r\n\"Business Email Compromise - Financial Fraud\",\"8ac77493-3cae-4840-8634-15fb23f8fb68\",\"Malicious BEC Inbox Rule\",\"Persistence DefenseEvasion\",\"T1098 T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"0433c8a3-9aa6-4577-beef-2ea23be41137\",\"Privileged Account Permissions Changed\",\"PrivilegeEscalation\",\"T1078.004\"\r\n\"Business Email Compromise - Financial Fraud\",\"cd8d946d-10a4-40a9-bac1-6d0a6c847d65\",\"Suspicious access of BEC related documents\",\"Collection\",\"T1530\"\r\n\"Business Email Compromise - Financial Fraud\",\"f3e2d35f-1202-4215-995c-4654ef07d1d8\",\"Suspicious access of BEC related documents in AWS S3 buckets\",\"Collection\",\"T1530\"\r\n\"Business Email Compromise - Financial Fraud\",\"2a09f8cb-deb7-4c40-b08b-9137667f1c0b\",\"User Added to Admin Role\",\"PrivilegeEscalation\",\"T1078.004\"\r\n\"CTM360\",\"abe1a662-d00d-482e-aa68-9394622ae03e\",\"Auto Generated Page\",,\r\n\"CTM360\",\"6e9e1975-6d85-4387-bd30-3881c66e302e\",\"Brand Abuse\",\"DefenseEvasion\",\r\n\"CTM360\",\"bf93bd26-cad8-40a3-bde0-71acb874d595\",\"Brand Impersonation - HIGH\",,\r\n\"CTM360\",\"40045fff-d01f-4165-af5f-aca94fd402af\",\"Brand Impersonation - INFO\",,\r\n\"CTM360\",\"da2059f5-8463-49d5-a6dc-22597fd9ce66\",\"Code Repository\",,\r\n\"CTM360\",\"3db2904c-a93e-4ea5-a1bb-11b3ea5ec0bb\",\"Compromised Cards\",,\r\n\"CTM360\",\"e303d68e-08a7-4382-ab31-6a4bd80e8066\",\"Cookies HttpOnly Flag Not Used\",,\r\n\"CTM360\",\"f4a06203-66f0-4f84-8bc8-05a44161b426\",\"Cookies SameSite Flag Not Used\",,\r\n\"CTM360\",\"91da8421-6066-4570-8a0b-25d980810109\",\"Cookies Secure Flag Not Used\",,\r\n\"CTM360\",\"c2b123c3-e909-4c2e-bd4a-92b7055cf7e0\",\"DMARC Not Configured\",\"Collection\",\"T1114\"\r\n\"CTM360\",\"0faddbac-0004-40fa-9046-a1ead13e005a\",\"Domain Infringemen\",,\r\n\"CTM360\",\"24e1b876-f0ee-44cd-86a2-ec81d08f4ba7\",\"Executive Impersonation\",,\r\n\"CTM360\",\"2f58535e-e92a-450f-8052-a905b8c340b1\",\"Exposed Admin Login Page\",,\r\n\"CTM360\",\"b25aae75-d333-4b77-a7c1-b24644dc1e1f\",\"Exposed Email Address\",\"CredentialAccess\",\r\n\"CTM360\",\"2caf81cf-a419-4d56-91da-67368f2e73d2\",\"Exposed User List\",,\r\n\"CTM360\",\"0765fa90-1198-4241-960b-975387ac73fa\",\"Header Content Security Policy Missing\",,\r\n\"CTM360\",\"a3efb9ff-14a4-42ef-b019-0b9cbe5d3888\",\"Header HTTP Strict Transport Security Missing\",,\r\n\"CTM360\",\"5ee7098a-f0d8-46bf-806d-25015145e24f\",\"Header Referrer-Policy Missing\",,\r\n\"CTM360\",\"d6793fa2-c1db-4323-9bdb-a1e8d1990f5c\",\"Header Web Server Exposed\",,\r\n\"CTM360\",\"b3235222-fdb9-4083-b4ce-05aef9f48630\",\"Header X-Frame-Options Missing - Informational\",,\r\n\"CTM360\",\"ffa44079-5658-45f0-8d26-f73684455615\",\"Header X-Frame-Options Missing - Low\",,\r\n\"CTM360\",\"99212068-e9b9-445f-838b-aec05585e43e\",\"Header X-Frame-Options Missing - Medium\",,\r\n\"CTM360\",\"62956863-f450-48d6-bf8f-41956d2e8b29\",\"Header X-XSS-Protection Missing\",,\r\n\"CTM360\",\"a0a46e91-3f94-4ed4-ab70-ecd36ae0ead0\",\"Leaked Credential\",\"CredentialAccess\",\r\n\"CTM360\",\"c3771865-b647-46a7-9be5-a96c418cebc0\",\"Phishing\",\"Reconnaissance InitialAccess LateralMovement\",\r\n\"CTM360\",\"f78c03ec-4397-42f6-9c51-a54421817fd8\",\"SPF Not Configured\",,\r\n\"CTM360\",\"32f4eb88-0d23-4185-8579-f1645412e9de\",\"SPF Policy Set to Soft Fail\",,\r\n\"CTM360\",\"20ffc702-b7b2-4041-8f08-10ede8906cbf\",\"Subdomain Infringement\",,\r\n\"CTM360\",\"6e9c75ed-7009-4918-a2f0-40b446614ea0\",\"Subresource Integrity (SRI) Not Implemented\",,\r\n\"CTM360\",\"6e9afac9-6828-486f-b1d8-cf76e86e1224\",\"Suspicious Mobile App High\",,\r\n\"CTM360\",\"18155351-23b6-4684-bca6-23c11e4ff5c1\",\"Suspicious Mobile App INFO\",,\r\n\"CTM360\",\"69761091-1a9a-49a9-8966-be68cd550766\",\"TLS Certificate Host\",,\r\n\"CTM360\",\"1bdf3cba-6b85-4b88-ab1e-681bac20d41f\",\"TLS Certificate Using Weak Cipher - Informational\",,\r\n\"CTM360\",\"7bbe51fe-9c5f-4f54-a079-b84cc27737a1\",\"TLS Certificate Using Weak Cipher - Medium\",,\r\n\"CTM360\",\"049edfdd-0331-4493-bcd7-b375bba7b551\",\"TLSv1.1 in Use - info\",,\r\n\"CTM360\",\"92400070-199b-46d3-bd86-2fb8421b5338\",\"TLSv1.1 in Use - Medium\",,\r\n\"CTM360\",\"9435d04a-e8a6-49e5-90c4-e7f3456f9ed5\",\"TLSv1 in Use - Low\",,\r\n\"CTM360\",\"93f2ab34-15a3-4199-ad5a-6ebf8d2ad449\",\"TLSv1 in Use - Medium\",,\r\n\"Cisco ISE\",\"e63b4d90-d0a8-4609-b187-babfcc7f86d7\",\"CiscoISE - ISE administrator password has been reset\",\"InitialAccess Persistence PrivilegeEscalation DefenseEvasion\",\r\n\"Cisco ISE\",\"b6549a28-d61c-476e-b350-4404352ee427\",\"CiscoISE - Attempt to delete local store logs\",\"DefenseEvasion\",\r\n\"Cisco ISE\",\"4eddd44a-25e4-41af-930d-0c17218bec74\",\"CiscoISE - Backup failed\",,\r\n\"Cisco ISE\",\"6107cba5-2974-4c22-8222-2a6f7bbea664\",\"CiscoISE - Certificate has expired\",\"CredentialAccess\",\r\n\"Cisco ISE\",\"1fa0da3e-ec99-484f-aadb-93f59764e158\",\"CiscoISE -  Command executed with the highest privileges from new IP\",\"InitialAccess Persistence PrivilegeEscalation DefenseEvasion Execution\",\r\n\"Cisco ISE\",\"e71890a2-5f61-4790-b1ed-cf1d92d3e398\",\"CiscoISE - Command executed with the highest privileges by new user\",\"InitialAccess  Persistence PrivilegeEscalation  DefenseEvasion  Execution\",\r\n\"Cisco ISE\",\"0c509e9b-121e-4951-9f9b-43722e052b4f\",\"CiscoISE - Device changed IP in last 24 hours\",,\r\n\"Cisco ISE\",\"548a2eda-d3eb-46cc-8d4b-1601551629e4\",\"CiscoISE - Device PostureStatus changed to non-compliant\",\"CredentialAccess\",\r\n\"Cisco ISE\",\"ce171782-1643-4f21-bbb7-fa954b1e6897\",\"CiscoISE - Log collector was suspended\",\"DefenseEvasion\",\r\n\"Cisco ISE\",\"21d3be4c-6088-4e76-b6eb-d25479019cb9\",\"CiscoISE - Log files deleted\",\"DefenseEvasion\",\r\n\"Cisco SD-WAN\",\"dc3627c3-f9de-4f17-bfd3-ba99b64a0a67\",\"Cisco SDWAN - IPS Event Threshold\",\"Discovery\",\r\n\"Cisco SD-WAN\",\"232a1c75-63fc-4c81-8b18-b4a739fccba8\",\"Cisco SDWAN - Intrusion Events\",\"DefenseEvasion\",\r\n\"Cisco SD-WAN\",\"cb14defd-3415-4420-a2e4-2dd0f3e07a86\",\"Cisco SDWAN - Maleware Events\",\"Discovery\",\r\n\"Cisco SD-WAN\",\"a62a207e-62be-4a74-acab-4466d5b3854f\",\"Cisco SDWAN - Monitor Critical IPs\",\"Discovery\",\r\n\"Cisco Secure Endpoint\",\"4683ebce-07ad-4089-89e3-39d8fe83c011\",\"Cisco SE High Events Last Hour\",\"Execution InitialAccess\",\r\n\"Cisco Secure Endpoint\",\"0f788a93-dc88-4f80-89ef-bef7cd0fef05\",\"Cisco SE - Connection to known C2 server\",\"CommandAndControl\",\"T1071\"\r\n\"Cisco Secure Endpoint\",\"b6df3e11-de70-4779-ac9a-276c454a9025\",\"Cisco SE - Dropper activity on host\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"bccdbc39-31d3-4e2b-9df2-e4c9eecba825\",\"Cisco SE - Generic IOC\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"aea4468e-6322-48b6-bd83-f9d300cce855\",\"Cisco SE - Malware execusion on host\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"225053c7-085b-4fca-a18f-c367f9228bf3\",\"Cisco SE - Malware outbreak\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cisco Secure Endpoint\",\"b13489d7-feb1-4ad3-9a4c-09f6d64448fd\",\"Cisco SE - Multiple malware on host\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cisco Secure Endpoint\",\"64fece0a-44db-4bab-844d-fd503dc0aaba\",\"Cisco SE - Policy update failure\",\"DefenseEvasion\",\"T1562\"\r\n\"Cisco Secure Endpoint\",\"c9629114-0f49-4b50-9f1b-345287b2eebf\",\"Cisco SE - Ransomware Activity\",\"Impact\",\"T1486\"\r\n\"Cisco Secure Endpoint\",\"eabb9c20-7b0b-4a77-81e8-b06944f351c6\",\"Cisco SE - Unexpected binary file\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cisco Secure Endpoint\",\"d2c97cc9-1ccc-494d-bad4-564700451a2b\",\"Cisco SE - Possible webshell\",\"CommandAndControl\",\"T1102\"\r\n\"CiscoASA\",\"79f29feb-6a9d-4cdf-baaa-2daf480a5da1\",\"Cisco ASA - average attack detection rate increase\",\"Discovery Impact\",\"T1046 T1498\"\r\n\"CiscoASA\",\"795edf2d-cf3e-45b5-8452-fe6c9e6a582e\",\"Cisco ASA - threat detection message fired\",\"Discovery Impact\",\"T1046 T1498\"\r\n\"CiscoDuoSecurity\",\"398dd1cd-3251-49d8-b927-5b93bae4a094\",\"Cisco Duo - AD sync failed\",\"Impact\",\"T1489\"\r\n\"CiscoDuoSecurity\",\"6424c623-31a5-4892-be33-452586fd4075\",\"Cisco Duo - Admin user deleted\",\"Impact\",\"T1531\"\r\n\"CiscoDuoSecurity\",\"e46c5588-e643-4a60-a008-5ba9a4c84328\",\"Cisco Duo - Multiple admin 2FA failures\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"413e49a5-b107-4698-8428-46b89308bd22\",\"Cisco Duo - Admin password reset\",\"Persistence\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"034f62b6-df51-49f3-831f-1e4cfd3c40d2\",\"Cisco Duo - Multiple user login failures\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"6e4f9031-91d3-4fa1-8baf-624935f04ad8\",\"Cisco Duo - Multiple users deleted\",\"Impact\",\"T1531\"\r\n\"CiscoDuoSecurity\",\"f05271b6-26a5-49cf-ad73-4a202fba6eb6\",\"Cisco Duo - New access device\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"0724cb01-4866-483d-a149-eb400fe1daa8\",\"Cisco Duo - Admin user created\",\"Persistence  PrivilegeEscalation\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"01df3abe-3dc7-40e2-8aa7-f00b402df6f0\",\"Cisco Duo - Authentication device new location\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"16c91a2c-17ad-4985-a9ad-4a4f1cb11830\",\"Cisco Duo - Unexpected authentication factor\",\"InitialAccess\",\"T1078\"\r\n\"CiscoSEG\",\"df5c34dd-e1e6-4e07-90b1-4309ebfe754c\",\"Cisco SEG - DLP policy violation\",\"Exfiltration\",\"T1030\"\r\n\"CiscoSEG\",\"236e872c-31d1-4b45-ac2a-fda3af465c97\",\"Cisco SEG - Malicious attachment not blocked\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"1399a9a5-6200-411e-8c34-ca5658754cf7\",\"Cisco SEG - Multiple large emails sent to external recipient\",\"Exfiltration\",\"T1030\"\r\n\"CiscoSEG\",\"dfdb9a73-4335-4bb4-b29b-eb713bce61a6\",\"Cisco SEG - Multiple suspiciuos attachments received\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"53242559-95ea-4d4c-b003-107e8f06304b\",\"Cisco SEG - Possible outbreak\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"2e5158e1-9fc2-40ff-a909-c701a13a0405\",\"Cisco SEG - Potential phishing link\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"506291dd-8050-4c98-a92f-58e376080a0a\",\"Cisco SEG - Suspicious link\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"ef0a253c-95b5-48e1-8ebc-dbeb073b9338\",\"Cisco SEG - Suspicious sender domain\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"9cb4a02d-3708-42ba-b33b-0fdd360ce4b6\",\"Cisco SEG - Unexpected link\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"f8ba18c4-81e3-4db0-8f85-4989f2ed2ade\",\"Cisco SEG - Unexpected attachment\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"c66b8ced-8c76-415b-a0f3-08c7030a857d\",\"Cisco SEG - Unscannable attacment\",\"InitialAccess\",\"T1566\"\r\n\"CiscoUmbrella\",\"c9b6d281-b96b-4763-b728-9a04b9fe1246\",\"Cisco Umbrella - Connection to non-corporate private network\",\"CommandAndControl Exfiltration\",\r\n\"CiscoUmbrella\",\"75297f62-10a8-4fc1-9b2a-12f25c6f05a7\",\"Cisco Umbrella - Connection to Unpopular Website Detected\",\"CommandAndControl\",\r\n\"CiscoUmbrella\",\"b619d1f1-7f39-4c7e-bf9e-afbb46457997\",\"Cisco Umbrella - Crypto Miner User-Agent Detected\",\"CommandAndControl\",\r\n\"CiscoUmbrella\",\"2b328487-162d-4034-b472-59f1d53684a1\",\"Cisco Umbrella - Empty User Agent Detected\",\"CommandAndControl\",\r\n\"CiscoUmbrella\",\"8d537f3c-094f-430c-a588-8a87da36ee3a\",\"Cisco Umbrella - Hack Tool User-Agent Detected\",\"CommandAndControl\",\r\n\"CiscoUmbrella\",\"b12b3dab-d973-45af-b07e-e29bb34d8db9\",\"Cisco Umbrella - Windows PowerShell User-Agent Detected\",\"CommandAndControl DefenseEvasion\",\r\n\"CiscoUmbrella\",\"8c8de3fa-6425-4623-9cd9-45de1dd0569a\",\"Cisco Umbrella - Rare User Agent Detected\",\"CommandAndControl\",\r\n\"CiscoUmbrella\",\"d6bf1931-b1eb-448d-90b2-de118559c7ce\",\"Cisco Umbrella - Request Allowed to harmful/malicious URI category\",\"CommandAndControl InitialAccess\",\r\n\"CiscoUmbrella\",\"de58ee9e-b229-4252-8537-41a4c2f4045e\",\"Cisco Umbrella - Request to blocklisted file type\",\"InitialAccess\",\r\n\"CiscoUmbrella\",\"ee1818ec-5f65-4991-b711-bcf2ab7e36c3\",\"Cisco Umbrella - URI contains IP address\",\"CommandAndControl\",\r\n\"CiscoWSA\",\"38029e86-030c-46c4-8a91-a2be7c74d74c\",\"Cisco WSA - Access to unwanted site\",\"InitialAccess\",\"T1566\"\r\n\"CiscoWSA\",\"32c460ad-2d40-43e9-8ead-5cdd1d7a3163\",\"Cisco WSA - Unexpected uploads\",\"Exfiltration\",\"T1567\"\r\n\"CiscoWSA\",\"ebf9db0c-ba7b-4249-b9ec-50a05fa7c7c9\",\"Cisco WSA - Multiple errors to resource from risky category\",\"InitialAccess CommandAndControl\",\"T1189 T1102\"\r\n\"CiscoWSA\",\"1db49647-435c-41ad-bf8c-7130ba75429d\",\"Cisco WSA - Multiple errors to URL\",\"CommandAndControl\",\"T1102\"\r\n\"CiscoWSA\",\"93186e3d-5dc2-4a00-a993-fa1448db8734\",\"Cisco WSA - Multiple infected files\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"46b6c6fc-2c1a-4270-be10-9d444d83f027\",\"Cisco WSA - Multiple attempts to download unwanted file\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"6f756792-4888-48a5-97cf-40d9430dc932\",\"Cisco WSA - Suspected protocol abuse\",\"Exfiltration\",\"T1048\"\r\n\"CiscoWSA\",\"4250b050-e1c6-4926-af04-9484bbd7e94f\",\"Cisco WSA - Internet access from public IP\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"8e9d1f70-d529-4598-9d3e-5dd5164d1d02\",\"Cisco WSA - Unexpected file type\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"010644fd-2830-4451-9e0e-606cc192f2e7\",\"Cisco WSA - Unexpected URL\",\"CommandAndControl\",\"T1102\"\r\n\"CiscoWSA\",\"9b61a945-ebcb-4245-b6e4-51f3addb5248\",\"Cisco WSA - Unscannable file or scan error\",\"InitialAccess\",\"T1189\"\r\n\"Claroty\",\"fd6e3416-0421-4166-adb9-186e555a7008\",\"Claroty - Asset Down\",\"Impact\",\"T1529\"\r\n\"Claroty\",\"9a8b4321-e2be-449b-8227-a78227441b2a\",\"Claroty - Critical baseline deviation\",\"Impact\",\"T1529\"\r\n\"Claroty\",\"e7dbcbc3-b18f-4635-b27c-718195c369f1\",\"Claroty - Login to uncommon location\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Claroty\",\"4b5bb3fc-c690-4f54-9a74-016213d699b4\",\"Claroty - Multiple failed logins by user\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Claroty\",\"1c2310ef-19bf-4caf-b2b0-a4c983932fa5\",\"Claroty - Multiple failed logins to same destinations\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Claroty\",\"6c29b611-ce69-4016-bf99-eca639fee1f5\",\"Claroty - New Asset\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Claroty\",\"3b22ac47-e02c-4599-a37a-57f965de17be\",\"Claroty - Policy violation\",\"Discovery\",\"T1018\"\r\n\"Claroty\",\"99ad9f3c-304c-44c5-a61f-3a17f8b58218\",\"Claroty - Suspicious activity\",\"Discovery\",\"T1018\"\r\n\"Claroty\",\"5cf35bad-677f-4c23-8927-1611e7ff6f28\",\"Claroty - Suspicious file transfer\",\"Discovery\",\"T1018\"\r\n\"Claroty\",\"731e5ac4-7fe1-4b06-9941-532f2e008bb3\",\"Claroty - Treat detected\",\"Discovery\",\"T1018\"\r\n\"Cloud Identity Threat Protection Essentials\",\"65c78944-930b-4cae-bd79-c3664ae30ba7\",\"Multi-Factor Authentication Disabled for a User\",\"CredentialAccess Persistence\",\"T1098 T1556\"\r\n\"Cloud Identity Threat Protection Essentials\",\"d7424fd9-abb3-4ded-a723-eebe023aaa0b\",\"New External User Granted Admin Role\",\"Persistence\",\"T1098.001\"\r\n\"Cloudflare\",\"a7ce6135-9d55-4f14-b058-adc2e920a4fa\",\"Cloudflare - Bad client IP\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"729c6d21-fad9-4a6a-9c7f-482393c95957\",\"Cloudflare - Empty user agent\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"ef877d68-755f-4cf1-ac1d-f336e395667c\",\"Cloudflare - Multiple error requests from single source\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Cloudflare\",\"fc50076a-0275-43d5-b9dd-38346c061f67\",\"Cloudflare - Multiple user agents for single source\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"40554544-6e4a-4413-8d14-bf2de939c5d9\",\"Cloudflare - Client request from country in blocklist\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"7313352a-09f6-4a84-88bd-6f17f1cbeb8f\",\"Cloudflare - Unexpected POST requests\",\"Persistence CommandAndControl\",\"T1505 T1071\"\r\n\"Cloudflare\",\"f32142b1-4bcb-45c0-92e4-2ddc18768522\",\"Cloudflare - Unexpected client request\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Cloudflare\",\"dcb797cd-a4cd-4306-897b-7991f71d7e27\",\"Cloudflare - Unexpected URI\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Cloudflare\",\"f53fe2a9-96b5-454c-827e-cf1764a67fb0\",\"Cloudflare - WAF Allowed threat\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"4d9d00b9-31a6-49e4-88c1-9e68277053ac\",\"Cloudflare - XSS probing pattern in request\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cognni\",\"44e80f00-b4f5-486b-a57d-4073746276df\",\"Cognni Incidents for Highly Sensitive Business Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"7ebb7386-6c99-4331-aab1-a185a603eb47\",\"Cognni Incidents for Highly Sensitive Financial Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"2926ce29-08d2-4654-b2e8-7d8df70095d9\",\"Cognni Incidents for Highly Sensitive Governance Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"f68846cf-ec99-497d-9ce1-80a9441564fb\",\"Cognni Incidents for Highly Sensitive HR Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"4f45f43b-3a4b-491b-9cbe-d649603384aa\",\"Cognni Incidents for Highly Sensitive Legal Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"a0647a60-16f9-4175-b344-5cdd2934413f\",\"Cognni Incidents for Low Sensitivity Business Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"77171efa-4502-4ab7-9d23-d12305ff5a5e\",\"Cognni Incidents for Low Sensitivity Financial Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"d2e40c79-fe8c-428e-8cb9-0e2282d4558c\",\"Cognni Incidents for Low Sensitivity Governance Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"ef8654b1-b2cf-4f6c-ae5c-eca635a764e8\",\"Cognni Incidents for Low Sensitivity HR Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"8374ec0f-d857-4c17-b1e7-93d11800f8fb\",\"Cognni Incidents for Low Sensitivity Legal Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"2c286288-3756-4824-b599-d3c499836c11\",\"Cognni Incidents for Medium Sensitivity Business Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"d29b1d66-d4d9-4be2-b607-63278fc4fe6b\",\"Cognni Incidents for Medium Sensitivity Financial Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"c1d4a005-e220-4d06-9e53-7326a22b8fe4\",\"Cognni Incidents for Medium Sensitivity Governance Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"75ff4f7d-0564-4a55-8b25-a75be951cde3\",\"Cognni Incidents for Medium Sensitivity HR Information\",\"Collection\",\"T1530\"\r\n\"Cognni\",\"db750607-d48f-4aef-b238-085f4a9882f1\",\"Cognni Incidents for Medium Sensitivity Legal Information\",\"Collection\",\"T1530\"\r\n\"Commvault Security IQ\",\"317e757e-c320-448e-8837-fc61a70fe609\",\"CommvaultSecurityIQ Alert\",\"DefenseEvasion Impact\",\"T1578 T1531\"\r\n\"Commvault Security IQ\",\"1d2c3da7-60ec-40be-9c14-bade6eaf3c49\",\"Data Alert\",\"DefenseEvasion Impact\",\"T1578 T1531\"\r\n\"Commvault Security IQ\",\"c982bcc1-ef73-485b-80d5-2a637ce4ab2b\",\"IDP Alert\",\"DefenseEvasion Impact\",\"T1578 T1531\"\r\n\"Commvault Security IQ\",\"29e0767c-80ac-4689-9a2e-b25b9fc88fce\",\"User Alert\",\"DefenseEvasion Impact\",\"T1578 T1531\"\r\n\"ContinuousDiagnostics&Mitigation\",\"fd950af9-d9db-4879-a60a-7267cc041beb\",\"CDM_ContinuousDiagnostics&Mitigation_PostureChanged\",\"Discovery\",\"T1082\"\r\n\"Contrast Protect\",\"4396f8c3-d114-4154-9f4c-048ba522ed04\",\"Contrast Blocks\",\"InitialAccess Exfiltration\",\"T1566\"\r\n\"Contrast Protect\",\"e1abb6ed-be18-40fd-be58-3d3d84041daf\",\"Contrast Exploits\",\"InitialAccess Exfiltration\",\"T1566\"\r\n\"Contrast Protect\",\"297596de-d9ae-4fb8-b6ff-00fc01c9462d\",\"Contrast Probes\",\"InitialAccess Exfiltration\",\"T1566\"\r\n\"Contrast Protect\",\"f713404e-805c-4e0c-91fa-2c149f76a07d\",\"Contrast Suspicious\",\"InitialAccess Exfiltration\",\"T1566\"\r\n\"Corelight\",\"8eaa2268-74ee-492c-b869-450eff707fef\",\"Corelight - C2 DGA Detected Via Repetitive Failures\",\"CommandAndControl\",\r\n\"Corelight\",\"05850746-9ae4-412f-838b-844f0903f4a9\",\"Corelight - External Proxy Detected\",\"DefenseEvasion  CommandAndControl\",\"T1090\"\r\n\"Corelight\",\"73f23aa2-5cc4-4507-940b-75c9092e9e01\",\"Corelight - Forced External Outbound SMB\",\"CredentialAccess\",\"T1187\"\r\n\"Corelight\",\"4e55e306-3022-43a1-870a-41c4d5116079\",\"Corelight - Multiple Compressed Files Transferred over HTTP\",\"Exfiltration\",\r\n\"Corelight\",\"7226d37b-50ee-4e3b-9f80-5b74080d8f2c\",\"Corelight - Multiple files sent over HTTP with abnormal requests\",\"Exfiltration\",\"T1030\"\r\n\"Corelight\",\"599570d4-06f8-4939-8e29-95cd003f1abd\",\"Corelight - Network Service Scanning Multiple IP Addresses\",\"InitialAccess\",\"T1566\"\r\n\"Corelight\",\"f3245aa1-1ca1-471c-a0b7-97ea6b791d5d\",\"Corelight - Possible Webshell\",\"Persistence\",\"T1505\"\r\n\"Corelight\",\"db662e49-6e34-4d10-9d3c-5d04b5479658\",\"Corelight - Possible Webshell (Rare PUT or POST)\",\"Persistence\",\"T1505\"\r\n\"Corelight\",\"50c61708-9824-46f3-87cf-22490796fae2\",\"Corelight - SMTP Email containing NON Ascii Characters within the Subject\",\"InitialAccess\",\"T1566\"\r\n\"Corelight\",\"6b579e98-abc9-4e7a-9efc-2f3408ba16c9\",\"Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request\",\"InitialAccess\",\"T1566\"\r\n\"Cortex XDR\",\"f96728eb-9802-4522-b715-47fb66c2ecf5\",\"Cortex XDR Incident - High\",,\r\n\"Cortex XDR\",\"1426bbcf-a9ae-4aa5-9da6-abbf48f04115\",\"Cortex XDR Incident - Low\",,\r\n\"Cortex XDR\",\"2b05823b-ee15-4b92-a642-b13170e37c35\",\"Cortex XDR Incident - Medium\",,\r\n\"CrowdStrike Falcon Endpoint Protection\",\"4465ebde-b381-45f7-ad08-7d818070a11c\",\"Critical or High Severity Detections by User\",,\r\n\"CrowdStrike Falcon Endpoint Protection\",\"f7d298b2-726c-42a5-bbac-0d7f9950f527\",\"Critical Severity Detection\",,\r\n\"CyberArkEPM\",\"8e8978a2-9188-4187-8909-5ea00507bf16\",\"CyberArkEPM - Attack attempt not blocked\",\"Execution\",\"T1204\"\r\n\"CyberArkEPM\",\"a11bf869-458e-49fd-be03-58021b14be15\",\"CyberArkEPM - MSBuild usage as LOLBin\",\"DefenseEvasion\",\"T1127\"\r\n\"CyberArkEPM\",\"c02f96b4-057b-4e63-87af-6376ef7a081b\",\"CyberArkEPM - Multiple attack types\",\"Execution\",\"T1204\"\r\n\"CyberArkEPM\",\"16b940d2-aaf8-4eaa-a5e1-05df5f5c3d43\",\"CyberArkEPM - Uncommon Windows process started from System folder\",\"Execution  DefenseEvasion\",\"T1204 T1036\"\r\n\"CyberArkEPM\",\"eddfd1fd-71df-4cc3-b050-287643bee398\",\"CyberArkEPM - Possible execution of Powershell Empire\",\"Execution\",\"T1204\"\r\n\"CyberArkEPM\",\"0d4e62da-0a64-4532-b93e-28cd2940c300\",\"CyberArkEPM - Process started from different locations\",\"Execution  DefenseEvasion\",\"T1204  T1036\"\r\n\"CyberArkEPM\",\"9d0d44ab-54dc-472a-9931-53521e888932\",\"CyberArkEPM - Uncommon process Internet access\",\"Execution  DefenseEvasion CommandAndControl\",\"T1204 T1036 T1095\"\r\n\"CyberArkEPM\",\"9281b7cc-8f05-45a9-bf10-17fb29492a84\",\"CyberArkEPM - Re\",\"Execution  DefenseEvasion\",\"T1204  T1036\"\r\n\"CyberArkEPM\",\"911d5b75-a1ce-4f13-a839-9c2474768696\",\"CyberArkEPM - Unexpected executable extension\",\"Execution DefenseEvasion\",\"T1204 T1036\"\r\n\"CyberArkEPM\",\"c1fcbbd7-74f8-4f32-8116-0a533ebd3878\",\"CyberArkEPM - Unexpected executable location\",\"Execution DefenseEvasion\",\"T1204 T1036\"\r\n\"CybersecurityMaturityModelCertification(CMMC)2.0\",\"fb127436-e5c4-4e31-85a8-d3507128dd09\",\"CMMC 2.0 Level 1 (Foundational) Readiness Posture\",\"Discovery\",\"T1082\"\r\n\"CybersecurityMaturityModelCertification(CMMC)2.0\",\"7bfe573b-3069-4e81-98fe-9a4cffbcbc24\",\"CMMC 2.0 Level 2 (Advanced) Readiness Posture\",\"Discovery\",\"T1082\"\r\n\"Cynerio\",\"84e0ea1f-766d-4775-836a-c0c9cca05085\",\"Cynerio - IoT - Default password\",\"CredentialAccess\",\"T1552\"\r\n\"Cynerio\",\"3d853a88-92d2-4aec-a680-2bf7bb560c56\",\"Cynerio - Exploitation Attempt of IoT device\",\"LateralMovement\",\"T0866\"\r\n\"Cynerio\",\"65db1346-6435-4079-bbf4-9a7113c98054\",\"Cynerio - IoT - Weak password\",\"CredentialAccess\",\"T1552\"\r\n\"Cynerio\",\"211e9f49-3fca-4598-bc6e-e2c28d86e72c\",\"Cynerio - Medical device scanning\",\"LateralMovement\",\"T0866\"\r\n\"Cynerio\",\"c0756978-baa6-4239-9174-bac1b1ca1a6a\",\"Cynerio - Suspicious Connection to External Address\",\"LateralMovement\",\"T0866\"\r\n\"DNS Essentials\",\"02f23312-1a33-4390-8b80-f7cd4df4dea0\",\"Detect excessive NXDOMAIN DNS queries - Anomaly based (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"DNS Essentials\",\"4ab8b09e-3c23-4974-afbe-7e653779eb2b\",\"Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"DNS Essentials\",\"cf687598-5a2c-46f8-81c8-06b15ed489b1\",\"Detect DNS queries reporting multiple errors from different clients - Anomaly Based (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1573 T1008\"\r\n\"DNS Essentials\",\"5b8344eb-fa28-4ac3-bcff-bc19d5d63089\",\"Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1573 T1008\"\r\n\"DNS Essentials\",\"50b0dfb7-2c94-4eaf-a332-a5936d78c263\",\"Ngrok Reverse Proxy on Network (ASIM DNS Solution)\",\"CommandAndControl\",\"T1572 T1090 T1102\"\r\n\"DNS Essentials\",\"01191239-274e-43c9-b154-3a042692af06\",\"Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Anomaly based (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"DNS Essentials\",\"89ba52fa-96a7-4653-829a-ca49bb13336c\",\"Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Static threshold based (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"DNS Essentials\",\"0fe6bde4-b215-480c-99b4-84a96edcdbd7\",\"Rare client observed with high reverse DNS lookup count - Anomaly based (ASIM DNS Solution)\",\"Reconnaissance\",\"T1590\"\r\n\"DNS Essentials\",\"77b7c820-5f60-4779-8bdb-f06e21add5f1\",\"Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution)\",\"Reconnaissance\",\"T1590\"\r\n\"Darktrace\",\"a3c7b8ed-56a9-47b7-98e5-2555c16e17c9\",\"Darktrace Model Breach\",,\r\n\"Darktrace\",\"2e629769-60eb-4a14-8bfc-bde9be66ebeb\",\"Darktrace System Status\",,\r\n\"Darktrace\",\"ffa2977f-3077-4bba-b1bf-f3417699cbb0\",\"Darktrace AI Analyst\",,\r\n\"Dataminr Pulse\",\"64a46029-3236-4d03-b5df-207366a623f1\",\"Dataminr - urgent alerts detected\",\"Persistence\",\"T1546\"\r\n\"Dev 0270 Detection and Hunting\",\"7965f0be-c039-4d18-8ee8-9a6add8aecf3\",\"DEV-0270 New User Creation\",\"Persistence\",\"T1098\"\r\n\"Dev 0270 Detection and Hunting\",\"422ca2bf-598b-4872-82bb-5f7e8fa731e7\",\"Dev-0270 Malicious Powershell usage\",\"Exfiltration DefenseEvasion\",\"T1048  T1562\"\r\n\"Dev 0270 Detection and Hunting\",\"2566e99f-ad0f-472a-b9ac-d3899c9283e6\",\"Dev-0270 Registry IOC - September 2022\",\"Impact\",\"T1486\"\r\n\"Dev 0270 Detection and Hunting\",\"6b652b4f-9810-4eec-9027-7aa88ce4db23\",\"Dev-0270 WMIC  Discovery\",\"Discovery\",\"T1482\"\r\n\"Digital Shadows\",\"f7abe9c1-1e6c-4317-b907-25769e7764c5\",\"Digital Shadows Incident Creation for exclude-app\",,\r\n\"Digital Shadows\",\"ede3071d-9317-45f9-b36c-6a6effee5294\",\"Digital Shadows Incident Creation for include-app\",,\r\n\"DigitalGuardianDLP\",\"b52cda18-c1af-40e5-91f3-1fcbf9fa267e\",\"Digital Guardian - Sensitive data transfer over insecure channel\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"39e25deb-49bb-4cdb-89c1-c466d596e2bd\",\"Digital Guardian - Exfiltration using DNS protocol\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"f7b6ddef-c1e9-46f0-8539-dbba7fb8a5b8\",\"Digital Guardian - Exfiltration to online fileshare\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"edead9b5-243a-466b-ae78-2dae32ab1117\",\"Digital Guardian - Exfiltration to private email\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"a19885c8-1e44-47e3-81df-d1d109f5c92d\",\"Digital Guardian - Exfiltration to external domain\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"5f75a873-b524-4ba5-a3b8-2c20db517148\",\"Digital Guardian - Bulk exfiltration to external domain\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"e8901dac-2549-4948-b793-5197a5ed697a\",\"Digital Guardian - Multiple incidents from user\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"a374a933-f6c4-4200-8682-70402a9054dd\",\"Digital Guardian - Possible SMTP protocol abuse\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"a14f2f95-bbd2-4036-ad59-e3aff132b296\",\"Digital Guardian - Unexpected protocol\",\"Exfiltration\",\"T1048\"\r\n\"DigitalGuardianDLP\",\"07bca129-e7d6-4421-b489-32abade0b6a7\",\"Digital Guardian - Incident with not blocked action\",\"Exfiltration\",\"T1048\"\r\n\"Dynatrace\",\"1b0b2065-8bac-5a00-83c4-1b58f69ac212\",\"Dynatrace Application Security - Attack detection\",\"Execution Impact InitialAccess PrivilegeEscalation\",\"T1059 T1565 T1190 T1068\"\r\n\"Dynatrace\",\"305093b4-0fa2-57bc-bced-caea782a6e9c\",\"Dynatrace Application Security - Code-Level runtime vulnerability detection\",\"DefenseEvasion Execution Impact InitialAccess LateralMovement Persistence PrivilegeEscalation\",\r\n\"Dynatrace\",\"ff0af873-a2f2-4233-8412-0ef4e00b0156\",\"Dynatrace Application Security - Non-critical runtime vulnerability detection\",\"DefenseEvasion Execution Impact InitialAccess LateralMovement Persistence PrivilegeEscalation\",\r\n\"Dynatrace\",\"af99b078-124b-543a-9a50-66ef87c09f6a\",\"Dynatrace Application Security - Third-Party runtime vulnerability detection\",\"DefenseEvasion Execution Impact InitialAccess LateralMovement Persistence PrivilegeEscalation\",\r\n\"Dynatrace\",\"415978ff-074e-4203-824a-b06153d77bf7\",\"Dynatrace - Problem detection\",,\r\n\"ESETPROTECT\",\"64badfab-1dd8-4491-927b-3ca206fa9a17\",\"Threats detected by ESET\",\"Execution\",\"T1204\"\r\n\"ESETPROTECT\",\"7b84fc5b-9ffb-4e9b-945b-5d480e330b3f\",\"Website blocked by ESET\",\"Exfiltration CommandAndControl InitialAccess\",\"T1041 T1071 T1189 T1566\"\r\n\"EatonForeseer\",\"5a7fccb8-3ed0-44f2-8477-540af3ef4d92\",\"EatonForeseer - Unauthorized Logins\",\"InitialAccess\",\"T1078\"\r\n\"Egress Defend\",\"a0e55dd4-8454-4396-91e6-f28fec3d2cab\",\"Egress Defend - Dangerous Attachment Detected\",\"Execution InitialAccess Persistence PrivilegeEscalation\",\"T1204 T0853 T0863 T1566 T1546 T1546\"\r\n\"Egress Defend\",\"a896123e-03a5-4a4d-a7e3-fd814846dfb2\",\"Egress Defend - Dangerous Link Click\",\"Execution\",\"T1204 T0853\"\r\n\"Endpoint Threat Protection Essentials\",\"a7b9df32-1367-402d-b385-882daf6e3020\",\"Dumping LSASS Process Into a File\",\"CredentialAccess\",\"T1003.001\"\r\n\"Endpoint Threat Protection Essentials\",\"50cbf34a-4cdd-45d7-b3f5-8b53a1d0d14f\",\"Lateral Movement via DCOM\",\"LateralMovement\",\"T1021.003\"\r\n\"Endpoint Threat Protection Essentials\",\"e7470b35-0128-4508-bfc9-e01cfb3c2eb7\",\"Detecting Macro Invoking ShellBrowserWindow COM Objects\",\"LateralMovement\",\"T1021.003\"\r\n\"Endpoint Threat Protection Essentials\",\"d2e8fd50-8d66-11ec-b909-0242ac120002\",\"Potential Remote Desktop Tunneling\",\"CommandAndControl\",\"T1572\"\r\n\"Endpoint Threat Protection Essentials\",\"c61ad0ac-ad68-4ebb-b41a-74296d3e0044\",\"Registry Persistence via AppCert DLL Modification\",\"Persistence\",\"T1546.009\"\r\n\"Endpoint Threat Protection Essentials\",\"9367dff0-941d-44e2-8875-cb48570c7add\",\"Registry Persistence via AppInit DLLs Modification\",\"Persistence\",\"T1546.010\"\r\n\"Endpoint Threat Protection Essentials\",\"80da0a8f-cfe1-4cd0-a895-8bc1771a720e\",\"Security Event log cleared\",\"DefenseEvasion\",\"T1070\"\r\n\"Endpoint Threat Protection Essentials\",\"b5153fb3-ada9-4ce4-9131-79c771efb50d\",\"Suspicious Powershell Commandlet Executed\",\"Execution\",\"T1059\"\r\n\"Endpoint Threat Protection Essentials\",\"f6502545-ae3a-4232-a8b0-79d87e5c98d7\",\"WDigest downgrade attack\",\"CredentialAccess\",\"T1003\"\r\n\"Endpoint Threat Protection Essentials\",\"15049017-527f-4d3b-b011-b0e99e68ef45\",\"Windows Binaries Executed from Non-Default Directory\",\"Execution\",\"T1059\"\r\n\"Endpoint Threat Protection Essentials\",\"cbf6ad48-fa5c-4bf7-b205-28dbadb91255\",\"Windows Binaries Lolbins Re\",\"Execution\",\"T1059\"\r\n\"Endpoint Threat Protection Essentials\",\"ca67c83e-7fff-4127-a3e3-1af66d6d4cad\",\"Base64 encoded Windows process command-lines\",\"Execution DefenseEvasion\",\"T1059 T1027 T1140\"\r\n\"Endpoint Threat Protection Essentials\",\"d6190dde-8fd2-456a-ac5b-0a32400b0464\",\"Process executed from binary hidden in Base64 encoded file\",\"Execution DefenseEvasion\",\"T1059 T1027 T1140\"\r\n\"Endpoint Threat Protection Essentials\",\"75bf9902-0789-47c1-a5d8-f57046aa72df\",\"Malware in the recycle bin\",\"DefenseEvasion\",\r\n\"Eset Security Management Center\",\"84ad2f8a-b64c-49bc-b669-bdb4fd3071e9\",\"Web sites blocked by Eset\",\"Exfiltration CommandAndControl InitialAccess\",\r\n\"Eset Security Management Center\",\"2d8a60aa-c15e-442e-9ce3-ee924889d2a6\",\"Threats detected by Eset\",\"Execution CredentialAccess PrivilegeEscalation\",\r\n\"FalconFriday\",\"efe4efef-5ca7-4b51-a53e-0e96492ce97a\",\"ASR Bypassing Writing Executable Content\",\"DefenseEvasion\",\"T1211\"\r\n\"FalconFriday\",\"87d5cd18-211d-4fd4-9b86-65d23fed87ea\",\"Microsoft Entra ID Rare UserAgent App Sign-in\",\"DefenseEvasion\",\"T1036\"\r\n\"FalconFriday\",\"6a638d80-f6b2-473b-9087-3cac78a84b40\",\"Microsoft Entra ID UserAgent OS Missmatch\",\"DefenseEvasion\",\"T1036\"\r\n\"FalconFriday\",\"1aaff41f-4e18-45b1-bb34-de6eb4943cf2\",\"Component Object Model Hijacking - Vault7 trick\",\"Persistence PrivilegeEscalation\",\"T1546.015\"\r\n\"FalconFriday\",\"b838a13c-052e-45b8-a5ac-7d3eb62efa11\",\"Certified Pre-Owned - TGTs requested with certificate authentication\",\"DefenseEvasion\",\"T1036\"\r\n\"FalconFriday\",\"aa5eaac7-1264-4833-b620-8f062be75541\",\"Certified Pre-Owned - backup of CA private key - rule 1\",\"DefenseEvasion\",\"T1036\"\r\n\"FalconFriday\",\"88f8fbc0-345d-458e-85f6-f73921d5ef50\",\"Certified Pre-Owned - backup of CA private key - rule 2\",\"DefenseEvasion\",\"T1036\"\r\n\"FalconFriday\",\"f0be11a9-ec48-4df6-801d-479556044d4e\",\"Ingress Tool Transfer - Certutil\",\"CommandAndControl DefenseEvasion\",\"T1105 T1564.004 T1027 T1140\"\r\n\"FalconFriday\",\"8df80270-b4fa-4a7a-931e-8d17c0b321ae\",\"Access Token Manipulation - Create Process with Token\",\"PrivilegeEscalation DefenseEvasion\",\"T1134.002\"\r\n\"FalconFriday\",\"d58035ff-0bac-4c61-a7f4-f58939ff9764\",\"DCOM Lateral Movement\",\"LateralMovement\",\"T1021.003\"\r\n\"FalconFriday\",\"3084b487-fad6-4000-9544-6085b9657290\",\"Hijack Execution Flow - DLL Side-Loading\",\"Persistence PrivilegeEscalation DefenseEvasion\",\"T1574.002\"\r\n\"FalconFriday\",\"20d52a04-b5d8-402d-88e2-7929d12cbdcd\",\"Disable or Modify Windows Defender\",\"DefenseEvasion\",\"T1562.001\"\r\n\"FalconFriday\",\"9f921513-65f3-48a2-ae7d-326c5901c55e\",\"Detect .NET runtime being loaded in JScript for code execution\",\"Execution\",\"T1204\"\r\n\"FalconFriday\",\"aba0b08c-aace-40c5-a21d-39153023dcaa\",\"Excessive share permissions\",\"Collection Discovery\",\"T1039 T1135\"\r\n\"FalconFriday\",\"433c3b0a-7278-4d74-b137-963ac6f9a7e7\",\"Expired access credentials being used in Azure\",\"CredentialAccess\",\"T1528\"\r\n\"FalconFriday\",\"dd22dc4f-ab7c-4d0a-84ad-cc393638ba31\",\"Match Legitimate Name or Location - 2\",\"DefenseEvasion\",\"T1036.005\"\r\n\"FalconFriday\",\"30580043-2451-4d35-b49f-065728529f4a\",\"Office ASR rule triggered from browser spawned office process.\",\"InitialAccess\",\"T1566.002\"\r\n\"FalconFriday\",\"a4d8e681-6f30-440a-a2f3-c312bc1389d0\",\"Suspicious Process Injection from Office application\",\"Execution\",\"T1204\"\r\n\"FalconFriday\",\"e6c5ff42-0f42-4cec-994a-dabb92fe36e1\",\"Oracle suspicious command execution\",\"LateralMovement PrivilegeEscalation\",\"T1210 T1611\"\r\n\"FalconFriday\",\"e00f72ab-fea1-4a31-9ecc-eea6397cd38d\",\"Password Spraying\",\"CredentialAccess\",\"T1110.003\"\r\n\"FalconFriday\",\"6345c923-99eb-4a83-b11d-7af0ffa75577\",\"Beacon Traffic Based on Common User Agents Visiting Limited Number of Domains\",\"CommandAndControl\",\"T1071.001\"\r\n\"FalconFriday\",\"cc46e76c-0d04-40b0-9c8b-929aa40513e7\",\"Remote Desktop Protocol - SharpRDP\",\"LateralMovement\",\"T1021.001\"\r\n\"FalconFriday\",\"335ddff8-b615-42cd-b593-86e419b45d78\",\"Re\",\"DefenseEvasion\",\"T1036.003\"\r\n\"FalconFriday\",\"9da25366-2c77-41a5-a159-0da5e2f5fb90\",\"SMB/Windows Admin Shares\",\"LateralMovement\",\"T1021.002\"\r\n\"FalconFriday\",\"ddf7c669-db26-4215-acaf-11e2953a04e6\",\"Suspicious\",\"Execution DefenseEvasion\",\"T1559 T1055\"\r\n\"FalconFriday\",\"5ee34fa1-64ed-48c7-afa2-794b244f6c60\",\"Suspicious parentprocess relationship - Office child processes.\",\"InitialAccess\",\"T1566.002\"\r\n\"FalconFriday\",\"5c2bb446-926f-4160-a233-21e335c2c290\",\"Trusted Developer Utilities Proxy Execution\",\"DefenseEvasion\",\"T1127\"\r\n\"FalconFriday\",\"2d5efc71-2e91-4ca2-8506-857eecb453ec\",\"Detecting UAC bypass - elevated COM interface\",\"Impact\",\"T1490\"\r\n\"FalconFriday\",\"8b8fbf9c-35d4-474b-8151-a40173521293\",\"Detecting UAC bypass - modify Windows Store settings\",\"Impact\",\"T1490\"\r\n\"FalconFriday\",\"829a69ba-93e1-491f-8a1f-b19506e9d88a\",\"Detecting UAC bypass - ChangePK and SLUI registry tampering\",\"Impact\",\"T1490\"\r\n\"Flare\",\"9cb7c337-f172-4af6-b0e8-b6b7552d762d\",\"Flare Cloud bucket result\",\"Reconnaissance\",\"T1593\"\r\n\"Flare\",\"9cb7c337-f170-4af6-b0e8-b6b7552d762d\",\"Flare Leaked Credentials\",\"CredentialAccess\",\"T1110\"\r\n\"Flare\",\"9cb7c337-f173-4af6-b0e8-b6b7552d762d\",\"Flare Darkweb result\",\"Reconnaissance\",\"T1597\"\r\n\"Flare\",\"9cb7c337-f174-4af6-b0e8-b6b7552d762d\",\"Flare Google Dork result found\",\"Reconnaissance\",\"T1593\"\r\n\"Flare\",\"9cb7c337-f175-4af6-b0e8-b6b7552d762d\",\"Flare Host result\",\"Reconnaissance\",\"T1596\"\r\n\"Flare\",\"9cb7c337-f176-4af6-b0e8-b6b7552d762d\",\"Flare Infected Device\",\"CredentialAccess\",\"T1555\"\r\n\"Flare\",\"9cb7c337-f177-4af6-b0e8-b6b7552d762d\",\"Flare Paste result\",\"Reconnaissance\",\"T1593\"\r\n\"Flare\",\"9cb7c337-f179-4af6-b0e8-b6b7552d762d\",\"Flare SSL Certificate result\",\"ResourceDevelopment\",\"T1583\"\r\n\"Flare\",\"9cb7c337-f178-4af6-b0e8-b6b7552d762d\",\"Flare Source Code found\",\"Reconnaissance\",\"T1593\"\r\n\"ForescoutHostPropertyMonitor\",\"d272e277-f285-4dbc-ae2d-7f65ba64a79e\",\"Forescout-DNS_Sniff_Event_Monitor\",,\r\n\"Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel\",\"86e9409f-b9ea-4e9a-8b72-5132ba43bcae\",\"Fortiweb - WAF Allowed threat\",\"InitialAccess\",\"T1190 T1133\"\r\n\"GitHub\",\"6bb50582-caac-4a9b-9afb-3fee766ebbf7\",\"(Preview) GitHub - A payment method was removed\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"f041e01d-840d-43da-95c8-4188f6cef546\",\"GitHub Activites from a New Country\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c5\",\"(Preview) GitHub - Oauth application - a client secret was removed\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c2\",\"(Preview) GitHub - Repository was created\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c3\",\"(Preview) GitHub - Repository was destroyed\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"3ff0fffb-d963-40c0-b235-3404f915add7\",\"GitHub Two Factor Auth Disable\",\"DefenseEvasion\",\"T1562\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe20c9\",\"(Preview) GitHub - User visibility Was changed\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c4\",\"(Preview) GitHub - User was added to the organization\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c8\",\"(Preview) GitHub - User was blocked\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe40c9\",\"(Preview) GitHub - User was invited to the repository\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c7\",\"(Preview) GitHub - pull request was created\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"0b85a077-8ba5-4cb5-90f7-1e882afe10c6\",\"(Preview) GitHub - pull request was merged\",\"InitialAccess\",\"T1078\"\r\n\"GitHub\",\"594c653d-719a-4c23-b028-36e3413e632e\",\"NRT GitHub Two Factor Auth Disable\",\"DefenseEvasion\",\"T1562\"\r\n\"GitHub\",\"5436f471-b03d-41cb-b333-65891f887c43\",\"GitHub Security Vulnerability in Repository\",,\r\n\"GitLab\",\"2238d13a-cf05-4973-a83f-d12a25dbb153\",\"GitLab - Brute-force Attempts\",\"CredentialAccess\",\"T1110\"\r\n\"GitLab\",\"c1544d8f-cbbd-4e35-8d32-5b9312279833\",\"GitLab - External User Added to GitLab\",\"Persistence\",\"T1136\"\r\n\"GitLab\",\"0f4f16a2-b464-4c10-9a42-993da3e15a40\",\"GitLab - User Impersonation\",\"Persistence\",\"T1078\"\r\n\"GitLab\",\"e0b45487-5c79-482d-8ac0-695de8c031af\",\"GitLab - Local Auth - No MFA\",\"CredentialAccess\",\"T1110\"\r\n\"GitLab\",\"7241740a-5280-4b74-820a-862312d721a8\",\"GitLab - TI - Connection from Malicious IP\",\"InitialAccess\",\"T1078\"\r\n\"GitLab\",\"4d6d8b0e-6d9a-4857-a141-f5d89393cddb\",\"GitLab - Personal Access Tokens creation over time\",\"Collection\",\"T1213\"\r\n\"GitLab\",\"8b291c3d-90ba-4ebf-af2c-0283192d430e\",\"GitLab - Repository visibility to Public\",\"Persistence DefenseEvasion CredentialAccess\",\"T1556\"\r\n\"GitLab\",\"3efd09bd-a582-4410-b7ec-5ff21cfad7bd\",\"GitLab - Abnormal number of repositories deleted\",\"Impact\",\"T1485\"\r\n\"GitLab\",\"57b1634b-531d-4eab-a456-8b855887428f\",\"GitLab - SSO - Sign-Ins Burst\",\"CredentialAccess\",\"T1110\"\r\n\"GoogleCloudPlatformDNS\",\"6758c671-e9ee-495d-b6b0-92ffd08a8c3b\",\"Google DNS - CVE-2021-40444 exploitation\",\"PrivilegeEscalation\",\"T1068\"\r\n\"GoogleCloudPlatformDNS\",\"424c2aca-5367-4247-917a-5d0f7035e40e\",\"Google DNS - Exchange online autodiscover abuse\",\"InitialAccess CredentialAccess\",\"T1566  T1187\"\r\n\"GoogleCloudPlatformDNS\",\"35221a58-cacb-4174-9bb4-ee777784fbce\",\"Google DNS - IP check activity\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"09fc03e0-daec-4b22-8afa-4bba30d7e909\",\"Google DNS - Request to dynamic DNS service\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"75491db8-eaf7-40bb-a46a-279872cc82f5\",\"Google DNS - Malicous Python packages\",\"InitialAccess\",\"T1195\"\r\n\"GoogleCloudPlatformDNS\",\"7e81a935-5e91-45a5-92fd-3b58c180513b\",\"Google DNS - Multiple errors for source\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"da04a5d6-e2be-4cba-8cdb-a3f2efa87e9e\",\"Google DNS - Multiple errors to same domain\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"e632e73a-06c4-47f6-8bed-b2498aa6e30f\",\"Google DNS - CVE-2021-34527 (PrintNightmare) external exploit\",\"PrivilegeEscalation\",\"T1068\"\r\n\"GoogleCloudPlatformDNS\",\"1267d53d-f5fd-418b-b8da-34453a5994c2\",\"Google DNS - CVE-2020-1350 (SIGRED) exploitation pattern\",\"PrivilegeEscalation\",\"T1068\"\r\n\"GoogleCloudPlatformDNS\",\"22a613ea-c338-4f91-bbd3-3be97b00ebf9\",\"Google DNS - UNC2452 (Nobelium) APT Group activity\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformIAM\",\"2530a631-9605-404d-ae58-58ef1f91b17c\",\"GCP IAM - Disable Data Access Logging\",\"DefenseEvasion\",\"T1562\"\r\n\"GoogleCloudPlatformIAM\",\"9e0d8632-d33d-4075-979e-c972674f77b3\",\"GCP IAM - Empty user agent\",\"DefenseEvasion\",\"T1550\"\r\n\"GoogleCloudPlatformIAM\",\"86112c4b-2535-4178-aa0e-ed9e32e3f054\",\"GCP IAM - High privileged role added to service account\",\"PrivilegeEscalation\",\"T1078\"\r\n\"GoogleCloudPlatformIAM\",\"80e4db30-5636-4fbd-8816-24c3ded8d243\",\"GCP IAM - New Authentication Token for Service Account\",\"LateralMovement\",\"T1550\"\r\n\"GoogleCloudPlatformIAM\",\"a768aa52-453e-4e3e-80c2-62928d2e2f56\",\"GCP IAM - New Service Account\",\"Persistence\",\"T1136\"\r\n\"GoogleCloudPlatformIAM\",\"fc135860-8773-4ead-b5be-9789af1ff8ff\",\"GCP IAM - New Service Account Key\",\"LateralMovement\",\"T1550\"\r\n\"GoogleCloudPlatformIAM\",\"52d88912-fa8b-4db2-b247-ee9225e41e8f\",\"GCP IAM - Privileges Enumeration\",\"Discovery\",\"T1069\"\r\n\"GoogleCloudPlatformIAM\",\"4a433846-4b05-4a27-99d7-92093feded79\",\"GCP IAM - Publicly exposed storage bucket\",\"Discovery\",\"T1069\"\r\n\"GoogleCloudPlatformIAM\",\"50e0437e-912d-4cd0-ac19-fef0aebdd3d7\",\"GCP IAM - Service Account Enumeration\",\"Discovery\",\"T1087\"\r\n\"GoogleCloudPlatformIAM\",\"7ad3cfed-18c0-44af-9e9d-9fb5472a2321\",\"GCP IAM - Service Account Keys Enumeration\",\"Discovery\",\"T1069\"\r\n\"GoogleWorkspaceReports\",\"03f25156-6172-11ec-90d6-0242ac120003\",\"GWorkspace - Admin permissions granted\",\"Persistence\",\"T1098\"\r\n\"GoogleWorkspaceReports\",\"e369d246-5da8-11ec-bf63-0242ac130002\",\"GWorkspace - Alert events\",\"InitialAccess\",\"T1190  T1133\"\r\n\"GoogleWorkspaceReports\",\"c45a9804-5da8-11ec-bf63-0242ac130002\",\"GWorkspace - API Access Granted\",\"DefenseEvasion LateralMovement\",\"T1550\"\r\n\"GoogleWorkspaceReports\",\"92fae638-5da8-11ec-bf63-0242ac130002\",\"GWorkspace - User access has been changed\",\"Persistence\",\"T1098\"\r\n\"GoogleWorkspaceReports\",\"6ff0e16e-5999-11ec-bf63-0242ac130002\",\"GWorkspace - Multiple user agents for single source\",\"Persistence Collection\",\"T1185 T1176\"\r\n\"GoogleWorkspaceReports\",\"ead87cd6-5da7-11ec-bf63-0242ac130002\",\"GWorkspace - An Outbound Relay has been added to a G Suite Domain\",\"Collection\",\"T1114\"\r\n\"GoogleWorkspaceReports\",\"8f6cd9a4-5e57-11ec-bf63-0242ac130002\",\"GWorkspace - Possible brute force attack\",\"CredentialAccess\",\"T1110\"\r\n\"GoogleWorkspaceReports\",\"d80d02a8-5da6-11ec-bf63-0242ac130002\",\"GWorkspace - Possible maldoc file\",\"InitialAccess\",\"T1566\"\r\n\"GoogleWorkspaceReports\",\"c8cc02d0-5da6-11ec-bf63-0242ac130002\",\"GWorkspace - Two-step authentification disabled for a user\",\"CredentialAccess\",\"T1111\"\r\n\"GoogleWorkspaceReports\",\"c02b0c8e-5da6-11ec-bf63-0242ac130002\",\"GWorkspace - Unexpected OS update\",\"PrivilegeEscalation\",\r\n\"GreyNoiseThreatIntelligence\",\"e50657d7-8bca-43ff-a647-d407fae440d6\",\"GreyNoise TI Map IP Entity to CommonSecurityLog\",\"Impact\",\r\n\"GreyNoiseThreatIntelligence\",\"ddf47b6f-870c-5712-a296-1383acb13c82\",\"GreyNoise TI Map IP Entity to DnsEvents\",\"Impact\",\r\n\"GreyNoiseThreatIntelligence\",\"c51628fe-999c-5150-9fd7-660fc4f58ed2\",\"GreyNoise TI map IP entity to OfficeActivity\",\"Impact\",\r\n\"GreyNoiseThreatIntelligence\",\"f6c76cc9-218c-5b76-9b82-8607f09ea1b4\",\"GreyNoise TI Map IP Entity to SigninLogs\",\"Impact\",\r\n\"GreyNoiseThreatIntelligence\",\"536e8e5c-ce0e-575e-bcc9-aba8e7bf9316\",\"GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)\",\"Impact\",\r\n\"IONIX\",\"8e0403b1-07f8-4865-b2e9-74d1e83200a4\",\"High Urgency IONIX Action Items\",\"InitialAccess\",\"T1190 T1195\"\r\n\"Illusive Platform\",\"1a7dbcf6-21a2-4255-84b2-c8dbbdca4630\",\"Illusive Incidents Analytic Rule\",,\r\n\"ImpervaCloudWAF\",\"363307f6-09ba-4926-ad52-03aadfd24b5e\",\"Imperva - Abnormal protocol usage\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ImpervaCloudWAF\",\"427c025d-c068-4844-8205-66879e89bcfa\",\"Imperva - Request from unexpected IP address to admin panel\",\"InitialAccess\",\"T1190  T1133\"\r\n\"ImpervaCloudWAF\",\"4d365217-f96a-437c-9c57-53594fa261c3\",\"Imperva - Critical severity event not blocked\",\"InitialAccess\",\"T1190  T1133\"\r\n\"ImpervaCloudWAF\",\"6214f187-5840-4cf7-a174-0cf9a72bfd29\",\"Imperva - Possible command injection\",\"InitialAccess\",\"T1190  T1133\"\r\n\"ImpervaCloudWAF\",\"58300723-22e0-4096-b33a-aa9b992c3564\",\"Imperva - Request from unexpected countries\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ImpervaCloudWAF\",\"7ebc9e24-319c-4786-9151-c898240463bc\",\"Imperva - Forbidden HTTP request method in request\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ImpervaCloudWAF\",\"2ff35ed4-b26a-4cad-93a6-f67adb00e919\",\"Imperva - Malicious Client\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ImpervaCloudWAF\",\"905794a9-bc46-42b9-974d-5a2dd58110c5\",\"Imperva - Malicious user agent\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ImpervaCloudWAF\",\"4e8032eb-f04d-4a30-85d3-b74bf2c8f204\",\"Imperva - Multiple user agents from same source\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ImpervaCloudWAF\",\"0ba78922-033c-468c-82de-2974d7b1797d\",\"Imperva - Request to unexpected destination port\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Infoblox Cloud Data Connector\",\"8db2b374-0337-49bd-94c9-cfbf8e5d83ad\",\"Infoblox - Data Exfiltration Attack\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"dc7af829-d716-4774-9d6f-03d9aa7c27a4\",\"Infoblox - High Threat Level Query Not Blocked Detected\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"3822b794-fa89-4420-aad6-0e1a2307f419\",\"Infoblox - Many High Threat Level Queries From Single Host Detected\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"99278700-79ca-4b0f-b416-bf57ec699e1a\",\"Infoblox - Many High Threat Level Single Query Detected\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"b2f34315-9065-488e-88d0-a171d2b0da8e\",\"Infoblox - Many NXDOMAIN DNS Responses Detected\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"5b0864a9-4577-4087-b9fa-de3e14a8a999\",\"Infoblox - TI - CommonSecurityLog Match Found - MalwareC2\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"568730be-b39d-45e3-a392-941e00837d52\",\"Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox Cloud Data Connector\",\"28ee3c2b-eb4b-44de-a71e-e462843fea72\",\"Infoblox - TI - Syslog Match Found - URL\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox NIOS\",\"b8266f81-2715-41a6-9062-42486cbc9c73\",\"Excessive NXDOMAIN DNS Queries\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"Infoblox NIOS\",\"57e56fc9-417a-4f41-a579-5475aea7b8ce\",\"Potential DHCP Starvation Attack\",\"InitialAccess\",\"T1200\"\r\n\"Infoblox SOC Insights\",\"cf9847bb-ab46-4050-bb81-75cab3f893dc\",\"Infoblox - SOC Insight Detected - API Source\",\"Impact\",\"T1498 T1565\"\r\n\"Infoblox SOC Insights\",\"a4bdd81e-afc8-4410-a3d1-8478fa810537\",\"Infoblox - SOC Insight Detected - CDC Source\",\"Impact\",\"T1498 T1565\"\r\n\"Integration for Atlassian Beacon\",\"83fbf6a2-f227-48f4-8e7b-0b0ecac2381b\",\"Atlassian Beacon Alert\",,\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"e068187a-01f5-4737-bc13-25db4027b7ea\",\"Denial of Service (Microsoft Defender for IoT)\",\"InhibitResponseFunction\",\"T0814\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"f5217b4c-3f1f-4d89-b4f3-5d7581da1c1c\",\"Excessive Login Attempts (Microsoft Defender for IoT)\",\"ImpairProcessControl\",\"T0806\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"7cad4b66-5e83-4756-8de4-f21315ab1e77\",\"Firmware Updates (Microsoft Defender for IoT)\",\"Persistence\",\"T0857\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"caa4665f-21fa-462d-bb31-92226e746c68\",\"High bandwidth in the network (Microsoft Defender for IoT)\",\"Discovery\",\"T0842\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3\",\"No traffic on Sensor Detected (Microsoft Defender for IoT)\",\"InhibitResponseFunction\",\"T0881\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"70be4a31-9d2b-433b-bdc7-da8928988069\",\"Illegal Function Codes for ICS traffic (Microsoft Defender for IoT)\",\"ImpairProcessControl\",\"T0855\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"f9df500a-e2a4-4104-a517-dc1d85bb654f\",\"PLC unsecure key state (Microsoft Defender for IoT)\",\"Execution\",\"T0858\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"9ff3b13b-287a-4ed0-8f6b-7e7b66cbbcbd\",\"Internet Access (Microsoft Defender for IoT)\",\"LateralMovement\",\"T0886\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"6fb1acd5-356d-40f7-9b97-78d993c6a183\",\"Suspicious malware found in the network (Microsoft Defender for IoT)\",\"Impact\",\"T0882\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"493916d5-a094-4bfa-bdd1-d983a063ea3d\",\"Multiple scans in the network (Microsoft Defender for IoT)\",\"Discovery\",\"T0842\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"a7d3f642-15d8-4e83-99ee-83ca3352525d\",\"PLC Stop Command (Microsoft Defender for IoT)\",\"DefenseEvasion\",\"T0858\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"f4c71e55-6192-47ca-92e2-0856ae502a46\",\"Unauthorized device in the network (Microsoft Defender for IoT)\",\"Discovery\",\"T0842\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"c52ec521-9188-4a9e-a4cd-34a3dfbc3d27\",\"Unauthorized DHCP configuration in the network (Microsoft Defender for IoT)\",\"Discovery\",\"T0842\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"c2fb27c7-5f67-49c4-aaf3-d82934234a69\",\"Unauthorized PLC changes (Microsoft Defender for IoT)\",\"Persistence\",\"T0839\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"1ff4fa3d-150b-4c87-b733-26c289af0d49\",\"Unauthorized remote access to the network (Microsoft Defender for IoT)\",\"InitialAccess\",\"T0886\"\r\n\"IronNet IronDefense\",\"3cf46cb9-99d5-42ee-a43c-7bd88ea394a1\",\"Create Incidents from IronDefense\",,\r\n\"Jamf Protect\",\"6098daa0-f05e-44d5-b5a0-913e63ba3179\",\"Jamf Protect - Alerts\",,\r\n\"Jamf Protect\",\"44da53c3-f3b0-4b70-afff-f79275cb9442\",\"Jamf Protect - Network Threats\",\"InitialAccess\",\r\n\"Jamf Protect\",\"9eb2f758-003b-4303-83c6-97aed4c03e41\",\"Jamf Protect - Unified Logs\",,\r\n\"LastPass\",\"8a2cc466-342d-4ebb-8871-f9e1d83a24a5\",\"Employee account deleted\",\"Impact\",\"T1485\"\r\n\"LastPass\",\"760b8467-e6cc-4006-9149-5696845c1a54\",\"Failed sign-ins into LastPass due to MFA\",\"InitialAccess\",\"T1078  T1190\"\r\n\"LastPass\",\"b39e6482-ab7e-4817-813d-ec910b64b26e\",\"Highly Sensitive Password Accessed\",\"CredentialAccess Discovery\",\"T1555  T1087\"\r\n\"LastPass\",\"2a723664-22c2-4d3e-bbec-5843b90166f3\",\"TI map IP entity to LastPass data\",\"Impact\",\"T1485\"\r\n\"LastPass\",\"a3bbdf60-0a6d-4cc2-b1d1-dd70aca184ce\",\"Unusual Volume of Password Updated or Removed\",\"Impact\",\"T1485\"\r\n\"Lookout\",\"7593cc60-e294-402d-9202-279fb3c7d55f\",\"Lookout - New Threat events found.\",\"Discovery\",\"T1057\"\r\n\"Malware Protection Essentials\",\"259de2c1-c546-4c6d-a17c-df639722f4d7\",\"Detect Malicious Usage of Recovery Tools to Delete Backup Files\",\"Impact\",\"T1490\"\r\n\"Malware Protection Essentials\",\"7edde3d4-9859-4a00-b93c-b19ddda55320\",\"Detect Print Processors Registry Driver Key Creation/Modification\",\"Persistence PrivilegeEscalation\",\"T1547\"\r\n\"Malware Protection Essentials\",\"dd041e4e-1ee2-41ec-ba4e-82a71d628260\",\"Detect Registry Run Key Creation/Modification\",\"Persistence PrivilegeEscalation DefenseEvasion\",\"T1547 T1112\"\r\n\"Malware Protection Essentials\",\"fdbcc0eb-44fb-467e-a51d-a91df0780a81\",\"Process Creation with Suspicious CommandLine Arguments\",\"Execution DefenseEvasion\",\"T1059 T1027\"\r\n\"Malware Protection Essentials\",\"056593d4-ca3b-47a7-be9d-d1d0884a1d36\",\"Detect Windows Allow Firewall Rule Addition/Modification\",\"DefenseEvasion\",\"T1562\"\r\n\"Malware Protection Essentials\",\"f1443a87-78d5-40c3-b051-f468f0f2def0\",\"Detect Windows Update Disabled from Registry\",\"DefenseEvasion\",\"T1562\"\r\n\"MaturityModelForEventLogManagementM2131\",\"4be5b645-1d08-49e4-b58d-07294ff19223\",\"M2131_AssetStoppedLogging\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"1f8fcca5-47ed-409d-a8fa-d49ef821feaf\",\"M2131_EventLogManagementPostureChanged_EL0\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"036ce0a8-a1ff-4731-a078-02b3207fa4f3\",\"M2131_EventLogManagementPostureChanged_EL1\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"e1bb07c4-066b-4069-9b8e-f5275c592b6d\",\"M2131_EventLogManagementPostureChanged_EL2\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"672bfd77-4542-4ef1-acf9-e006dcd70c51\",\"M2131_EventLogManagementPostureChanged_EL3\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"8178a514-1270-4e31-a1d9-aaafeb40122f\",\"M2131_LogRetentionLessThan1Year\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"c61b167a-59ae-42af-bc98-36c78c5acb5c\",\"M2131_RecommendedDatatableUnhealthy\",\"Discovery\",\"T1082\"\r\n\"McAfee ePolicy Orchestrator\",\"3c1425d3-93d4-4eaf-8aa0-370dbac94c82\",\"McAfee ePO - Agent Handler down\",\"DefenseEvasion\",\"T1562\"\r\n\"McAfee ePolicy Orchestrator\",\"1e3bcd0f-10b2-4fbd-854f-1c6f33acc36a\",\"McAfee ePO - Error sending alert\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"2eff5809-bf84-48e0-8288-768689672c37\",\"McAfee ePO - Attempt uninstall McAfee agent\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"155243f4-d962-4717-8a7b-b15b6d112660\",\"McAfee ePO - Deployment failed\",\"DefenseEvasion\",\"T1562\"\r\n\"McAfee ePolicy Orchestrator\",\"b9d9fdfe-bc17-45ce-a70d-67a5cfd119f4\",\"McAfee ePO - File added to exceptions\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"bd3cedc3-efba-455a-85bd-0cf9ac1b0727\",\"McAfee ePO - Firewall disabled\",\"DefenseEvasion CommandAndControl\",\"T1562 T1071\"\r\n\"McAfee ePolicy Orchestrator\",\"0c9243d6-d2ec-48e1-8593-e713859c8f3c\",\"McAfee ePO - Logging error occurred\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"f53e5168-afdb-4fad-b29a-bb9cb71ec460\",\"McAfee ePO - Multiple threats on same host\",\"InitialAccess Persistence DefenseEvasion PrivilegeEscalation\",\"T1562 T1070 T1189 T1195 T1543 T1055\"\r\n\"McAfee ePolicy Orchestrator\",\"5223c1b8-75ef-4019-9076-a19b1ef3e5d1\",\"McAfee ePO - Scanning engine disabled\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"ffc9052b-3658-4ad4-9003-0151515fde15\",\"McAfee ePO - Spam Email detected\",\"InitialAccess\",\"T1566\"\r\n\"McAfee ePolicy Orchestrator\",\"3e397e31-7964-417e-a3e0-0acfaa2056f4\",\"McAfee ePO - Task error\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"6d70a26a-c119-45b7-b4c6-44ac4fd1bcb7\",\"McAfee ePO - Threat was not blocked\",\"InitialAccess PrivilegeEscalation DefenseEvasion\",\"T1562 T1070 T1068 T1189 T1195\"\r\n\"McAfee ePolicy Orchestrator\",\"9860e89f-72c8-425e-bac9-4a170798d3ea\",\"McAfee ePO - Unable to clean or delete infected file\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"4f0c91c3-1690-48f0-b538-4282dd5417a4\",\"McAfee ePO - Update failed\",\"DefenseEvasion\",\"T1562 T1070\"\r\n\"Microsoft 365\",\"bff058b2-500e-4ae5-bb49-a5b1423cbd5b\",\"Accessed files shared by temporary external user\",\"InitialAccess\",\"T1566\"\r\n\"Microsoft 365\",\"bff093b2-500e-4ae5-bb49-a5b1423cbd5b\",\"External user added and removed in short timeframe\",\"Persistence\",\"T1136\"\r\n\"Microsoft 365\",\"04384937-e927-4595-8f3c-89ff58ed231f\",\"Possible Forest Blizzard attempted credential harvesting - Sept 2020\",,\r\n\"Microsoft 365\",\"b4ceb583-4c44-4555-8ecf-39f572e827ba\",\"Exchange workflow MailItemsAccessed operation anomaly\",\"Collection\",\"T1114\"\r\n\"Microsoft 365\",\"500415fb-bba7-4227-a08a-9857fb61b6a7\",\"Mail redirect via ExO transport rule\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Microsoft 365\",\"7b907bf7-77d4-41d0-a208-5643ff75bf9a\",\"Malicious Inbox Rule\",\"Persistence DefenseEvasion\",\"T1098 T1078\"\r\n\"Microsoft 365\",\"173f8699-6af5-484a-8b06-8c47ba89b380\",\"Multiple Teams deleted by a single user\",\"Impact\",\"T1485 T1489\"\r\n\"Microsoft 365\",\"871ba14c-88ef-48aa-ad38-810f26760ca3\",\"Multiple users email forwarded to same destination\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Microsoft 365\",\"d722831e-88f5-4e25-b106-4ef6e29f8c13\",\"New executable via Office FileUploaded Operation\",\"CommandAndControl LateralMovement\",\"T1105 T1570\"\r\n\"Microsoft 365\",\"957cb240-f45d-4491-9ba5-93430a3c08be\",\"Rare and potentially high-risk Office operations\",\"Persistence Collection\",\"T1098 T1114\"\r\n\"Microsoft 365\",\"4b11568b-3f5f-4ba1-80c8-7f1dc8390eb7\",\"SharePointFileOperation via previously unseen IPs\",\"Exfiltration\",\"T1030\"\r\n\"Microsoft 365\",\"5dd76a87-9f87-4576-bab3-268b0e2b338b\",\"SharePointFileOperation via devices with previously unseen user agents\",\"Exfiltration\",\"T1030\"\r\n\"Microsoft 365\",\"194dd92e-d6e7-4249-85a5-273350a7f5ce\",\"Exchange AuditLog Disabled\",\"DefenseEvasion\",\"T1562\"\r\n\"Microsoft 365\",\"fbd72eb8-087e-466b-bd54-1ca6ea08c6d3\",\"Office Policy Tampering\",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"Microsoft 365\",\"8b4f03e7-3460-4401-824d-e65a8dd464f0\",\"Office365 Sharepoint File transfer above threshold\",\"Exfiltration\",\"T1020\"\r\n\"Microsoft 365\",\"8a547285-801c-4290-aa2e-5e7e20ca157d\",\"Office365 Sharepoint File transfer above threshold\",\"Exfiltration\",\"T1020\"\r\n\"Microsoft Defender XDR\",\"7ce00cba-f76f-4026-ab7f-7e4f1b67bd18\",\"C2-NamedPipe\",\"CommandAndControl\",\"T1105\"\r\n\"Microsoft Defender XDR\",\"1be34fb9-f81b-47ae-84fb-465e6686d76c\",\"DopplePaymer Procdump\",\"CredentialAccess\",\"T1003\"\r\n\"Microsoft Defender XDR\",\"c332b840-61e4-462e-a201-0e2d69bad45d\",\"LSASS Credential Dumping with Procdump\",\"CredentialAccess\",\"T1003\"\r\n\"Microsoft Defender XDR\",\"5bdc1504-880c-4b30-a39c-7c746535928d\",\"Doppelpaymer Stop Services\",\"Execution DefenseEvasion\",\"T1059 T1562\"\r\n\"Microsoft Defender XDR\",\"47c02e21-3949-4e05-a28e-576cd75ff6f6\",\"Qakbot Campaign Self Deletion\",\"DefenseEvasion\",\"T1070\"\r\n\"Microsoft Defender XDR\",\"36fbd4e7-5630-4414-aa42-702a7fdded21\",\"Regsvr32 Rundll32 Image Loads Abnormal Extension\",\"DefenseEvasion\",\"T1218.010 T1218.011\"\r\n\"Microsoft Defender XDR\",\"2624fc55-0998-4897-bb48-1c6422befce4\",\"Regsvr32 Rundll32 with Anomalous Parent Process\",\"DefenseEvasion\",\"T1218.010 T1218.011\"\r\n\"Microsoft Defender XDR\",\"fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7\",\"Detect Suspicious Commands Initiated by Webserver Processes\",\"Execution DefenseEvasion Discovery\",\"T1059 T1574 T1087 T1082\"\r\n\"Microsoft Defender XDR\",\"2a1dc4c2-a8d6-4a0e-8539-9b971c851195\",\"Bitsadmin Activity\",\"Persistence CommandAndControl Exfiltration\",\"T1197 T1105 T1048\"\r\n\"Microsoft Defender XDR\",\"174de33b-107b-4cd8-a85d-b4025a35453f\",\"Office Apps Launching Wscipt\",\"Execution Collection CommandAndControl\",\"T1059 T1105 T1203\"\r\n\"Microsoft Defender XDR\",\"12134de5-361b-427c-a1a0-d43f40a593c4\",\"Detect Potential Kerberoast Activities\",\"CredentialAccess\",\"T1558.003\"\r\n\"Microsoft Defender XDR\",\"3ab04acf-e0e7-4f7c-8995-748ab4c848c2\",\"Files Copied to USB Drives\",\"Exfiltration\",\"T1041\"\r\n\"Microsoft Defender XDR\",\"506f4d6b-3864-4bb1-8f75-a13fb066f97a\",\"MosaicLoader\",\"DefenseEvasion\",\"T1562\"\r\n\"Microsoft Defender XDR\",\"e5f8e196-3544-4a8b-96a9-17c1b6a49710\",\"Unusual Volume of file deletion by users\",\"Impact\",\"T1485\"\r\n\"Microsoft Defender XDR\",\"35ab0d58-baab-4154-87ed-fa2f69797e9e\",\"Remote File Creation with PsExec\",\"LateralMovement\",\"T1570\"\r\n\"Microsoft Defender XDR\",\"d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a\",\"Service Accounts Performing Remote PS\",\"LateralMovement\",\"T1210\"\r\n\"Microsoft Defender XDR\",\"450f4e56-5bba-4070-b9d9-9204ba9d777d\",\"Account Creation\",\"Persistence\",\"T1136\"\r\n\"Microsoft Defender XDR\",\"63aa43c2-e88e-4102-aea5-0432851c541a\",\"Local Admin Group Changes\",\"Persistence\",\"T1098\"\r\n\"Microsoft Defender XDR\",\"91a451e3-178f-41b2-9e5d-da97d75b9971\",\"Rare Process as a Service\",\"Persistence\",\"T1543 T1543.003\"\r\n\"Microsoft Defender XDR\",\"32b29155-3fd3-4a9e-a0ca-a67e2593b60b\",\"Disabling Security Services via Registry\",\"DefenseEvasion\",\"T1562\"\r\n\"Microsoft Defender XDR\",\"03caa992-477f-4b19-8e2a-8cd58f8f9652\",\"Deletion of data on multiple drives using cipher exe\",\"Impact\",\"T1485\"\r\n\"Microsoft Defender XDR\",\"7d0d3050-8dac-4b83-bfae-902f7dc0c21c\",\"LaZagne Credential Theft\",\"CredentialAccess\",\"T1003\"\r\n\"Microsoft Defender XDR\",\"515d0bba-b297-4f83-8280-20ff7f27ecb1\",\"Clearing of forensic evidence from event logs using wevtutil\",\"DefenseEvasion\",\"T1070\"\r\n\"Microsoft Defender XDR\",\"4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77\",\"Stopping multiple processes using taskkill\",\"DefenseEvasion\",\"T1562\"\r\n\"Microsoft Defender XDR\",\"4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d\",\"Potential Ransomware activity related to Cobalt Strike\",\"Execution Persistence DefenseEvasion Impact\",\"T1059 T1078 T1070 T1490\"\r\n\"Microsoft Defender XDR\",\"ba9db6b2-3d05-42ae-8aee-3a15bbe29f27\",\"Qakbot Discovery Activies\",\"DefenseEvasion Discovery Execution\",\"T1140 T1010 T1059\"\r\n\"Microsoft Defender XDR\",\"28c63a44-2d35-48b7-831b-3ed24af17c7e\",\"Shadow Copy Deletions\",\"Impact\",\"T1490\"\r\n\"Microsoft Defender XDR\",\"3bd33158-3f0b-47e3-a50f-7c20a1b88038\",\"AV detections related to SpringShell Vulnerability\",\"InitialAccess\",\"T1190\"\r\n\"Microsoft Defender XDR\",\"1785d372-b9fe-4283-96a6-3a1d83cabfd1\",\"AV detections related to Tarrask malware\",\"Persistence\",\"T1053\"\r\n\"Microsoft Defender XDR\",\"b6685757-3ed1-4b05-a5bd-2cacadc86c2a\",\"AV detections related to Ukraine threats\",\"Impact\",\"T1485\"\r\n\"Microsoft Defender XDR\",\"6c3a1258-bcdd-4fcd-b753-1a9bc826ce12\",\"Possible Phishing with CSL and Network Sessions\",\"InitialAccess CommandAndControl\",\"T1566 T1102\"\r\n\"Microsoft Defender XDR\",\"26e81021-2de6-4442-a74a-a77885e96911\",\"Execution of software vulnerable to webp buffer overflow of CVE-2023-4863\",\"Execution\",\"T1203\"\r\n\"Microsoft Defender XDR\",\"1bf6e165-5e32-420e-ab4f-0da8558a8be2\",\"Potential Build Process Compromise - MDE\",\"Persistence\",\"T1554\"\r\n\"Microsoft Defender XDR\",\"53e936c6-6c30-4d12-8343-b8a0456e8429\",\"SUNSPOT malware hashes\",\"Persistence\",\"T1554\"\r\n\"Microsoft Defender XDR\",\"a3c144f9-8051-47d4-ac29-ffb0c312c910\",\"SUNBURST and SUPERNOVA backdoor hashes\",\"Execution Persistence InitialAccess\",\"T1195 T1059 T1546\"\r\n\"Microsoft Defender XDR\",\"ce1e7025-866c-41f3-9b08-ec170e05e73e\",\"SUNBURST network beacons\",\"Execution Persistence InitialAccess\",\"T1195 T1059 T1546\"\r\n\"Microsoft Defender XDR\",\"738702fd-0a66-42c7-8586-e30f0583f8fe\",\"TEARDROP memory-only dropper\",\"Execution Persistence DefenseEvasion\",\"T1543 T1059 T1027\"\r\n\"Microsoft Defender for Cloud Apps\",\"b9e3b9f8-a406-4151-9891-e5ff1ddd8c1d\",\"Linked Malicious Storage Artifacts\",\"CommandAndControl Exfiltration\",\"T1071 T1567\"\r\n\"Microsoft Defender for Cloud\",\"011c84d8-85f0-4370-b864-24c13455aa94\",\"Detect CoreBackUp Deletion Activity from related Security Alerts\",\"Impact\",\"T1496\"\r\n\"Microsoft Entra ID Protection\",\"a3df4a32-4805-4c6d-8699-f3c888af2f67\",\"Correlate Unfamiliar sign-in properties & atypical travel alerts\",\"InitialAccess\",\"T1078\"\r\n\"Microsoft Entra ID\",\"95dc4ae3-e0f2-48bd-b996-cdd22b90f9af\",\"Modified domain federation trust settings\",\"CredentialAccess\",\r\n\"Microsoft Entra ID\",\"5533fe80-905e-49d5-889a-df27d2c3976d\",\"Password spray attack against ADFSSignInLogs\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"6d63efa6-7c25-4bd4-a486-aa6bf50fde8a\",\"Account created or deleted by non-approved user\",\"InitialAccess\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"bb616d82-108f-47d3-9dec-9652ea0d3bf6\",\"Account Created and Deleted in Short Timeframe\",\"InitialAccess\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"f80d951a-eddc-4171-b9d0-d616bb83efdc\",\"Admin promotion after Role Management Application Permission Grant\",\"PrivilegeEscalation Persistence\",\"T1098.003 T1078.004\"\r\n\"Microsoft Entra ID\",\"7cb8f77d-c52f-4e46-b82f-3cf2e106224a\",\"Anomalous sign-in location by user account and authenticating application\",\"InitialAccess\",\"T1078\"\r\n\"Microsoft Entra ID\",\"694c91ee-d606-4ba9-928e-405a2dd0ff0f\",\"Authentication Methods Changed for Privileged Account\",\"Persistence\",\"T1098\"\r\n\"Microsoft Entra ID\",\"50574fac-f8d1-4395-81c7-78a463ff0c52\",\"Microsoft Entra ID PowerShell accessing non-Entra ID resources\",\"InitialAccess\",\"T1078\"\r\n\"Microsoft Entra ID\",\"1ff56009-db01-4615-8211-d4fda21da02d\",\"Microsoft Entra ID Role Management Permission Grant\",\"Persistence Impact\",\"T1098.003 T1078.004\"\r\n\"Microsoft Entra ID\",\"87210ca1-49a4-4a7d-bb4a-4988752f978c\",\"Azure Portal sign in from another Azure Tenant\",\"InitialAccess\",\"T1199\"\r\n\"Microsoft Entra ID\",\"97ad74c4-fdd9-4a3f-b6bf-5e28f4f71e06\",\"Brute Force Attack against GitHub Account\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"3fbc20a4-04c4-464e-8fcb-6667f53e4987\",\"Brute force attack against a Cloud PC\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"218f60de-c269-457a-b882-9966632b9dc6\",\"Bulk Changes to Privileged Account Permissions\",\"PrivilegeEscalation\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"3af9285d-bb98-4a35-ad29-5ea39ba0c628\",\"Attempt to bypass conditional access rule in Microsoft Entra ID\",\"InitialAccess Persistence\",\"T1078 T1098\"\r\n\"Microsoft Entra ID\",\"707494a5-8e44-486b-90f8-155d1797a8eb\",\"Credential added after admin consented to Application\",\"CredentialAccesstags Solorigate NOBELIUM\",\r\n\"Microsoft Entra ID\",\"757e6a79-6d23-4ae6-9845-4dac170656b5\",\"Cross-tenant Access Settings Organization Added\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"eb8a9c1c-f532-4630-817c-1ecd8a60ed80\",\"Cross-tenant Access Settings Organization Deleted\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"c895c5b9-0fc6-40ce-9830-e8818862f2d5\",\"Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"276d5190-38de-4eb2-9933-b3b72f4a5737\",\"Cross-tenant Access Settings Organization Inbound Direct Settings Changed\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"229f71ba-d83b-42a5-b83b-11a641049ed1\",\"Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"0101e08d-99cd-4a97-a9e0-27649c4369ad\",\"Cross-tenant Access Settings Organization Outbound Direct Settings Changed\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"75ea5c39-93e5-489b-b1e1-68fa6c9d2d04\",\"Attempts to sign in to disabled accounts\",\"InitialAccess\",\"T1078\"\r\n\"Microsoft Entra ID\",\"bfb1c90f-8006-4325-98be-c7fffbc254d6\",\"Distributed Password cracking attempts in Microsoft Entra ID\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"54e22fed-0ec6-4fb2-8312-2a3809a93f63\",\"full_access_as_app Granted To Application\",\"DefenseEvasion\",\"T1550.001\"\r\n\"Microsoft Entra ID\",\"a22740ec-fc1e-4c91-8de6-c29c6450ad00\",\"Explicit MFA Deny\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"223db5c1-1bf8-47d8-8806-bed401b356a4\",\"Failed login attempts to Azure Portal\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"2cfc3c6e-f424-4b88-9cc9-c89f482d016a\",\"First access credential added to Application or Service Principal where no credential was present\",\"DefenseEvasion\",\"T1550.001\"\r\n\"Microsoft Entra ID\",\"6ab1f7b2-61b8-442f-bc81-96afe7ad8c53\",\"Guest accounts added in Entra ID Groups other than the ones specified\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"d99cf5c3-d660-436c-895b-8a8f8448da23\",\"MFA Rejected by User\",\"InitialAccess\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"a8cc6d5c-4e7e-4b48-b4ac-d8a116c62a8b\",\"MFA Spamming followed by Successful login\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"2560515c-07d1-434e-87fb-ebe3af267760\",\"Mail.Read Permissions Granted to Application\",\"Persistence\",\"T1098\"\r\n\"Microsoft Entra ID\",\"f948a32f-226c-4116-bddd-d95e91d97eb9\",\"Suspicious application consent similar to O365 Attack Toolkit\",\"CredentialAccess DefenseEvasion\",\"T1528 T1550\"\r\n\"Microsoft Entra ID\",\"39198934-62a0-4781-8416-a81265c03fd6\",\"Suspicious application consent similar to PwnAuth\",\"CredentialAccess DefenseEvasion\",\"T1528 T1550\"\r\n\"Microsoft Entra ID\",\"cda5928c-2c1e-4575-9dfa-07568bc27a4f\",\"Multiple admin membership removals from newly created admin.\",\"Impact\",\"T1531\"\r\n\"Microsoft Entra ID\",\"8540c842-5bbc-4a24-9fb2-a836c0e55a51\",\"NRT Modified domain federation trust settings\",\"CredentialAccess\",\r\n\"Microsoft Entra ID\",\"29e99017-e28d-47be-8b9a-c8c711f8a903\",\"NRT Authentication Methods Changed for VIP Users\",\"Persistence\",\"T1098\"\r\n\"Microsoft Entra ID\",\"e42e889a-caaf-4dbb-aec6-371b37d64298\",\"NRT New access credential added to Application or Service Principal\",\"DefenseEvasion\",\"T1550\"\r\n\"Microsoft Entra ID\",\"5db427b2-f406-4274-b413-e9fcb29412f8\",\"NRT PIM Elevation Request Rejected\",\"Persistence\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"14f6da04-2f96-44ee-9210-9ccc1be6401e\",\"NRT Privileged Role Assigned Outside PIM\",\"PrivilegeEscalation\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"70fc7201-f28e-4ba7-b9ea-c04b96701f13\",\"NRT User added to Microsoft Entra ID Privileged Groups\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Microsoft Entra ID\",\"79566f41-df67-4e10-a703-c38a6213afd8\",\"New access credential added to Application or Service Principal\",\"DefenseEvasion\",\"T1550.001\"\r\n\"Microsoft Entra ID\",\"4f42b94f-b210-42d1-a023-7fa1c51d969f\",\"New onmicrosoft domain added to tenant\",\"ResourceDevelopment\",\"T1585.003\"\r\n\"Microsoft Entra ID\",\"7d7e20f8-3384-4b71-811c-f5e950e8306c\",\"PIM Elevation Request Rejected\",\"Persistence\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"fa00014c-c5f4-4715-8f5b-ba567e19e41e\",\"Possible SignIn from Azure Backdoor\",\"Persistence\",\"T1098\"\r\n\"Microsoft Entra ID\",\"34c5aff9-a8c2-4601-9654-c7e46342d03b\",\"Privileged Accounts - Sign in Failure Spikes\",\"InitialAccess\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"269435e3-1db8-4423-9dfc-9bf59997da1c\",\"Privileged Role Assigned Outside PIM\",\"PrivilegeEscalation\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"83ba3057-9ea3-4759-bf6a-933f2e5bc7ee\",\"Rare application consent\",\"Persistence PrivilegeEscalation\",\"T1136 T1068\"\r\n\"Microsoft Entra ID\",\"fb7ca1c9-e14c-40a3-856e-28f3c14ea1ba\",\"Password spray attack against Microsoft Entra ID Seamless SSO\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"d3980830-dd9d-40a5-911f-76b44dfdce16\",\"GitHub Signin Burst from Multiple Locations\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"500c103a-0319-4d56-8e99-3cec8d860757\",\"Sign-ins from IPs that attempt sign-ins to disabled accounts\",\"InitialAccess Persistence\",\"T1078 T1098\"\r\n\"Microsoft Entra ID\",\"28b42356-45af-40a6-a0b4-a554cdfd5d8a\",\"Brute force attack against Azure Portal\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"48607a29-a26a-4abf-8078-a06dbdd174a4\",\"Password spray attack against Microsoft Entra ID application\",\"CredentialAccess\",\"T1110\"\r\n\"Microsoft Entra ID\",\"02ef8d7e-fc3a-4d86-a457-650fa571d8d2\",\"Successful logon from IP and failure from a different IP\",\"CredentialAccess InitialAccess\",\"T1110 T1078\"\r\n\"Microsoft Entra ID\",\"3a3c6835-0086-40ca-b033-a93bf26d878f\",\"Suspicious Entra ID Joined Device Update\",\"CredentialAccess\",\"T1528\"\r\n\"Microsoft Entra ID\",\"3533f74c-9207-4047-96e2-0eb9383be587\",\"Suspicious application consent for offline access\",\"CredentialAccess\",\"T1528\"\r\n\"Microsoft Entra ID\",\"6852d9da-8015-4b95-8ecf-d9572ee0395d\",\"Suspicious Service Principal creation activity\",\"CredentialAccess PrivilegeEscalation InitialAccess\",\"T1078 T1528\"\r\n\"Microsoft Entra ID\",\"aec77100-25c5-4254-a20a-8027ed92c46c\",\"Suspicious Sign In Followed by MFA Modification\",\"InitialAccess DefenseEvasion\",\"T1078.004 T1556.006\"\r\n\"Microsoft Entra ID\",\"acc4c247-aaf7-494b-b5da-17f18863878a\",\"External guest invitation followed by Microsoft Entra ID PowerShell signin\",\"InitialAccess Persistence Discovery\",\"T1078.004 T1136.003 T1087.004\"\r\n\"Microsoft Entra ID\",\"3a9d5ede-2b9d-43a2-acc4-d272321ff77c\",\"User Accounts - Sign in Failure due to CA Spikes\",\"InitialAccess\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"746ddb63-f51b-4563-b449-a8b13cf302ec\",\"User Assigned New Privileged Role\",\"Persistence\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"050b9b3d-53d0-4364-a3da-1b678b8211ec\",\"New User Assigned to Privileged Role\",\"Persistence\",\"T1078.004\"\r\n\"Microsoft Entra ID\",\"4d94d4a9-dc96-410a-8dea-4d4d4584188b\",\"User added to Microsoft Entra ID Privileged Groups\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Microsoft Entra ID\",\"b6988c32-4f3b-4a45-8313-b46b33061a74\",\"NRT First access credential added to Application or Service Principal where no credential was present\",\"DefenseEvasion\",\"T1550.001\"\r\n\"Microsoft Exchange Security - Exchange On-Premises\",\"5170c3c4-b8c9-485c-910d-a21d965ee181\",\"VIP Mailbox manipulation\",\"Exfiltration Persistence Collection\",\"T1020 T1098 T1114\"\r\n\"Microsoft Exchange Security - Exchange On-Premises\",\"7bce901b-9bc8-4948-8dfc-8f68878092d5\",\"Server Oriented Cmdlet And User Oriented Cmdlet used\",\"Exfiltration Persistence Collection\",\"T1020 T1098 T1114\"\r\n\"Microsoft Purview\",\"7ae7e8b0-07e9-43cb-b783-b04082f09060\",\"Sensitive Data Discovered in the Last 24 Hours\",\"Discovery\",\"T1087\"\r\n\"Microsoft Purview\",\"79f296d9-e6e4-45dc-9ca7-1770955435fa\",\"Sensitive Data Discovered in the Last 24 Hours - Customized\",\"Discovery\",\"T1087\"\r\n\"MicrosoftDefenderForEndpoint\",\"18dbdc22-b69f-4109-9e39-723d9465f45f\",\"Aqua Blizzard AV hits - Feb 2022\",\"Persistence\",\"T1137\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"a4fb4255-f55b-4c24-b396-976ee075d406\",\"Insider Risk_High User Security Alert Correlations\",\"Execution\",\"T1204\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"28a75d10-9b75-4192-9863-e452c3ad24db\",\"Insider Risk_High User Security Incidents Correlation\",\"Execution\",\"T1204\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"69660e65-0e5c-4700-8b99-5caf59786606\",\"Insider Risk_Microsoft Purview Insider Risk Management Alert Observed\",\"Execution\",\"T1204\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"b81ed294-28cf-48c3-bac8-ac60dcef293b\",\"Insider Risk_Sensitive Data Access Outside Organizational Geo-location\",\"Exfiltration\",\"T1567\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"15386bba-dc70-463f-a09f-d392e7731c63\",\"Insider Risk_Risky User Access By Application\",\"Execution\",\"T1204\"\r\n\"MimecastAudit\",\"9c5dcd76-9f6d-42a3-b984-314b52678f20\",\"Mimecast Audit - Logon Authentication Failed\",\"Discovery InitialAccess CredentialAccess\",\"T1110\"\r\n\"MimecastSEG\",\"1818aeaa-4cc8-426b-ba54-539de896d299\",\"Mimecast Data Leak Prevention - Notifications\",\"Exfiltration\",\"T1030\"\r\n\"MimecastSEG\",\"3e12b7b1-75e5-497c-ba01-b6cb30b60d7f\",\"Mimecast Data Leak Prevention - Hold\",\"Exfiltration\",\"T1030\"\r\n\"MimecastSEG\",\"0f0dc725-29dc-48c3-bf10-bd2f34fd1cbb\",\"Mimecast Secure Email Gateway - AV\",\"Execution\",\"T1053\"\r\n\"MimecastSEG\",\"72264f4f-61fb-4f4f-96c4-635571a376c2\",\"Mimecast Secure Email Gateway - Attachment Protect\",\"Collection Exfiltration Discovery InitialAccess Execution\",\"T1114 T1566 T0865\"\r\n\"MimecastSEG\",\"7034abc9-6b66-4533-9bf3-056672fd9d9e\",\"Mimecast Secure Email Gateway - Impersonation Protect\",\"Discovery LateralMovement Collection\",\"T1114\"\r\n\"MimecastSEG\",\"5b66d176-e344-4abf-b915-e5f09a6430ef\",\"Mimecast Secure Email Gateway - Internal Email Protect\",\"LateralMovement Persistence Exfiltration\",\"T1534 T1546\"\r\n\"MimecastSEG\",\"df1b9377-5c29-4928-872f-9934a6b4f611\",\"Mimecast Secure Email Gateway - Spam Event Thread\",\"Discovery\",\"T1083\"\r\n\"MimecastSEG\",\"ea19dae6-bbb3-4444-a1b8-8e9ae6064aab\",\"Mimecast Secure Email Gateway - URL Protect\",\"InitialAccess Discovery Execution\",\"T1566\"\r\n\"MimecastSEG\",\"30f73baa-602c-4373-8f02-04ff5e51fc7f\",\"Mimecast Secure Email Gateway - Virus\",\"Execution\",\"T1053\"\r\n\"MimecastTTP\",\"aa75944c-a663-4901-969e-7b55bfa49a73\",\"Mimecast Targeted Threat Protection - Attachment Protect\",\"InitialAccess Discovery\",\"T0865\"\r\n\"MimecastTTP\",\"d8e7eca6-4b59-4069-a31e-a022b2a12ea4\",\"Mimecast Targeted Threat Protection - Impersonation Protect\",\"Exfiltration Collection Discovery\",\"T1114\"\r\n\"MimecastTTP\",\"9d5545bd-1450-4086-935c-62f15fc4a4c9\",\"Mimecast Targeted Threat Protection - URL Protect\",\"InitialAccess Discovery\",\"T0865\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"1f40ed57-f54b-462f-906a-ac3a89cc90d4\",\"Cross-Cloud Password Spray detection\",\"CredentialAccess\",\"T1110\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"5c847e47-0a07-4c01-ab99-5817ad6cb11e\",\"Cross-Cloud Suspicious Compute resource creation in GCP\",\"InitialAccess Execution Persistence PrivilegeEscalation CredentialAccess Discovery LateralMovement\",\"T1566 T1059 T1078 T1547 T1548 T1069 T1552\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"58e306fe-1c49-4b8f-9b0e-15f25e8f0cd7\",\"Cross-Cloud Suspicious user activity observed in GCP Envourment\",\"InitialAccess Execution Persistence PrivilegeEscalation CredentialAccess Discovery\",\"T1566 T1059 T1078 T1046 T1547 T1548 T1069 T1552\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"122fbc6a-57ab-4aa7-b9a9-51ac4970cac1\",\"Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login\",\"CredentialAccess InitialAccess\",\"T1557 T1110 T1110.003 T1110.004 T1606 T1556 T1133\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"188db479-d50a-4a9c-a041-644bae347d1f\",\"Successful AWS Console Login from IP Address Observed Conducting Password Spray\",\"InitialAccess CredentialAccess\",\"T1110 T1078\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"b51fe620-62ad-4ed2-9d40-5c97c0a8231f\",\"Suspicious AWS console logins by credential access alerts\",\"InitialAccess CredentialAccess\",\"T1078\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"60f31001-018a-42bf-8045-a92e1f361b7b\",\"Unauthorized user access across AWS and Azure\",\"CredentialAccess Exfiltration Discovery\",\"T1557 T1110 T1110.003 T1110.004 T1212 T1048 T1087 T1580\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"11c3d541-5fa5-49df-8218-d1c98584473b\",\"User impersonation by Identity Protection alerts\",\"PrivilegeEscalation\",\"T1134\"\r\n\"Multi Cloud Attack Coverage Essentials - Resource Abuse\",\"f4a28082-2808-4783-9736-33c1ae117475\",\"High-Risk Cross-Cloud User Impersonation\",\"PrivilegeEscalation\",\"T1134 T1078.002 T1078.004\"\r\n\"NGINX HTTP Server\",\"d84739ce-2f46-4391-b25e-a2edbea19d7e\",\"NGINX - Command in URI\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec\",\"NGINX - Core Dump\",\"Impact\",\"T1499\"\r\n\"NGINX HTTP Server\",\"83a0b48f-1cb7-4b4f-a018-23c3203a239b\",\"NGINX - Multiple user agents for single source\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"a10c6551-bbf2-492c-aa8a-fe6efd8c9cc1\",\"NGINX - Known malicious user agent\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"42771afe-edb3-4330-bc4a-abf6a5714454\",\"NGINX - Multiple client errors from single IP address\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"b3ae0033-552e-4c3c-b493-3edffb4473bb\",\"NGINX - Multiple server errors from single IP address\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"NGINX HTTP Server\",\"1aa6bfed-f11b-402f-9007-0dccc1152ede\",\"NGINX - Private IP address in URL\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"e04fa38e-9fb7-438d-887a-381d5dd235e6\",\"NGINX - Put file and get file from same IP address\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"2141ef6c-d158-4d44-b739-b145a4c21947\",\"NGINX - Request to sensitive files\",\"InitialAccess\",\"T1189\"\r\n\"NGINX HTTP Server\",\"3bac451d-f919-4c92-9be7-694990e0ca4b\",\"NGINX - Sql injection patterns\",\"InitialAccess\",\"T1190\"\r\n\"NISTSP80053\",\"dd834c97-4638-4bb3-a4e3-807e8b0580dc\",\"NIST SP 800-53 Posture Changed\",\"Discovery\",\"T1082\"\r\n\"Nasuni\",\"6c8770fb-c854-403e-a64d-0293ba344d5f\",\"Ransomware Attack Detected\",\"Impact\",\"T1486\"\r\n\"Nasuni\",\"0c96a5a2-d60d-427d-8399-8df7fe8e6536\",\"Ransomware Client Blocked\",\"Impact\",\"T1486\"\r\n\"NetClean ProActive\",\"77548170-5c60-42e5-bdac-b0360d0779bb\",\"NetClean ProActive Incidents\",\"Discovery\",\"T1083\"\r\n\"Netskopev2\",\"66c4cd4c-d391-47e8-b4e6-93e55d86ca9f\",\"Netskope - WebTransaction Error Detection\",\"Execution\",\"T1204\"\r\n\"Network Session Essentials\",\"8717e498-7b5d-4e23-9e7c-fa4913dbfd79\",\"Anomaly in SMB Traffic(ASIM Network Session schema)\",\"LateralMovement\",\"T1021 T1021.002\"\r\n\"Network Session Essentials\",\"cd6def0d-3ef0-4d55-a7e3-faa96c46ba12\",\"Anomaly found in Network Session Traffic (ASIM Network Session schema)\",\"CommandAndControl Discovery Exfiltration LateralMovement\",\"T1095 T1071 T1046 T1030 T1210\"\r\n\"Network Session Essentials\",\"cbf07406-fa2a-48b0-82b8-efad58db14ec\",\"Detect port misuse by anomaly based detection (ASIM Network Session schema)\",\"CommandAndControl LateralMovement Execution InitialAccess\",\"T1095 T1059 T1203 T1190\"\r\n\"Network Session Essentials\",\"156997bd-da0f-4729-b47a-0a3e02dd50c8\",\"Detect port misuse by static threshold (ASIM Network Session schema)\",\"CommandAndControl Execution InitialAccess\",\"T1095 T1059 T1203 T1190\"\r\n\"Network Session Essentials\",\"4902eddb-34f7-44a8-ac94-8486366e9494\",\"Excessive number of failed connections from a single source (ASIM Network Session schema)\",\"Impact\",\"T1499\"\r\n\"Network Session Essentials\",\"cd8faa84-4464-4b4e-96dc-b22f50c27541\",\"Network Port Sweep from External Network (ASIM Network Session schema)\",\"Discovery\",\r\n\"Network Session Essentials\",\"1da9853f-3dea-4ea9-b7e5-26730da3d537\",\"Port scan detected  (ASIM Network Session schema)\",\"Discovery\",\"T1046\"\r\n\"Network Session Essentials\",\"fcb9d75c-c3c1-4910-8697-f136bfef2363\",\"Potential beaconing activity (ASIM Network Session schema)\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"Network Session Essentials\",\"b7dc801e-1e79-48bb-91e8-2229a8e6d40b\",\"Remote Desktop Network Brute force (ASIM Network Session schema)\",\"CredentialAccess\",\"T1110\"\r\n\"Network Threat Protection Essentials\",\"01f64465-b1ef-41ea-a7f5-31553a11ad43\",\"Network endpoint to host executable correlation\",\"Execution\",\"T1204\"\r\n\"Network Threat Protection Essentials\",\"b725d62c-eb77-42ff-96f6-bdc6745fc6e0\",\"New UserAgent observed in last 24 hours\",\"InitialAccess CommandAndControl Execution\",\"T1189 T1071 T1203\"\r\n\"Okta Single Sign-On\",\"e36c6bd6-f86a-4282-93a5-b4a1b48dd849\",\"Device Registration from Malicious IP\",\"Persistence\",\"T1098\"\r\n\"Okta Single Sign-On\",\"884be6e7-e568-418e-9c12-89229865ffde\",\"Failed Logins from Unknown or Invalid User\",\"CredentialAccess\",\"T1110\"\r\n\"Okta Single Sign-On\",\"9f82a735-ae43-4c03-afb4-d5d153e1ace1\",\"High-Risk Admin Activity\",\"Persistence\",\"T1098\"\r\n\"Okta Single Sign-On\",\"2954d424-f786-4677-9ffc-c24c44c6e7d5\",\"User Login from Different Countries within 3 hours\",\"InitialAccess\",\"T1078\"\r\n\"Okta Single Sign-On\",\"c2697b81-7fe9-4f57-ba1d-de46c6f91f9c\",\"MFA Fatigue (OKTA)\",\"CredentialAccess\",\"T1621\"\r\n\"Okta Single Sign-On\",\"41e843a8-92e7-444d-8d72-638f1145d1e1\",\"New Device/Location sign-in along with critical operation\",\"InitialAccess Persistence\",\"T1078 T1556\"\r\n\"Okta Single Sign-On\",\"e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508\",\"Potential Password Spray Attack\",\"CredentialAccess\",\"T1110\"\r\n\"Okta Single Sign-On\",\"78d2b06c-8dc0-40e1-91c8-66d916c186f3\",\"Okta Fast Pass phishing Detection\",\"InitialAccess\",\"T1566\"\r\n\"Okta Single Sign-On\",\"35846296-4052-4de2-8098-beb6bb5f2203\",\"User Session Impersonation(Okta)\",\"PrivilegeEscalation\",\"T1134 T1134.003\"\r\n\"Oracle Cloud Infrastructure\",\"61f995d7-8038-4ff0-ad2b-eccfd18fcc8c\",\"OCI - Discovery activity\",\"Discovery\",\"T1580\"\r\n\"Oracle Cloud Infrastructure\",\"31b15699-0b55-4246-851e-93f9cefb6f5c\",\"OCI - Event rule deleted\",\"DefenseEvasion\",\"T1070\"\r\n\"Oracle Cloud Infrastructure\",\"eb6e07a1-2895-4c55-9c27-ac84294f0e46\",\"OCI - Inbound SSH connection\",\"InitialAccess\",\"T1190\"\r\n\"Oracle Cloud Infrastructure\",\"9c4b1b9c-6462-41ce-8f2e-ce8c104331fc\",\"OCI - Insecure metadata endpoint\",\"Discovery\",\"T1069\"\r\n\"Oracle Cloud Infrastructure\",\"a55b4bbe-a014-4ae9-a50d-441ba5e98b65\",\"OCI - Instance metadata access\",\"Discovery\",\"T1069\"\r\n\"Oracle Cloud Infrastructure\",\"a79cf2b9-a511-4282-ba5d-812e14b07831\",\"OCI - Multiple instances launched\",\"Impact\",\"T1496\"\r\n\"Oracle Cloud Infrastructure\",\"252e651d-d825-480c-bdeb-8b239354577d\",\"OCI - Multiple instances terminated\",\"Impact\",\"T1529\"\r\n\"Oracle Cloud Infrastructure\",\"482c24b9-a700-4b2a-85d3-1c42110ba78c\",\"OCI - Multiple rejects on rare ports\",\"Reconnaissance\",\"T1595\"\r\n\"Oracle Cloud Infrastructure\",\"e087d4fb-af0b-4e08-a067-b9ba9e5f8840\",\"OCI - SSH scanner\",\"Reconnaissance\",\"T1595\"\r\n\"Oracle Cloud Infrastructure\",\"a0b9a7ca-3e6d-4996-ae35-759df1d67a54\",\"OCI - Unexpected user agent\",\"InitialAccess\",\"T1190\"\r\n\"OracleDatabaseAudit\",\"54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe\",\"OracleDBAudit - Connection to database from external IP\",\"InitialAccess Collection  Exfiltration\",\"T1190 T1133 T1078 T1119 T1029\"\r\n\"OracleDatabaseAudit\",\"b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f\",\"OracleDBAudit - Multiple tables dropped in short time\",\"Impact\",\"T1485\"\r\n\"OracleDatabaseAudit\",\"80b1dd6d-1aea-471e-be7a-a4a0afdeec80\",\"OracleDBAudit - Connection to database from unknown IP\",\"InitialAccess\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"39a0995e-f4a9-4869-a0ae-36d6d9049bfd\",\"OracleDBAudit - User connected to database from new IP\",\"InitialAccess\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"cca7b348-e904-4a7a-8f26-d22d4d477119\",\"OracleDBAudit - New user account\",\"InitialAccess Persistence\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e\",\"OracleDBAudit - Query on Sensitive Table\",\"Collection\",\r\n\"OracleDatabaseAudit\",\"5e93a535-036b-4570-9e58-d8992f30e1ae\",\"OracleDBAudit - User activity after long inactivity time\",\"InitialAccess Persistence\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"ab352f0d-7c55-4ab2-a22e-b1c2d995e193\",\"OracleDBAudit - SQL injection patterns\",\"InitialAccess\",\"T1190\"\r\n\"OracleDatabaseAudit\",\"75024e1c-26e7-4e73-821d-95e5decdd8db\",\"OracleDBAudit - Unusual user activity on multiple tables\",\"Collection\",\"T1119\"\r\n\"OracleDatabaseAudit\",\"27cc2cdc-ba67-4906-a6ef-ecbc9c284f4e\",\"OracleDBAudit - Shutdown Server\",\"Impact\",\"T1529\"\r\n\"OracleWebLogicServer\",\"6ae36a5e-573f-11ec-bf63-0242ac130002\",\"Oracle - Command in URI\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"44c7d12a-573f-11ec-bf63-0242ac130002\",\"Oracle - Multiple user agents for single source\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"67950168-5740-11ec-bf63-0242ac130002\",\"Oracle - Oracle WebLogic Exploit CVE-2021-2109\",\"InitialAccess\",\"T1190\"\r\n\"OracleWebLogicServer\",\"51d050ee-5740-11ec-bf63-0242ac130002\",\"Oracle - Malicious user agent\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"41775080-5740-11ec-bf63-0242ac130002\",\"Oracle - Multiple client errors from single IP\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"268f4fde-5740-11ec-bf63-0242ac130002\",\"Oracle - Multiple server errors from single IP\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"OracleWebLogicServer\",\"153ce6d8-5740-11ec-bf63-0242ac130002\",\"Oracle - Private IP in URL\",\"InitialAccess\",\"T1190  T1133\"\r\n\"OracleWebLogicServer\",\"033e98d2-5740-11ec-bf63-0242ac130002\",\"Oracle - Put file and get file from same IP address\",\"InitialAccess\",\"T1190  T1133\"\r\n\"OracleWebLogicServer\",\"edc2f2b4-573f-11ec-bf63-0242ac130002\",\"Oracle - Put suspicious file\",\"InitialAccess  Exfiltration\",\"T1190 T1133 T1048\"\r\n\"OracleWebLogicServer\",\"9cc9ed36-573f-11ec-bf63-0242ac130002\",\"Oracle - Request to sensitive files\",\"InitialAccess\",\"T1189\"\r\n\"PaloAlto-PAN-OS\",\"2be4ef67-a93f-4d8a-981a-88158cb73abd\",\"Microsoft COVID-19 file hash indicator matches\",\"Impact\",\r\n\"PaloAlto-PAN-OS\",\"f0be259a-34ac-4946-aa15-ca2b115d5feb\",\"Palo Alto - potential beaconing detected\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"PaloAlto-PAN-OS\",\"5b72f527-e3f6-4a00-9908-8e4fee14da9f\",\"Palo Alto - possible internal to external port scanning\",\"Discovery\",\"T1046\"\r\n\"PaloAlto-PAN-OS\",\"89a86f70-615f-4a79-9621-6f68c50f365f\",\"Palo Alto Threat signatures from Unusual IP addresses\",\"Discovery Exfiltration CommandAndControl\",\"T1046 T1030 T1071.001\"\r\n\"PaloAltoCDL\",\"976d2eee-51cb-11ec-bf63-0242ac130002\",\"PaloAlto - MAC address conflict\",\"InitialAccess\",\"T1190  T1133\"\r\n\"PaloAltoCDL\",\"ba663b74-51f4-11ec-bf63-0242ac130002\",\"PaloAlto - Dropping or denying session with traffic\",\"InitialAccess\",\"T1190  T1133\"\r\n\"PaloAltoCDL\",\"9150ad68-51c8-11ec-bf63-0242ac130002\",\"PaloAlto - File type changed\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"b2dd2dac-51c9-11ec-bf63-0242ac130002\",\"PaloAlto - Inbound connection to high risk ports\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"b6d54840-51d3-11ec-bf63-0242ac130002\",\"PaloAlto - Possible attack without response\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"feb185cc-51f4-11ec-bf63-0242ac130002\",\"PaloAlto - Possible flooding\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"3575a9c0-51c9-11ec-bf63-0242ac130002\",\"PaloAlto - Possible port scan\",\"Reconnaissance\",\"T1595\"\r\n\"PaloAltoCDL\",\"38f9e010-51ca-11ec-bf63-0242ac130002\",\"PaloAlto - User privileges was changed\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"f12e9d10-51ca-11ec-bf63-0242ac130002\",\"PaloAlto - Put and post method request in high risk file type\",\"InitialAccess\",\"T1190  T1133\"\r\n\"PaloAltoCDL\",\"9fcc7734-4d1b-11ec-81d3-0242ac130003\",\"PaloAlto - Forbidden countries\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoPrismaCloud\",\"777d4993-31bb-4d45-b949-84f58e09fa2f\",\"Palo Alto Prisma Cloud - Access keys are not rotated for 90 days\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"4264e133-eec2-438f-af85-05e869308f94\",\"Palo Alto Prisma Cloud - Network ACL allow all outbound traffic\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"df89f4bf-720e-41c5-a209-15e41e400d35\",\"Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"6098b34a-1e6b-440a-9e3b-fb4d5944ade1\",\"Palo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"bd602b90-f7f9-4ae9-bf8c-3672a24deb39\",\"Palo Alto Prisma Cloud - Anomalous access key usage\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"617b02d8-0f47-4f3c-afed-1926a45e7b28\",\"Palo Alto Prisma Cloud - High risk score alert\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"c5bf680f-fa37-47c3-9f38-e839a9b99c05\",\"Palo Alto Prisma Cloud - High severity alert opened for several days\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"ac76d9c0-17a3-4aaa-a341-48f4c0b1c882\",\"Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"7f78fa52-9833-41de-b5c5-76e61b8af9c1\",\"Palo Alto Prisma Cloud - Inactive user\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"119a574d-f37a-403a-a67a-4d6f5083d9cf\",\"Palo Alto Prisma Cloud - Maximum risk score alert\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"4f688252-bf9b-4136-87bf-d540b5be1050\",\"Palo Alto Prisma Cloud - Multiple failed logins for user\",\"CredentialAccess\",\"T1110\"\r\n\"PingFederate\",\"e45a7334-2cb4-4690-8156-f02cac73d584\",\"Ping Federate - Abnormal password reset attempts\",\"CredentialAccess\",\"T1110\"\r\n\"PingFederate\",\"30583ed4-d13c-43b8-baf2-d75fbe727210\",\"Ping Federate - Authentication from new IP.\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"14042f74-e50b-4c21-8a01-0faf4915ada4\",\"Ping Federate - Forbidden country\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"6145efdc-4724-42a6-9756-5bd1ba33982e\",\"Ping Federate - Abnormal password resets for user\",\"InitialAccess Persistence PrivilegeEscalation\",\"T1078  T1098  T1134\"\r\n\"PingFederate\",\"05282c91-7aaf-4d76-9a19-6dc582e6a411\",\"Ping Federate - New user SSO success login\",\"InitialAccess Persistence\",\"T1078  T1136\"\r\n\"PingFederate\",\"85f70197-4865-4635-a4b2-a9c57e8fea1b\",\"Ping Federate - OAuth old version\",\"InitialAccess\",\"T1190\"\r\n\"PingFederate\",\"2d201d21-77b4-4d97-95f3-26b5c6bde09f\",\"Ping Federate - Password reset request from unexpected source IP address\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"fddd3840-acd2-41ed-94d9-1474b0a7c8a6\",\"Ping Federate - SAML old version\",\"InitialAccess\",\"T1190\"\r\n\"PingFederate\",\"9578ef7f-cbb4-4e9a-bd26-37c15c53b413\",\"Ping Federate - Unexpected authentication URL\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"64e65105-c4fc-4c28-a4e9-bb1a3ce7652d\",\"Ping Federate - Unexpected country for user\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"dc79de7d-2590-4852-95fb-f8e02b34f4da\",\"Ping Federate - Unusual mail domain.\",\"InitialAccess\",\"T1078\"\r\n\"Prancer PenSuiteAI Integration\",\"8c484ef9-d758-4827-9920-f4f77158f03e\",\"Disks Alerts From Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"59336232-1bbc-4f66-90dd-5ac3708e4405\",\"Flow Logs Alerts for Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"a8babf91-b844-477c-8abf-d31e3df74933\",\"NetworkSecurityGroups Alert From Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"7caa1c03-d20b-42f2-ac95-5232f6e570da\",\"PAC high severity\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"08706063-c15e-4d96-beae-9e8d92ccefbb\",\"Registries Alerts for Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"bbeb2f26-cb99-4e4b-900f-24ce9809142d\",\"Sites Alerts for Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"4adf2b5d-6b88-4b96-8cc2-a3c7fbbee10b\",\"Storage Accounts Alerts From Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"10be8f37-d83c-4b7e-81c2-1271c51ac09f\",\"Subnets Alerts for Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"c13b025c-ea31-4e4b-8e08-955b8fa91fa0\",\"Virtual Machines Alerts for Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"0b76eef3-5dc0-41b1-9f67-fffa7783f5f6\",\"Vaults Alerts for Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"Prancer PenSuiteAI Integration\",\"6bd031cf-78d0-4edd-8191-60f84b6eef7a\",\"VirtualNetworkPeerings Alerts From Prancer\",\"Reconnaissance\",\"T1595\"\r\n\"ProofPointTap\",\"0558155e-4556-447e-9a22-828f2a7de06b\",\"Malware attachment delivered\",\"InitialAccess\",\"T1566.001\"\r\n\"ProofPointTap\",\"8675dd7a-795e-4d56-a79c-fc848c5ee61c\",\"Malware Link Clicked\",\"InitialAccess\",\"T1566.002\"\r\n\"Proofpoint On demand(POD) Email Security\",\"eb68b129-5f17-4f56-bf6d-dde48d5e615a\",\"ProofpointPOD - Binary file in attachment\",\"InitialAccess\",\"T1078\"\r\n\"Proofpoint On demand(POD) Email Security\",\"aedc5b33-2d7c-42cb-a692-f25ef637cbb1\",\"ProofpointPOD - Possible data exfiltration to private email\",\"InitialAccess\",\"T1078\"\r\n\"Proofpoint On demand(POD) Email Security\",\"78979d32-e63f-4740-b206-cfb300c735e0\",\"ProofpointPOD - Email sender IP in TI list\",\"Exfiltration InitialAccess\",\"T1078 T1567\"\r\n\"Proofpoint On demand(POD) Email Security\",\"35a0792a-1269-431e-ac93-7ae2980d4dde\",\"ProofpointPOD - Email sender in TI list\",\"Exfiltration InitialAccess\",\"T1078 T1567\"\r\n\"Proofpoint On demand(POD) Email Security\",\"c7cd6073-6d2c-4284-a5c8-da27605bdfde\",\"ProofpointPOD - High risk message not discarded\",\"InitialAccess\",\"T1566\"\r\n\"Proofpoint On demand(POD) Email Security\",\"bda5a2bd-979b-4828-a91f-27c2a5048f7f\",\"ProofpointPOD - Multiple archived attachments to the same recipient\",\"Exfiltration\",\"T1567\"\r\n\"Proofpoint On demand(POD) Email Security\",\"d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32\",\"ProofpointPOD - Multiple large emails to the same recipient\",\"Exfiltration\",\"T1567\"\r\n\"Proofpoint On demand(POD) Email Security\",\"f8127962-7739-4211-a4a9-390a7a00e91f\",\"ProofpointPOD - Multiple protected emails to unknown recipient\",\"Exfiltration\",\"T1567\"\r\n\"Proofpoint On demand(POD) Email Security\",\"f6a51e2c-2d6a-4f92-a090-cfb002ca611f\",\"ProofpointPOD - Suspicious attachment\",\"InitialAccess\",\"T1566\"\r\n\"Proofpoint On demand(POD) Email Security\",\"56b0a0cd-894e-4b38-a0a1-c41d9f96649a\",\"ProofpointPOD - Weak ciphers\",\"CommandandControl\",\"T1573\"\r\n\"Pulse Connect Secure\",\"34663177-8abf-4db1-b0a4-5683ab273f44\",\"PulseConnectSecure - Potential Brute Force Attempts\",\"CredentialAccess\",\"T1110\"\r\n\"Pulse Connect Secure\",\"1fa1528e-f746-4794-8a41-14827f4cb798\",\"PulseConnectSecure - Large Number of Distinct Failed User Logins\",\"CredentialAccess\",\"T1110\"\r\n\"Pure Storage\",\"c317b007-84e7-4449-93f4-4444f6638fd0\",\"Pure Controller Failed\",\"Execution\",\"T0871\"\r\n\"Pure Storage\",\"ed32b115-5001-43a7-a2bb-f53026db4d97\",\"Pure Failed Login\",\"CredentialAccess\",\"T1212\"\r\n\"QualysVM\",\"3edb7215-250b-40c0-8b46-79093949242d\",\"High Number of Urgent Vulnerabilities Detected\",\"InitialAccess\",\"T1190\"\r\n\"QualysVM\",\"6116dc19-475a-4148-84b2-efe89c073e27\",\"New High Severity Vulnerability Detected Across Multiple Hosts\",\"InitialAccess\",\"T1190\"\r\n\"Recorded Future\",\"a1c02815-4248-4728-a9ae-dac73c67db23\",\"Detection of Malware C2 Domains in DNS Events\",\"CommandAndControl\",\r\n\"Recorded Future\",\"dffd068f-fdab-440e-bbc0-34c14b623c89\",\"Detection of Malware C2 Domains in Syslog Events\",\"CommandAndControl\",\r\n\"Recorded Future\",\"388e197d-ec9e-46b6-addb-947d74d2a5c4\",\"Detection of Specific Hashes in CommonSecurityLog\",\"PreAttack\",\"T1587.001\"\r\n\"Recorded Future\",\"588dc717-7583-452c-a743-dee96705898e\",\"Detection of Malware C2 IPs in Azure Act. Events\",\"CommandAndControl\",\r\n\"Recorded Future\",\"22cc1dff-14ad-481d-97e1-0602895e429e\",\"Detection of Malware C2 IPs in DNS Events\",\"CommandAndControl\",\r\n\"Recorded Future\",\"9acb3664-72c4-4676-80fa-9f81912e347e\",\"Detection of Malicious URLs in Syslog Events\",\"Impact\",\r\n\"Red Canary\",\"6d263abb-6445-45cc-93e9-c593d3d77b89kind Scheduled\",\"Red Canary Threat Detection\",\"Collection CommandAndControl CredentialAccess DefenseEvasion Discovery Execution Exfiltration Impact InitialAccess LateralMovement Persistence PrivilegeEscalation\",\r\n\"RidgeSecurity\",\"1eebfaf3-40e1-4bc2-9f42-049b7b8ceb60\",\"Critical Risks\",\"Execution InitialAccess PrivilegeEscalation\",\"T1189 T1059 T1053 T1548\"\r\n\"RidgeSecurity\",\"d096643d-6789-4c74-8893-dd3fc8a94069\",\"Vulerabilities\",\"Execution InitialAccess PrivilegeEscalation\",\"T1189 T1059 T1053 T1548\"\r\n\"SailPointIdentityNow\",\"08330c3d-487e-4f5e-a539-1e7d06dea786\",\"SailPointIdentityNowAlertForTriggers\",\"InitialAccess Collection\",\"T1133 T1005\"\r\n\"SailPointIdentityNow\",\"48bb92e2-bad4-4fd4-9684-26cb188299b7\",\"SailPointIdentityNowEventType\",\"InitialAccess\",\"T1133\"\r\n\"SailPointIdentityNow\",\"2151e8ea-4838-4c74-be12-4d6a950dde7a\",\"SailPointIdentityNowEventTypeTechnicalName\",\"InitialAccess\",\"T1133\"\r\n\"SailPointIdentityNow\",\"c3835197-fd07-447e-a0ac-7540d51a1f64\",\"SailPointIdentityNowFailedEvents\",\"InitialAccess\",\"T1133\"\r\n\"SailPointIdentityNow\",\"175b79ef-0fc3-4b27-b92a-89b2db6c85c2\",\"SailPointIdentityNowFailedEventsBasedOnTime\",\"InitialAccess\",\"T1133\"\r\n\"SailPointIdentityNow\",\"2a215222-bfc5-4858-a530-6d4088ebfa15\",\"SailPointIdentityNowUserWithFailedEvent\",\"InitialAccess\",\"T1133\"\r\n\"Salesforce Service Cloud\",\"5a6ce089-e756-40fb-b022-c8e8864a973a\",\"Brute force attack against user credentials\",\"CredentialAccess\",\"T1110\"\r\n\"Salesforce Service Cloud\",\"64d16e62-1a17-4a35-9ea7-2b9fe6f07118\",\"Potential Password Spray Attack\",\"CredentialAccess\",\"T1110\"\r\n\"Salesforce Service Cloud\",\"3094e036-e5ae-4d6e-8626-b0f86ebc71f2\",\"User Sign in from different countries\",\"InitialAccess\",\"T1078\"\r\n\"SecurityBridge App\",\"8c5c766a-ce9b-4112-b6ed-1b8fe33733b7\",\"'SecurityBridge A critical event occured'\",\"InitialAccess\",\r\n\"SecurityThreatEssentialSolution\",\"16daa67c-b137-48dc-8eb7-76598a44791a\",\"Possible AiTM Phishing Attempt Against Microsoft Entra ID\",\"InitialAccess DefenseEvasion CredentialAccess\",\"T1078.004 T1557 T1111\"\r\n\"SecurityThreatEssentialSolution\",\"d7c575b2-84f5-48cb-92c5-70d7e8246284\",\"Threat Essentials - Mail redirect via ExO transport rule\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"SecurityThreatEssentialSolution\",\"199978c5-cd6d-4194-b505-8ef5800739df\",\"Threat Essentials - Multiple admin membership removals from newly created admin.\",\"Impact\",\"T1531\"\r\n\"SecurityThreatEssentialSolution\",\"0a627f29-f0dd-4924-be92-c3d6dac84367\",\"Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"SecurityThreatEssentialSolution\",\"b49a1093-cbf6-4973-89ac-2eef98f533c6\",\"Threat Essentials - Time series anomaly for data size transferred to public internet\",\"Exfiltration\",\"T1030\"\r\n\"SecurityThreatEssentialSolution\",\"fa2658fe-3714-4c55-bb12-2b7275c628e8\",\"Threat Essentials - Mass Cloud resource deletions Time Series Anomaly\",\"Impact\",\"T1485\"\r\n\"SecurityThreatEssentialSolution\",\"b09795c9-8dce-47ab-8f75-5a4afb78ef0c\",\"Threat Essentials - User Assigned Privileged Role\",\"Persistence\",\"T1078.004\"\r\n\"Semperis Directory Services Protector\",\"1a6d0a49-64b3-4ca1-96c3-f154c16c218c\",\"Semperis DSP Mimikatz's DCShadow Alert\",\"DefenseEvasion\",\"T1207\"\r\n\"Semperis Directory Services Protector\",\"9ff3b26b-7636-412e-ac46-072b084b94cb\",\"Semperis DSP Kerberos krbtgt account with old password\",\"CredentialAccess\",\r\n\"Semperis Directory Services Protector\",\"64796da3-6383-4de2-9c97-866c83c459ae\",\"Semperis DSP Recent sIDHistory changes on AD objects\",\"PrivilegeEscalation\",\r\n\"Semperis Directory Services Protector\",\"ddd75d93-5b8b-4349-babe-c4e15343c5a3\",\"Semperis DSP Well-known privileged SIDs in sIDHistory\",\"PrivilegeEscalation DefenseEvasion\",\"T1134\"\r\n\"Semperis Directory Services Protector\",\"85c1f9e4-6f14-46bf-82d5-dbe495b92aab\",\"Semperis DSP Zerologon vulnerability\",\"PrivilegeEscalation\",\r\n\"Semperis Directory Services Protector\",\"0e105444-fe13-4ce6-9239-21880076a3f9\",\"Semperis DSP Failed Logons\",,\r\n\"Semperis Directory Services Protector\",\"8f471e21-3bb2-466f-9bc2-0a0326a60788\",\"Semperis DSP Operations Critical Notifications\",,\r\n\"Semperis Directory Services Protector\",\"e5edf3f3-de53-45e6-b0d7-1ce1c048df4a\",\"Semperis DSP RBAC Changes\",,\r\n\"SenservaPro\",\"9a15c3dd-f72b-49a4-bcb7-94406395661e\",\"Azure secure score admin MFA\",\"Impact\",\"T1529 T1498\"\r\n\"SenservaPro\",\"56910d7b-aae7-452c-a3ed-89f72ef59234\",\"SenservaPro AD Applications Not Using Client Credentials\",\"Impact\",\"T1529 T1485\"\r\n\"SenservaPro\",\"C27BB559-28C5-4924-A7DA-3BF04CD02C8F\",\"Azure secure score block legacy authentication\",\"CredentialAccess\",\"T1212 T1556\"\r\n\"SenservaPro\",\"8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A\",\"Azure secure score role overlap\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"8EB2B20A-BF64-4DCC-9D98-1AD559502C00\",\"Azure secure score MFA registration V2\",\"CredentialAccess\",\"T1056\"\r\n\"SenservaPro\",\"9B6558C4-BA23-40AC-B95F-42F8A29A3B35\",\"Non-admin guest\",\"InitialAccess\",\"T1078\"\r\n\"SenservaPro\",\"D308318A-B298-4E57-82BD-74AE33C4A539\",\"Service principal not using client credentials\",\"InitialAccess\",\"T1078\"\r\n\"SenservaPro\",\"F539B2A7-D9E7-4438-AA20-893BC61DF130\",\"Azure secure score one admin\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"88C9A5E0-31EC-490B-82E5-A286D9B99A67\",\"Azure secure score PW age policy new\",\"CredentialAccess\",\"T1555 T1606 T1040\"\r\n\"SenservaPro\",\"645A8724-5C7E-4A1F-81CB-C33AFF1439EB\",\"Stale last password change\",\"InitialAccess\",\"T1566\"\r\n\"SenservaPro\",\"114120B2-AAA0-4C4E-BDF1-2EE178465047\",\"Azure Secure Score Self Service Password Reset\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"5231D757-A5B5-4CA7-A91B-AA3702970E02\",\"Azure secure score sign in risk policy\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"BFA7EE22-B5A9-42C8-BD50-2E95885640BB\",\"Third party integrated apps\",\"Exfiltration\",\"T1020\"\r\n\"SenservaPro\",\"24E0132F-61D1-41BD-9393-06136D1039C7\",\"UserAccountDisabled\",\"InitialAccess\",\"T1078\"\r\n\"SenservaPro\",\"1C07A4CB-E31B-4917-BD2A-3572E42F602C\",\"Azure secure score user risk policy\",\"Impact\",\"T1529\"\r\n\"SentinelOne\",\"382f37b3-b49a-492f-b436-a4717c8c5c3e\",\"Sentinel One - Admin login from new location\",\"InitialAccess  PrivilegeEscalation\",\"T1078\"\r\n\"SentinelOne\",\"4ad87e4a-d045-4c6b-9652-c9de27fcb442\",\"Sentinel One - Agent uninstalled from multiple hosts\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"5f37de91-ff2b-45fb-9eda-49e9f76a3942\",\"Sentinel One - Alert from custom rule\",\"InitialAccess\",\r\n\"SentinelOne\",\"de339761-2298-4b37-8f1b-80ebd4f0b5f6\",\"Sentinel One - Blacklist hash deleted\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"4224409f-a7bf-45eb-a931-922d79575a05\",\"Sentinel One - Exclusion added\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"47e427e6-61bc-4e24-8d16-a12871b9f939\",\"Sentinel One - Multiple alerts on host\",\"InitialAccess\",\r\n\"SentinelOne\",\"e73d293d-966c-47ec-b8e0-95255755f12c\",\"Sentinel One - New admin created\",\"PrivilegeEscalation\",\"T1078\"\r\n\"SentinelOne\",\"e171b587-22bd-46ec-b96c-7c99024847a7\",\"Sentinel One - Rule deleted\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"84e210dd-8982-4398-b6f3-264fd72d036c\",\"Sentinel One - Rule disabled\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"5586d378-1bce-4d9b-9ac8-e7271c9d5a9a\",\"Sentinel One - Same custom rule triggered on different hosts\",\"InitialAccess\",\r\n\"SentinelOne\",\"51999097-60f4-42c0-bee8-fa28160e5583\",\"Sentinel One - User viewed agent's passphrase\",\"CredentialAccess\",\"T1555\"\r\n\"SlackAudit\",\"04528635-a5f1-438b-ab74-21ca7bc3aa32\",\"SlackAudit - Empty User Agent\",\"InitialAccess\",\"T1133\"\r\n\"SlackAudit\",\"3db0cb83-5fa4-4310-a8a0-d8d66183f0bd\",\"SlackAudit - Multiple archived files uploaded in short period of time\",\"Exfiltration\",\"T1567\"\r\n\"SlackAudit\",\"93a91c37-032c-4380-847c-957c001957ad\",\"SlackAudit - Multiple failed logins for user\",\"CredentialAccess\",\"T1110\"\r\n\"SlackAudit\",\"279316e8-8965-47d2-9788-b94dc352c853\",\"SlackAudit - Public link created for file which can contain sensitive information.\",\"Exfiltration\",\"T1048\"\r\n\"SlackAudit\",\"132b98a5-07e9-401a-9b6f-453e52a53979\",\"SlackAudit - Suspicious file downloaded.\",\"InitialAccess\",\"T1189\"\r\n\"SlackAudit\",\"3b11f06e-4afd-4ae6-8477-c61136619ac8\",\"SlackAudit - Unknown User Agent\",\"Persistence\",\r\n\"SlackAudit\",\"be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e\",\"SlackAudit - User role changed to admin or owner\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"SlackAudit\",\"9d85feb3-7f54-4181-b143-68abb1a86823\",\"SlackAudit - User email linked to account changed.\",\"InitialAccess\",\"T1078\"\r\n\"SlackAudit\",\"e6e99dcb-4dff-48d2-8012-206ca166b36b\",\"SlackAudit - User login after deactivated.\",\"InitialAccess Persistence PrivilegeEscalation\",\"T1078\"\r\n\"Snowflake\",\"09b8dfc7-87b0-4215-b34b-bab363d685cb\",\"Snowflake - Possible discovery activity\",\"Discovery\",\r\n\"Snowflake\",\"1376f5e5-855a-4f88-8591-19eba4575a0f\",\"Snowflake - Abnormal query process time\",\"Impact\",\"T1499\"\r\n\"Snowflake\",\"5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8\",\"Snowflake - Multiple failed queries\",\"Discovery\",\"T1518  T1082\"\r\n\"Snowflake\",\"e05cc333-d499-430f-907c-7f28a9e4d1b5\",\"Snowflake - Multiple login failures by user\",\"InitialAccess\",\"T1078\"\r\n\"Snowflake\",\"b7d22407-1391-4256-b09a-414a9719443c\",\"Snowflake - Multiple login failures from single IP\",\"InitialAccess\",\"T1078\"\r\n\"Snowflake\",\"c2f93727-e4b0-4cb9-8f80-f52ebbd96ece\",\"Snowflake - Possible data destraction\",\"Impact\",\"T1485\"\r\n\"Snowflake\",\"627a4ff1-036b-4375-a9f9-288d5e1d7d37\",\"Snowflake - Possible privileges discovery activity\",\"Discovery\",\"T1087\"\r\n\"Snowflake\",\"f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e\",\"Snowflake - Query on sensitive or restricted table\",\"Collection\",\"T1119\"\r\n\"Snowflake\",\"1dd1d9e5-3ebf-43cb-be07-6082d5eabe79\",\"Snowflake - Unusual query\",\"Collection\",\"T1119\"\r\n\"Snowflake\",\"5ed33eee-0ab6-4bf5-9e9b-6100db83d39a\",\"Snowflake - User granted admin privileges\",\"PrivilegeEscalation\",\"T1078\"\r\n\"SonicWall Firewall\",\"27f1a570-5f20-496b-88f6-a9aa2c5c9534\",\"SonicWall - Allowed SSH Telnet and RDP Connections\",\"InitialAccess  Execution  Persistence  CredentialAccess  Discovery  LateralMovement  Collection  Exfiltration  Impact\",\"T1190  T1133  T1059  T1133  T1110  T1003  T1087  T1018  T1021  T1005  T1048  T1041  T1011  T1567  T1490\"\r\n\"SonicWall Firewall\",\"3db9f99e-a459-41e0-8e02-8b332f5fcb2c\",\"SonicWall - Capture ATP Malicious File Detection\",\"Execution\",\"T1204\"\r\n\"SonraiSecurity\",\"bcc3362d-b6f9-4de0-b41c-707fafd5a416\",\"New Sonrai Ticket\",,\r\n\"SonraiSecurity\",\"37a8d052-a3db-4dc6-9dca-9390cac6f486\",\"Sonrai Ticket Assigned\",,\r\n\"SonraiSecurity\",\"f5d467de-b5a2-4b4f-96db-55e27c733594\",\"Sonrai Ticket Closed\",,\r\n\"SonraiSecurity\",\"0d29c93e-b83f-4dfb-bbbb-76824b77eeca\",\"Sonrai Ticket Escalation Executed\",,\r\n\"SonraiSecurity\",\"822fff15-ea68-4d0f-94ee-b4482ddb6f3a\",\"Sonrai Ticket Escalation Executed\",,\r\n\"SonraiSecurity\",\"b60129ab-ce22-4b76-858d-3204932a13cc\",\"Sonrai Ticket Reopened\",,\r\n\"SonraiSecurity\",\"080191e8-271d-4ae6-85ce-c7bcd4b06b40\",\"Sonrai Ticket Risk Accepted\",,\r\n\"SonraiSecurity\",\"10e6c454-5cad-4f86-81ce-800235cb050a\",\"Sonrai Ticket Snoozed\",,\r\n\"SonraiSecurity\",\"af9b8eb1-a8ef-40aa-92a4-1fc73a1479c7\",\"Sonrai Ticket Updated\",,\r\n\"Sophos XG Firewall\",\"3d645a88-2724-41a7-adea-db74c439cf79\",\"Excessive Amount of Denied Connections from a Single Source\",\"Impact\",\"T1499\"\r\n\"Sophos XG Firewall\",\"427e4c9e-8cf4-4094-a684-a2d060dbca38\",\"Port Scan Detected\",\"Discovery\",\"T1046\"\r\n\"SpyCloud Enterprise Protection\",\"cb410ad5-6e9d-4278-b963-1e3af205d680\",\"SpyCloud Enterprise Breach Detection\",\"CredentialAccess\",\"T1555\"\r\n\"SpyCloud Enterprise Protection\",\"7ba50f9e-2f94-462b-a54b-8642b8c041f5\",\"SpyCloud Enterprise Malware Detection\",\"CredentialAccess\",\"T1555\"\r\n\"Symantec Endpoint Protection\",\"fa0ab69c-7124-4f62-acdd-61017cf6ce89\",\"Excessive Blocked Traffic Events Generated by User\",,\r\n\"Symantec Endpoint Protection\",\"072ee087-17e1-474d-b162-bbe38bcab9f9\",\"Malware Detected\",\"Execution\",\r\n\"Symantec VIP\",\"a9956d3a-07a9-44a6-a279-081a85020cae\",\"ClientDeniedAccess\",\"CredentialAccess\",\"T1110\"\r\n\"Symantec VIP\",\"c775a46b-21b1-46d7-afa6-37e3e577a27b\",\"Excessive Failed Authentication from Invalid Inputs\",\"CredentialAccess\",\"T1110\"\r\n\"SymantecProxySG\",\"7a58b253-0ef2-4248-b4e5-c350f15a8346\",\"Excessive Denied Proxy Traffic\",\"DefenseEvasion\",\r\n\"SymantecProxySG\",\"fb0f4a93-d8ad-4b54-9931-85bdb7550f90\",\"User Accessed Suspicious URL Categories\",\"DefenseEvasion\",\r\n\"Syslog\",\"e7ec9fa6-e7f7-41ed-a34b-b956837a3ee6\",\"Failed logon attempts in authpriv\",\"CredentialAccess\",\"T1110\"\r\n\"Syslog\",\"dd03057e-4347-4853-bf1e-2b2d21eb4e59\",\"NRT Squid proxy events related to mining pools\",\"CommandAndControl\",\"T1102\"\r\n\"Syslog\",\"bb6a74c8-889d-4c6e-8412-7d5efe33f4ed\",\"SFTP File transfer above threshold\",\"Exfiltration\",\"T1020\"\r\n\"Syslog\",\"7355434e-09d5-4401-b56d-e03e9379dfb1\",\"SFTP File transfer folder count above threshold\",\"Exfiltration\",\"T1020\"\r\n\"Syslog\",\"80733eb7-35b2-45b6-b2b8-3c51df258206\",\"Squid proxy events related to mining pools\",\"CommandAndControl\",\"T1102\"\r\n\"Syslog\",\"90d3f6ec-80fb-48e0-9937-2c70c9df9bad\",\"Squid proxy events for ToR proxies\",\"CommandAndControl\",\"T1090 T1008\"\r\n\"Syslog\",\"e1ce0eab-10d1-4aae-863f-9a383345ba88\",\"SSH - Potential Brute Force\",\"CredentialAccess\",\"T1110\"\r\n\"Tanium\",\"dd9aa0ff-7ac1-4448-879c-e1a18d5890b4\",\"Tanium Threat Response Alerts\",,\r\n\"TenableAD\",\"4639bb0a-ca12-4a57-8e53-f61c2c6034d6\",\"Tenable.ad Active Directory attacks pathways\",\"CredentialAccess\",\"T1110\"\r\n\"TenableAD\",\"861044f3-6eef-4f79-8609-e3764abb02f4\",\"Tenable.ad DCShadow\",\"DefenseEvasion\",\"T1207\"\r\n\"TenableAD\",\"0c8d4de3-adb9-4161-a863-aa1e2c8bd959\",\"Tenable.ad DCSync\",\"CredentialAccess\",\"T1003.006\"\r\n\"TenableAD\",\"d1abda25-f88a-429a-8163-582533cd0def\",\"Tenable.ad Golden Ticket\",\"CredentialAccess\",\"T1558.001\"\r\n\"TenableAD\",\"6405329a-8d20-48f3-aabc-e1b8a745568e\",\"Tenable.ad Indicators of Attack\",\"CredentialAccess\",\"T1110\"\r\n\"TenableAD\",\"55de1072-e93f-40f9-a14d-f7356d217cf6\",\"Tenable.ad Indicators of Exposures\",\"CredentialAccess\",\"T1110\"\r\n\"TenableAD\",\"6f7fa5f9-7d21-42c1-bc52-ac355b87c6cf\",\"Tenable.ad LSASS Memory\",\"CredentialAccess\",\"T1003.001\"\r\n\"TenableAD\",\"44d74560-0cd1-4e73-a8f5-d16eeeba219e\",\"Tenable.ad Password Guessing\",\"CredentialAccess\",\"T1110\"\r\n\"TenableAD\",\"2518b57f-1a8b-44ea-935d-7dc1cfe4f918\",\"Tenable.ad Password issues\",\"CredentialAccess\",\"T1110\"\r\n\"TenableAD\",\"29d350db-0ac0-4f4c-92ff-dac0f6335612\",\"Tenable.ad Password Spraying\",\"CredentialAccess\",\"T1110.003\"\r\n\"TenableAD\",\"353d6474-d795-4086-a179-ba1db4d8bbcb\",\"Tenable.ad privileged accounts issues\",\"CredentialAccess\",\"T1110\"\r\n\"TenableAD\",\"4f8ed6f3-8815-437d-9462-f0def9dc70d6\",\"Tenable.ad user accounts issues\",\"CredentialAccess\",\"T1110\"\r\n\"Theom\",\"f2490f5b-269c-471d-9ff4-475f62ea498e\",\"Theom - Dev secrets unencrypted\",,\r\n\"Theom\",\"a655f6d1-4ffa-4bc9-8b5d-2ec31cad09d4\",\"Theom - National IDs unencrypted\",,\r\n\"Theom\",\"b568d2fb-b73c-4e6a-88db-2093457712af\",\"Theom - Financial data unencrypted\",,\r\n\"Theom\",\"fb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7\",\"Theom - Healthcare data unencrypted\",,\r\n\"Theom\",\"6b93d8b1-40cf-4973-adaa-6f240df21ff1\",\"Theom - Unencrypted public data stores\",,\r\n\"Theom\",\"2ef36aaa-ec4a-473a-9734-f364ce8868f8\",\"Theom - Critical data in API headers or body\",,\r\n\"Theom\",\"65200844-e161-47a7-a103-f61f7e3afe30\",\"Theom - Dev secrets exposed\",,\r\n\"Theom\",\"078b5614-54c7-41a6-8289-5b5870e4c0f9\",\"Theom - Healthcare data exposed\",,\r\n\"Theom\",\"db95655e-bf5c-4c38-9676-501ec1878d4e\",\"Theom - National IDs exposed\",,\r\n\"Theom\",\"0cead100-f6ca-4cbb-989d-424d20705f30\",\"Theom - Financial data exposed\",,\r\n\"Theom\",\"545fdcc7-2123-4b8a-baf6-409f29aad4b1\",\"Theom - Dark Data with large fin value\",,\r\n\"Theom\",\"67b9ff50-5393-49d5-b66f-05b33e2f35d2\",\"Theom - Least priv large value shadow DB\",,\r\n\"Theom\",\"fb7769d0-e622-4479-95b4-f6266a5b41e2\",\"Theom - Overprovisioned Roles Shadow DB\",,\r\n\"Theom\",\"7cf83fce-276a-4b12-a876-7b1bc0683cd6\",\"Theom - Shadow DB large datastore value\",,\r\n\"Theom\",\"02bff937-ca52-4f52-a9cd-b826f8602694\",\"Theom - Shadow DB with atypical accesses\",,\r\n\"Theom\",\"bb9051ef-0e72-4758-a143-80c25ee452f0\",\"Theom Critical Risks\",,\r\n\"Theom\",\"74b80987-0a62-448c-8779-47b02e17d3cf\",\"Theom High Risks\",,\r\n\"Theom\",\"d200da84-0191-44ce-ad9e-b85e64c84c89\",\"Theom Insights\",,\r\n\"Theom\",\"cf7fb616-ac80-40ce-ad18-aa18912811f8\",\"Theom Low Risks\",,\r\n\"Theom\",\"4cb34832-f73a-49f2-8d38-c2d135c5440b\",\"Theom Medium Risks\",,\r\n\"Threat Intelligence\",\"b97e118c-b7fa-42a6-84de-2e13443fbb8f\",\"Preview - TI map Domain entity to Cloud App Events\",\"Impact\",\r\n\"Threat Intelligence\",\"dd0a6029-ecef-4507-89c4-fc355ac52111\",\"TI map Domain entity to PaloAlto CommonSecurityLog\",\"Impact\",\r\n\"Threat Intelligence\",\"c308b2f3-eebe-4a20-905c-cb8293b062db\",\"TI Map Domain Entity to DeviceNetworkEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"85aca4d1-5d15-4001-abd9-acb86ca1786a\",\"TI map Domain entity to DnsEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"96307710-8bb9-4b45-8363-a90c72ebf86f\",\"TI map Domain entity to EmailEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"87cc75df-d7b2-44f1-b064-ee924edfc879\",\"TI map Domain entity to EmailUrlInfo\",\"Impact\",\r\n\"Threat Intelligence\",\"ec21493c-2684-4acd-9bc2-696dbad72426\",\"TI map Domain entity to PaloAlto\",\"Impact\",\r\n\"Threat Intelligence\",\"87890d78-3e05-43ec-9ab9-ba32f4e01250\",\"TI map Domain entity to SecurityAlert\",\"Impact\",\r\n\"Threat Intelligence\",\"532f62c1-fba6-4baa-bbb6-4a32a4ef32fa\",\"TI map Domain entity to Syslog\",\"Impact\",\r\n\"Threat Intelligence\",\"b1832f60-6c3d-4722-a0a5-3d564ee61a63\",\"TI map Domain entity to Web Session Events (ASIM Web Session schema)\",\"Impact\",\r\n\"Threat Intelligence\",\"cca3b4d9-ac39-4109-8b93-65bb284003e6\",\"TI map Email entity to AzureActivity\",\"Impact\",\r\n\"Threat Intelligence\",\"47b9bb10-d216-4359-8cef-08ca2c67e5be\",\"Preview - TI map Email entity to Cloud App Events\",\"Impact\",\r\n\"Threat Intelligence\",\"11f7c6e3-f066-4b3c-9a81-b487ec0a6873\",\"TI map Email entity to EmailEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"4a3f5ed7-8da5-4ce2-af6f-c9ada45060f2\",\"TI map Email entity to OfficeActivity\",\"Impact\",\r\n\"Threat Intelligence\",\"ffcd575b-3d54-482a-a6d8-d0de13b6ac63\",\"TI map Email entity to PaloAlto CommonSecurityLog\",\"Impact\",\r\n\"Threat Intelligence\",\"a2e36ce0-da4d-4b6e-88c6-4e40161c5bfc\",\"TI map Email entity to SecurityAlert\",\"Impact\",\r\n\"Threat Intelligence\",\"2fc5d810-c9cc-491a-b564-841427ae0e50\",\"TI map Email entity to SecurityEvent\",\"Impact\",\r\n\"Threat Intelligence\",\"30fa312c-31eb-43d8-b0cc-bcbdfb360822\",\"TI map Email entity to SigninLogs\",\"Impact\",\r\n\"Threat Intelligence\",\"2f6bbf88-f5b0-49a3-b2b5-97fc3664e4d4\",\"Preview - TI map File Hash entity to Cloud App Events\",\"Impact\",\r\n\"Threat Intelligence\",\"5d33fc63-b83b-4913-b95e-94d13f0d379f\",\"TI map File Hash to CommonSecurityLog Event\",\"Impact\",\r\n\"Threat Intelligence\",\"bc0eca2e-db50-44e6-8fa3-b85f91ff5ee7\",\"TI map File Hash to DeviceFileEvents Event\",\"Impact\",\r\n\"Threat Intelligence\",\"a7427ed7-04b4-4e3b-b323-08b981b9b4bf\",\"TI map File Hash to Security Event\",\"Impact\",\r\n\"Threat Intelligence\",\"f110287e-1358-490d-8147-ed804b328514\",\"TI map IP entity to AWSCloudTrail\",\"Impact\",\r\n\"Threat Intelligence\",\"f9949656-473f-4503-bf43-a9d9890f7d08\",\"TI map IP entity to AppServiceHTTPLogs\",\"Impact\",\r\n\"Threat Intelligence\",\"2441bce9-02e4-407b-8cc7-7d597f38b8b0\",\"TI Map IP Entity to AzureActivity\",\"Impact\",\r\n\"Threat Intelligence\",\"0b904747-1336-4363-8d84-df2710bfe5e7\",\"TI map IP entity to AzureFirewall\",\"Impact\",\r\n\"Threat Intelligence\",\"57c7e832-64eb-411f-8928-4133f01f4a25\",\"TI map IP entity to Azure Key Vault logs\",\"Impact\",\r\n\"Threat Intelligence\",\"a4025a76-6490-4e6b-bb69-d02be4b03f07\",\"TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)\",\"Impact\",\r\n\"Threat Intelligence\",\"d0aa8969-1bbe-4da3-9e76-09e5f67c9d85\",\"TI Map IP Entity to Azure SQL Security Audit Events\",\"Impact\",\r\n\"Threat Intelligence\",\"4e0a6fc8-697e-4455-be47-831b41ea91ac\",\"Preview - TI map IP entity to Cloud App Events\",\"Impact\",\r\n\"Threat Intelligence\",\"66c81ae2-1f89-4433-be00-2fbbd9ba5ebe\",\"TI Map IP Entity to CommonSecurityLog\",\"Impact\",\r\n\"Threat Intelligence\",\"b2df4979-d34a-48b3-a7d9-f473a4bf8058\",\"TI Map IP Entity to DeviceNetworkEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"69b7723c-2889-469f-8b55-a2d355ed9c87\",\"TI Map IP Entity to DnsEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"d23ed927-5be3-4902-a9c1-85f841eb4fa1\",\"TI Map IP Entity to Duo Security\",\"Impact\",\r\n\"Threat Intelligence\",\"f15370f4-c6fa-42c5-9be4-1d308f40284e\",\"TI map IP entity to OfficeActivity\",\"Impact\",\r\n\"Threat Intelligence\",\"f2eb15bd-8a88-4b24-9281-e133edfba315\",\"TI Map IP Entity to SigninLogs\",\"Impact\",\r\n\"Threat Intelligence\",\"9713e3c0-1410-468d-b79e-383448434b2d\",\"TI Map IP Entity to VMConnection\",\"Impact\",\r\n\"Threat Intelligence\",\"5e45930c-09b1-4430-b2d1-cc75ada0dc0f\",\"TI Map IP Entity to W3CIISLog\",\"Impact\",\r\n\"Threat Intelligence\",\"e2399891-383c-4caf-ae67-68a008b9f89e\",\"TI map IP entity to Network Session Events (ASIM Network Session schema)\",\"Impact\",\r\n\"Threat Intelligence\",\"e2559891-383c-4caf-ae67-55a008b9f89e\",\"TI map IP entity to Web Session Events (ASIM Web Session schema)\",\"Impact\",\r\n\"Threat Intelligence\",\"aac495a9-feb1-446d-b08e-a1164a539452\",\"TI map IP entity to GitHub_CL\",\"Impact\",\r\n\"Threat Intelligence\",\"712fab52-2a7d-401e-a08c-ff939cc7c25e\",\"TI Map URL Entity to AuditLogs\",\"Impact\",\r\n\"Threat Intelligence\",\"e8ae92dd-1d41-4530-8be8-85c5014c7b47\",\"Preview - TI map URL entity to Cloud App Events\",\"Impact\",\r\n\"Threat Intelligence\",\"6ddbd892-a9be-47be-bab7-521241695bd6\",\"TI Map URL Entity to DeviceNetworkEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"a0038239-72f4-4f7b-90ff-37f89f7881e0\",\"TI Map URL Entity to EmailUrlInfo\",\"Impactq\",\r\n\"Threat Intelligence\",\"36a9c9e5-3dc1-4ed9-afaa-1d13617bfc2b\",\"TI Map URL Entity to OfficeActivity Data [Deprecated]\",\"Impact\",\r\n\"Threat Intelligence\",\"106813db-679e-4382-a51b-1bfc463befc3\",\"TI Map URL Entity to PaloAlto Data\",\"Impact\",\r\n\"Threat Intelligence\",\"f30a47c1-65fb-42b1-a7f4-00941c12550b\",\"TI Map URL Entity to SecurityAlert Data\",\"Impact\",\r\n\"Threat Intelligence\",\"b31037ea-6f68-4fbd-bab2-d0d0f44c2fcf\",\"TI Map URL Entity to Syslog Data\",\"Impact\",\r\n\"Threat Intelligence\",\"23391c84-87d8-452f-a84c-47a62f01e115\",\"TI Map URL Entity to UrlClickEvents\",\"Impact\",\r\n\"Threat Intelligence\",\"999e9f5d-db4a-4b07-a206-29c4e667b7e8\",\"TI map Domain entity to Dns Events (ASIM DNS Schema)\",\"Impact\",\r\n\"Threat Intelligence\",\"67775878-7f8b-4380-ac54-115e1e828901\",\"TI map IP entity to DNS Events (ASIM DNS schema)\",\"Impact\",\r\n\"ThreatConnect\",\"f8960f1c-07d2-512b-9c41-952772d40c84\",\"Threat Connect TI map Domain entity to DnsEvents\",\"Impact\",\r\n\"ThreatConnect\",\"4f7ade3e-7121-5274-83ea-d7ed22a01fea\",\"ThreatConnect TI map Email entity to OfficeActivity\",\"Impact\",\r\n\"ThreatConnect\",\"ecb68ce7-c309-59a7-a8de-07ccf2a0ea4f\",\"ThreatConnect TI map Email entity to SigninLogs\",\"Impact\",\r\n\"ThreatConnect\",\"ee1fd303-2081-47b7-8f02-e38bfd0868e6\",\"ThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema)\",\"Impact\",\r\n\"ThreatConnect\",\"12c3b31b-66a6-53ff-b6ab-6ae45e56dc92\",\"ThreatConnect TI Map URL Entity to OfficeActivity Data\",\"Impact\",\r\n\"Tomcat\",\"91f59cea-486f-11ec-81d3-0242ac130003\",\"Tomcat - Commands in URI\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"5e77a818-5825-4ff6-a901-80891c4774d1\",\"Tomcat - Known malicious user agent\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"4fa66058-4870-11ec-81d3-0242ac130003\",\"Tomcat - Multiple client errors from single IP address\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"7c9a1026-4872-11ec-81d3-0242ac130003\",\"Tomcat - Multiple empty requests from same IP\",\"InitialAccess Impact\",\"T1190 T1133 T1499\"\r\n\"Tomcat\",\"de9df79c-4872-11ec-81d3-0242ac130003\",\"Tomcat - Multiple server errors from single IP address\",\"Impact  InitialAccess\",\"T1498  T1190  T1133\"\r\n\"Tomcat\",\"103d5ada-4874-11ec-81d3-0242ac130003\",\"Tomcat - Put file and get file from same IP address\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Tomcat\",\"a45dd6ea-4874-11ec-81d3-0242ac130003\",\"Tomcat - Request from localhost IP address\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Tomcat\",\"0c851bd4-4875-11ec-81d3-0242ac130003\",\"Tomcat - Request to sensitive files\",\"InitialAccess\",\"T1189\"\r\n\"Tomcat\",\"ce84741e-4875-11ec-81d3-0242ac130003\",\"Tomcat - Sql injection patterns\",\"InitialAccess\",\"T1190\"\r\n\"Tomcat\",\"875da588-4875-11ec-81d3-0242ac130003\",\"Tomcat - Server errors after multiple requests from same IP\",\"Impact  InitialAccess\",\"T1498 T1190 T1133\"\r\n\"Trend Micro Apex One\",\"7a3193b8-67b7-11ec-90d6-0242ac120003\",\"ApexOne - Attack Discovery Detection\",\"InitialAccess\",\"T1190\"\r\n\"Trend Micro Apex One\",\"4d7199b2-67b8-11ec-90d6-0242ac120003\",\"ApexOne - Suspicious commandline arguments\",\"Execution\",\"T1059\"\r\n\"Trend Micro Apex One\",\"4a9a5900-67b7-11ec-90d6-0242ac120003\",\"ApexOne - Commands in Url\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Trend Micro Apex One\",\"b463b952-67b8-11ec-90d6-0242ac120003\",\"ApexOne - Device access permissions was changed\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Trend Micro Apex One\",\"6303235a-ee70-42a4-b969-43e7b969b916\",\"ApexOne - Inbound remote access connection\",\"LateralMovement\",\"T1021\"\r\n\"Trend Micro Apex One\",\"cd94e078-67b7-11ec-90d6-0242ac120003\",\"ApexOne - Multiple deny or terminate actions on single IP\",\"InitialAccess\",\"T1190\"\r\n\"Trend Micro Apex One\",\"e289d762-6cc2-11ec-90d6-0242ac120003\",\"ApexOne - Possible exploit or execute operation\",\"PrivilegeEscalation  Persistence\",\"T1546\"\r\n\"Trend Micro Apex One\",\"1a87cd10-67b7-11ec-90d6-0242ac120003\",\"ApexOne - C&C callback events\",\"CommandAndControl\",\"T1071\"\r\n\"Trend Micro Apex One\",\"c92d9fe4-67b6-11ec-90d6-0242ac120003\",\"ApexOne - Spyware with failed response\",\"InitialAccess\",\"T1190\"\r\n\"Trend Micro Apex One\",\"9e3dc038-67b7-11ec-90d6-0242ac120003\",\"ApexOne - Suspicious connections\",\"CommandAndControl\",\"T1102\"\r\n\"Trend Micro Cloud App Security\",\"1ddeb8ad-cad9-4db4-b074-f9da003ca3ed\",\"Trend Micro CAS - DLP violation\",\"Exfiltration\",\"T1048\"\r\n\"Trend Micro Cloud App Security\",\"9e7b3811-d743-479c-a296-635410562429\",\"Trend Micro CAS - Possible phishing mail\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"0bec3f9a-dbe9-4b4c-9ff6-498d64bbef90\",\"Trend Micro CAS - Ransomware infection\",\"Impact\",\"T1486\"\r\n\"Trend Micro Cloud App Security\",\"38e043ce-a1fd-497b-8d4f-ce5ca2db90cd\",\"Trend Micro CAS - Ransomware outbreak\",\"Impact\",\"T1486\"\r\n\"Trend Micro Cloud App Security\",\"52c4640a-1e2b-4155-b69e-e1869c9a57c9\",\"Trend Micro CAS - Suspicious file\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"c8e2ad52-bd5f-4f74-a2f7-6c3ab8ba687a\",\"Trend Micro CAS - Threat detected and not blocked\",\"DefenseEvasion\",\"T1562\"\r\n\"Trend Micro Cloud App Security\",\"201fd2d1-9131-4b29-bace-ce5d19f3e4ee\",\"Trend Micro CAS - Unexpected file via mail\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"de54f817-f338-46bf-989b-4e016ea6b71b\",\"Trend Micro CAS - Unexpected file on file share\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"3649dfb8-a5ca-47dd-8965-cd2f633ca533\",\"Trend Micro CAS - Infected user\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"65c2a6fe-ff7b-46b0-9278-61265f77f3bc\",\"Trend Micro CAS - Multiple infected users\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Vision One\",\"0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd\",\"Create Incident for XDR Alerts\",,\r\n\"Ubiquiti UniFi\",\"7feb3c32-2a11-4eb8-a2d7-e3792b31cb80\",\"Ubiquiti - Possible connection to cryptominning pool\",\"CommandAndControl\",\"T1071 T1095 T1571\"\r\n\"Ubiquiti UniFi\",\"db60ca0b-b668-439b-b889-b63b57ef20fb\",\"Ubiquiti - Connection to known malicious IP or C2\",\"Exfiltration CommandAndControl\",\"T1071 T1571 T1572\"\r\n\"Ubiquiti UniFi\",\"fd200125-9d57-4838-85ca-6430c63e4e5d\",\"Ubiquiti - Unusual FTP connection to external server\",\"Exfiltration\",\r\n\"Ubiquiti UniFi\",\"6df85d74-e32f-4b71-80e5-bfe2af00be1c\",\"Ubiquiti - Large ICMP to external server\",\"Exfiltration CommandAndControl\",\"T1041 T1572\"\r\n\"Ubiquiti UniFi\",\"fe232837-9bdc-4e2b-8c08-cdac2610eed3\",\"Ubiquiti - connection to non-corporate DNS server\",\"CommandAndControl Exfiltration\",\"T1572 T1041\"\r\n\"Ubiquiti UniFi\",\"14a23ded-7fb9-48ee-ba39-859517a49b51\",\"Ubiquiti - Unusual DNS connection\",\"CommandAndControl\",\"T1090 T1572\"\r\n\"Ubiquiti UniFi\",\"95d5ca9b-72c5-4b80-ad5c-b6401cdc5e08\",\"Ubiquiti - RDP from external source\",\"InitialAccess\",\"T1133\"\r\n\"Ubiquiti UniFi\",\"0998a19d-8451-4cdd-8493-fc342816a197\",\"Ubiquiti - SSH from external source\",\"InitialAccess\",\"T1133\"\r\n\"Ubiquiti UniFi\",\"9757cee3-1a6c-4d8e-a968-3b7e48ded690\",\"Ubiquiti - Unknown MAC Joined AP\",\"InitialAccess\",\"T1133\"\r\n\"Ubiquiti UniFi\",\"31e868c0-91d3-40eb-accc-3fa73aa96f8e\",\"Ubiquiti - Unusual traffic\",\"InitialAccess\",\r\n\"VMWareESXi\",\"4cdcd5d8-89df-4076-a917-bc50abb9f2ab\",\"VMware ESXi - Dormant VM started\",\"InitialAccess\",\"T1190\"\r\n\"VMWareESXi\",\"48d992ba-d404-4159-a8c6-46f51d1325c7\",\"VMware ESXi - Low patch disk space\",\"Impact\",\"T1529\"\r\n\"VMWareESXi\",\"2ee727f7-b7c2-4034-b6c9-d245d5a29343\",\"VMware ESXi - Low temp directory space\",\"Impact\",\"T1529\"\r\n\"VMWareESXi\",\"bdea247f-7d17-498c-ac0e-c7e764cbdbbe\",\"VMware ESXi - Multiple new VMs started\",\"InitialAccess\",\"T1078\"\r\n\"VMWareESXi\",\"5fe1af14-cd40-48ff-b581-3a12a1f90785\",\"VMware ESXi - Multiple VMs stopped\",\"Impact\",\"T1529\"\r\n\"VMWareESXi\",\"0f4a80de-344f-47c0-bc19-cb120c59b6f0\",\"VMware ESXi - New VM started\",\"InitialAccess\",\"T1078\"\r\n\"VMWareESXi\",\"23a3cf72-9497-408e-8144-87958a60d31a\",\"VMware ESXi - Root impersonation\",\"PrivilegeEscalation\",\"T1078\"\r\n\"VMWareESXi\",\"deb448a8-6a9d-4f8c-8a95-679a0a2cd62c\",\"VMware ESXi - Root login\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"VMWareESXi\",\"9c496d6c-42a3-4896-9b6c-00254386928f\",\"VMware ESXi - Shared or stolen root account\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"VMWareESXi\",\"395c5560-ddc2-45b2-aafe-2e3f64528d3d\",\"VMware ESXi - Unexpected disk image\",\"Impact\",\"T1496\"\r\n\"VMWareESXi\",\"43889f30-7bce-4d8a-93bb-29c9615ca8dd\",\"VMware ESXi - VM stopped\",\"Impact\",\"T1529\"\r\n\"VMware Carbon Black Cloud\",\"2ca4e7fc-c61a-49e5-9736-5da8035c47e0\",\"Critical Threat Detected\",\"LateralMovement\",\"T1210\"\r\n\"VMware Carbon Black Cloud\",\"9f86885f-f31f-4e66-a39d-352771ee789e\",\"Known Malware Detected\",\"Execution\",\"T1204\"\r\n\"VMware SD-WAN and SASE\",\"b26a7d97-6b6e-43ab-870e-eb18460ae602\",\"VMware Cloud Web Security - Policy Publish Event\",,\r\n\"VMware SD-WAN and SASE\",\"3efebd49-c985-431b-9da8-d7d397092d18\",\"VMware Cloud Web Security - Policy Change Detected\",,\r\n\"VMware SD-WAN and SASE\",\"b84a1f62-ad30-4ae1-8b21-3d304d8aa818\",\"VMware Cloud Web Security - Web Access Policy Violation\",,\r\n\"VMware SD-WAN and SASE\",\"d811ef72-66b9-43a3-ba29-cd9e4bf75b74\",\"VMware Cloud Web Security - Data Loss Prevention Violation\",,\r\n\"VMware SD-WAN and SASE\",\"a88ead0a-f022-48d6-8f53-e5a164c4c72e\",\"VMware SD-WAN Edge - Device Congestion Alert - Packet Drops\",\"Impact\",\"T1498\"\r\n\"VMware SD-WAN and SASE\",\"44f78dbf-9f29-4ec0-aaca-ab5bf0b559af\",\"VMware SD-WAN Edge - IDS/IPS Alert triggered (Search API)\",\"LateralMovement\",\"T1210\"\r\n\"VMware SD-WAN and SASE\",\"a8e2bfd2-5d9c-4acc-aa55-30029e50d574\",\"VMware SD-WAN Edge - IDS/IPS Alert triggered (Syslog)\",\"LateralMovement\",\"T1210\"\r\n\"VMware SD-WAN and SASE\",\"6364be84-9f13-4fd8-8b4a-8ccb43a89376\",\"VMware SD-WAN Edge - IDS/IPS Signature Update Succeeded\",,\r\n\"VMware SD-WAN and SASE\",\"27553108-4aaf-4a3e-8ecd-5439d820d474\",\"VMware SD-WAN Edge - IDS/IPS Signature Update Failed\",,\r\n\"VMware SD-WAN and SASE\",\"ce207901-ed7b-49ae-ada7-033e1fbb1240\",\"VMware SD-WAN Edge - Network Anomaly Detection - Potential Fragmentation Attack\",\"Impact DefenseEvasion\",\"T1498 T1599\"\r\n\"VMware SD-WAN and SASE\",\"69c0644f-4ad5-41b6-9e09-a94c072ab80e\",\"VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected\",,\r\n\"VMware SD-WAN and SASE\",\"8d05cc90-d337-41f5-b5fa-614cbfe1a879\",\"VMware SD-WAN Edge - All Cloud Security Service Tunnels DOWN\",,\r\n\"VMware SD-WAN and SASE\",\"50c86f92-86b0-4ae3-bb94-698da076ca9e\",\"VMware SD-WAN - Orchestrator Audit Event\",,\r\n\"VMware SD-WAN and SASE\",\"840b050f-842b-4264-8973-d4f9b65facb5\",\"VMware SD-WAN Edge - Network Anomaly Detection - RPF Check Failure\",\"Impact\",\"T1498\"\r\n\"VMware vCenter\",\"f1fcb22c-b459-42f2-a7ee-7276b5f1309c\",\"vCenter - Root impersonation\",\"PrivilegeEscalation\",\"T1078\"\r\n\"VMware vCenter\",\"03e8a895-b5ba-49a0-aed3-f9a997d92fbe\",\"VMware vCenter - Root login\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"Valence Security\",\"d944d564-b6fa-470d-b5ab-a1a141878c5e\",\"Valence Security Alerts\",,\r\n\"Vectra AI Detect\",\"ce54b5d3-4c31-4eaf-a73e-31412270b6ab\",\"Vectra Account's Behaviors\",\"CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact\",\r\n\"Vectra AI Detect\",\"321f9dbd-64b7-4541-81dc-08cf7732ccb0\",\"Vectra AI Detect - Suspected Compromised Account\",\"CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact\",\r\n\"Vectra AI Detect\",\"39e48890-2c02-487e-aa9e-3ba494061798\",\"Vectra AI Detect - Detections with High Severity\",\"CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact\",\r\n\"Vectra AI Detect\",\"33e3b6da-2660-4cd7-9032-11be76db88d2\",\"Vectra Host's Behaviors\",\"CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact\",\r\n\"Vectra AI Detect\",\"60eb6cf0-3fa1-44c1-b1fe-220fbee23d63\",\"Vectra AI Detect - Suspected Compromised Host\",\"CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact\",\r\n\"Vectra AI Detect\",\"a34d0338-eda0-42b5-8b93-32aae0d7a501\",\"Vectra AI Detect - New Campaign Detected\",\"LateralMovement CommandAndControl\",\r\n\"Vectra AI Detect\",\"6cb75f65-231f-46c4-a0b3-50ff21ee6ed3\",\"Vectra AI Detect - Suspicious Behaviors by Category\",,\r\n\"Vectra XDR\",\"93de640a-314d-459a-9e21-00de2bffa92d\",\"Vectra Priority Entities\",,\r\n\"Vectra XDR\",\"065c0a50-3080-4f9a-acca-1fe6fbf63205\",\"Vectra Detection Alerts\",,\r\n\"Veritas NetBackup\",\"2e0efcd4-56d2-41df-9098-d6898a58c62b\",\"Alarming number of anomalies generated in NetBackup\",\"Discovery  CredentialAccess\",\"T1110  T1212\"\r\n\"Veritas NetBackup\",\"d39f0c47-2e85-49b9-a686-388c2eb7062c\",\"Multiple failed attempts of NetBackup login\",\"CredentialAccess Discovery\",\"T1110 T1212\"\r\n\"Votiro\",\"17bf3780-ae0d-4cd9-a884-5df8b687f3f5\",\"Votiro - File Blocked from Connector\",\"DefenseEvasion Discovery Impact\",\"T1036 T1083 T1057 T1082 T1565 T1498 T0837\"\r\n\"Votiro\",\"0b8b91de-c63e-4bc2-b5f4-b15d3b379ec9\",\"Votiro - File Blocked in Email\",\"CommandAndControl DefenseEvasion Impact InitialAccess\",\"T0885 T1036 T1027 T1486 T1566\"\r\n\"Web Session Essentials\",\"32c08696-2e37-4730-86f8-97d9c8b184c9\",\"Detect URLs containing known malicious keywords or commands (ASIM Web Session)\",\"InitialAccess CommandAndControl\",\"T1190 T1133 T1071\"\r\n\"Web Session Essentials\",\"5965d3e7-8ed0-477c-9b42-e75d9237fab0\",\"Detect unauthorized data transfers using timeseries anomaly (ASIM Web Session)\",\"Exfiltration\",\"T1030\"\r\n\"Web Session Essentials\",\"b7fe8f27-7010-404b-aec5-6e5245cea580\",\"The download of potentially risky files from the Discord Content Delivery Network (CDN) (ASIM Web Session)\",\"CommandAndControl\",\"T1071.001\"\r\n\"Web Session Essentials\",\"6a4dbcf8-f5e2-4b33-b34f-2db6487613f0\",\"Detect known risky user agents (ASIM Web Session)\",\"InitialAccess CommandAndControl\",\"T1190 T1133 T1071\"\r\n\"Web Session Essentials\",\"7bb55d05-ef39-4a40-8079-0bc3c05e7881\",\"Detect Local File Inclusion(LFI) in web requests (ASIM Web Session)\",\"InitialAccess Execution\",\"T1190 T1133 T1059\"\r\n\"Web Session Essentials\",\"faa40333-1e8b-40cc-a003-51ae41fa886f\",\"Detect instances of multiple client errors occurring within a brief period of time (ASIM Web Session)\",\"InitialAccess CommandAndControl\",\"T1190 T1133 T1071\"\r\n\"Web Session Essentials\",\"a59ba76c-0205-4966-948e-3d5640140688\",\"Detect instances of multiple server errors occurring within a brief period of time (ASIM Web Session)\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"Web Session Essentials\",\"813ccf3b-0321-4622-b0bc-63518fd14454\",\"Identify instances where a single source is observed using multiple user agents (ASIM Web Session)\",\"InitialAccess CredentialAccess\",\"T1190 T1133 T1528\"\r\n\"Web Session Essentials\",\"6a71687f-00cf-44d3-93fc-8cbacc7b5615\",\"Detect potential presence of a malicious file with a double extension (ASIM Web Session)\",\"DefenseEvasion Persistence CommandAndControl\",\"T1036 T1505 T1071\"\r\n\"Web Session Essentials\",\"b3731ce1-1f04-47c4-95c2-9827408c4375\",\"Detect potential file enumeration activity (ASIM Web Session)\",\"Discovery CommandAndControl CredentialAccess\",\"T1083 T1071 T1110\"\r\n\"Web Session Essentials\",\"e3a7722a-e099-45a9-9afb-6618e8f05405\",\"Detect presence of private IP addresses in URLs (ASIM Web Session)\",\"Exfiltration CommandAndControl\",\"T1041 T1071.001 T1001\"\r\n\"Web Session Essentials\",\"2d50d937-d7f2-4c05-b151-9af7f9ec747e\",\"Detect presence of uncommon user agents in web requests (ASIM Web Session)\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Web Session Essentials\",\"c99cf650-c53b-4c4c-9671-7d7500191a10\",\"Detect requests for an uncommon resources on the web (ASIM Web Session)\",\"CommandAndControl\",\"T1102 T1071\"\r\n\"Web Session Essentials\",\"c6608467-3678-45fe-b038-b590ce6d00fb\",\"Detect web requests to potentially harmful files (ASIM Web Session)\",\"InitialAccess Persistence Execution\",\"T1133 T1203 T1566\"\r\n\"Web Session Essentials\",\"7d2ed1c7-da26-45fd-b4ea-b6f2bbeccea7\",\"Detect threat information in web requests (ASIM Web Session)\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Web Shells Threat Protection\",\"fbfbf530-506b-49a4-81ad-4030885a195c\",\"Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts\",\"Persistence\",\"T1505\"\r\n\"Web Shells Threat Protection\",\"50eb4cbd-188f-44f4-b964-bab84dcdec10\",\"Identify SysAid Server web shell creation\",\"InitialAccess\",\"T1190\"\r\n\"Web Shells Threat Protection\",\"2acc91c3-17c2-4388-938e-4eac2d5894e8\",\"SUPERNOVA webshell\",\"Persistence CommandAndControl\",\"T1505 T1071\"\r\n\"Windows Forwarded Events\",\"066395ac-ef91-4993-8bf6-25c61ab0ca5a\",\"Caramel Tsunami Actor IOC - July 2021\",\"Persistence\",\"T1546\"\r\n\"Windows Forwarded Events\",\"4d173248-439b-4741-8b37-f63ad0c896ae\",\"Chia_Crypto_Mining IOC - June 2021\",\"Impact\",\"T1496\"\r\n\"Windows Forwarded Events\",\"9bd18b63-f1ca-4375-95db-39fda00bfe20\",\"Progress MOVEIt File transfer above threshold\",\"Exfiltration\",\"T1020\"\r\n\"Windows Forwarded Events\",\"26a993ca-0a96-45a0-8405-05a210fb98f8\",\"Progress MOVEIt File transfer folder count above threshold\",\"Exfiltration\",\"T1020\"\r\n\"Windows Security Events\",\"dcdf9bfc-c239-4764-a9f9-3612e6dff49c\",\"ADFS Database Named Pipe Connection\",\"Collection\",\"T1005\"\r\n\"Windows Security Events\",\"2f4165a6-c4fb-4e94-861e-37f1b4d6c0e6\",\"AD FS Remote Auth Sync Connection\",\"Collection\",\"T1005\"\r\n\"Windows Security Events\",\"d57c33a9-76b9-40e0-9dfa-ff0404546410\",\"AD FS Remote HTTP Network Connection\",\"Collection\",\"T1005\"\r\n\"Windows Security Events\",\"2391ce61-8c8d-41ac-9723-d945b2e90720\",\"Excessive Windows Logon Failures\",\"CredentialAccess\",\"T1110\"\r\n\"Windows Security Events\",\"faf1a6ff-53b5-4f92-8c55-4b20e9957594\",\"Exchange OAB Virtual Directory Attribute Containing Potential Webshell\",\"InitialAccess\",\"T1190\"\r\n\"Windows Security Events\",\"12dcea64-bec2-41c9-9df2-9f28461b1295\",\"Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task\",\"LateralMovement\",\"T1210\"\r\n\"Windows Security Events\",\"a356c8bd-c81d-428b-aa36-83be706be034\",\"Microsoft Entra ID Local Device Join Information and Transport Key Registry Keys Access\",\"Discovery\",\"T1012\"\r\n\"Windows Security Events\",\"cf3ede88-a429-493b-9108-3e46d3c741f7\",\"SecurityEvent - Multiple authentication failures followed by a success\",\"CredentialAccess\",\"T1110\"\r\n\"Windows Security Events\",\"508cef41-2cd8-4d40-a519-b04826a9085f\",\"NRT Security Event log cleared\",\"DefenseEvasion\",\"T1070\"\r\n\"Windows Security Events\",\"c3e5dbaa-a540-408c-8b36-68bdfb3df088\",\"NRT Base64 Encoded Windows Process Command-lines\",\"Execution DefenseEvasion\",\"T1059 T1027 T1140\"\r\n\"Windows Security Events\",\"7ad4c32b-d0d2-411c-a0e8-b557afa12fce\",\"NRT Process executed from binary hidden in Base64 encoded file\",\"Execution DefenseEvasion\",\"T1059 T1027 T1140\"\r\n\"Windows Security Events\",\"05b4bccd-dd12-423d-8de4-5a6fb526bb4f\",\"New EXE deployed via Default Domain or Default Domain Controller Policies\",\"Execution LateralMovement\",\"T1072 T1570\"\r\n\"Windows Security Events\",\"b9d2eebc-5dcb-4888-8165-900db44443ab\",\"Non Domain Controller Active Directory Replication\",\"CredentialAccess\",\"T1003\"\r\n\"Windows Security Events\",\"56f3f35c-3aca-4437-a1fb-b7a84dc4af00\",\"Potential Fodhelper UAC Bypass\",\"PrivilegeEscalation\",\"T1548.002\"\r\n\"Windows Security Events\",\"720d12c6-a08c-44c4-b18f-2236412d59b0\",\"Potential re-\",\"DefenseEvasion Impact\",\"T1485 T1036\"\r\n\"Windows Security Events\",\"6dd2629c-534b-4275-8201-d7968b4fa77e\",\"Scheduled Task Hide\",\"DefenseEvasion\",\"T1562\"\r\n\"Windows Security Events\",\"d9f28fdf-abc8-4f1a-a7e7-1aaec87a2fc5\",\"Sdelete deployed via GPO and run recursively\",\"Impact\",\"T1485\"\r\n\"Windows Security Events\",\"2bc7b4ae-eeaa-4538-ba15-ef298ec1ffae\",\"Starting or Stopping HealthService to Avoid Detection\",\"DefenseEvasion\",\"T1562.001\"\r\n\"Windows Security Events\",\"2c55fe7a-b06f-4029-a5b9-c54a2320d7b8\",\"Process Execution Frequency Anomaly\",\"Execution\",\"T1059\"\r\n\"Windows Security Events\",\"62085097-d113-459f-9ea7-30216f2ee6af\",\"AD user enabled and password not set within 48 hours\",\"Persistence\",\"T1098\"\r\n\"Windows Server DNS\",\"a0907abe-6925-4d90-af2b-c7e89dc201a6\",\"Potential DGA detected\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"Windows Server DNS\",\"15ae38a2-2e29-48f7-883f-863fb25a5a06\",\"Rare client observed with high reverse DNS lookup count\",\"Discovery\",\"T1046\"\r\n\"Windows Server DNS\",\"0d76e9cf-788d-4a69-ac7d-f234826b5bed\",\"DNS events related to mining pools\",\"Impact\",\"T1496\"\r\n\"Windows Server DNS\",\"a83ef0f4-dace-4767-bce3-ebd32599d2a0\",\"DNS events related to ToR proxies\",\"Exfiltration\",\"T1048\"\r\n\"Windows Server DNS\",\"d5b32cd4-2328-43da-ab47-cd289c1f5efc\",\"NRT DNS events related to mining pools\",\"Impact\",\"T1496\"\r\n\"ZeroFox\",\"deb45e6d-892f-40bf-9118-e2a6f26b788d\",\"ZeroFox Alerts - High Severity Alerts\",\"ResourceDevelopment InitialAccess\",\"T1583 T1586 T1566\"\r\n\"ZeroFox\",\"6f7a7413-b72f-4361-84ee-897baeb9c6d4\",\"ZeroFox Alerts - Informational Severity Alerts\",\"ResourceDevelopment InitialAccess\",\"T1583 T1586 T1566\"\r\n\"ZeroFox\",\"e0c7a91a-7aa1-498a-9c20-cd6c721f9345\",\"ZeroFox Alerts - Low Severity Alerts\",\"ResourceDevelopment InitialAccess\",\"T1583 T1586 T1566\"\r\n\"ZeroFox\",\"a6496de5-911b-4199-b7db-d34ac9d70df3\",\"ZeroFox Alerts - Medium Severity Alerts\",\"ResourceDevelopment InitialAccess\",\"T1583 T1586 T1566\"\r\n\"ZeroNetworks\",\"a4ce12ca-d01d-460a-b15e-6c74ef328b82\",\"Zero Networks Segement - Machine Removed from protection\",\"DefenseEvasion\",\"T1562\"\r\n\"ZeroNetworks\",\"603a6b18-b54a-43b7-bb61-d2b0b47d224a\",\"Zero Networks Segment - New API Token created\",\"CredentialAccess\",\"T1528\"\r\n\"ZeroNetworks\",\"58688058-68b2-4b39-8009-ac6dc4d81ea1\",\"Zero Networks Segment - Rare JIT Rule Creation\",\"LateralMovement\",\"T1021\"\r\n\"ZeroTrust(TIC3.0)\",\"4942992d-a4d3-44b0-9cf4-b5a23811d82d\",\"ZeroTrust(TIC3.0) Control Assessment Posture Change\",\"Discovery\",\"T1082\"\r\n\"Zinc Open Source\",\"3705158d-e008-49c9-92dd-e538e1549090\",\"AV detections related to Zinc actors\",\"Impact\",\"T1486\"\r\n\"Zinc Open Source\",\"9a7f6651-801b-491c-a548-8b454b356eaa\",\"Zinc Actor IOCs files - October 2022\",\"Persistence\",\"T1546\"\r\n\"Zinc Open Source\",\"95543d6d-f00d-4193-a63f-4edeefb7ec36\",\"[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022\",\"Persistence\",\"T1546\"\r\n\"Zscaler Internet Access\",\"010bd98c-a6be-498c-bdcd-502308c0fdae\",\"Discord CDN Risky File Download\",\"CommandAndControl\",\"T1071.001\"\r\n\"Zscaler Internet Access\",\"4d500e6d-c984-43a3-9f39-7edec8dcc04d\",\"Request for single resource on domain\",\"CommandAndControl\",\"T1102 T1071\"\r\n\"Zscaler Private Access (ZPA)\",\"40a98355-0e52-479f-8c91-4ab659cba878\",\"Zscaler - Shared ZPA session\",\"InitialAccess\",\"T1078 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"593e3e2a-43ce-11ec-81d3-0242ac130003\",\"Zscaler - Unexpected event count of rejects by policy\",\"InitialAccess\",\"T1078  T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"b3d112b4-3e1e-11ec-9bbc-0242ac130002\",\"Zscaler - Forbidden countries\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"672e2846-4226-11ec-81d3-0242ac130003\",\"Zscaler - Unexpected update operation\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"66bc77ee-3e45-11ec-9bbc-0242ac130002\",\"Zscaler - Connections by dormant user\",\"Persistence\",\"T1078\"\r\n\"Zscaler Private Access (ZPA)\",\"236a7ec1-0120-40f2-a157-c1a72dde8bcb\",\"Zscaler - ZPA connections by new user\",\"Persistence\",\"T1078\"\r\n\"Zscaler Private Access (ZPA)\",\"c4902121-7a7e-44d1-810b-88d26db622ff\",\"Zscaler - ZPA connections from new country\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"24f0779d-3927-403a-aac1-cc8791653606\",\"Zscaler - ZPA connections from new IP\",\"InitialAccess\",\"T1078 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"2859ad22-46c8-4cc7-ad7b-80ce0cba0af3\",\"Zscaler - ZPA connections outside operational hours\",\"InitialAccess\",\"T1190  T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"e07846e0-43ad-11ec-81d3-0242ac130003\",\"Zscaler - Unexpected ZPA session duration\",\"InitialAccess\",\"T1078  T1133\"\r\n\"vArmour Application Controller\",\"a36de6c3-3198-4d37-92ae-e19e36712c2e\",\"vArmour AppController - SMB Realm Traversal\",\"Discovery LateralMovement\",\"T1135 T1570\""
        },
        "apiVersion": "2022-08-01"
        },
        {
          "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/_hqueries_')]",
          "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists",
          "kind": "",
          "properties": {
              "displayName": "_hqueries_",
              "source": "csv",
              "description": "_hqueries_",
              "provider": "Microsoft",
              "isDeleted": false,
              "labels": [
              ],
              "defaultDuration": "P1000Y",
              "contentType": "Text/Csv",
              "numberOfLinesToSkip": 0,
              "itemsSearchKey": "id",
              "rawContent": "solution,id,name,tactics,techniques\r\n\"Amazon Web Services\",\"2b8cecfe-f705-432d-9f38-08207b9473e1\",\"IAM assume role policy brute force\",\"Credential Access\",\"T1110\"\r\n\"Amazon Web Services\",\"48c49b1d-2aa0-442b-96e3-cae6ad1251cd\",\"Bucket versioning suspended\",\"Impact\",\"T1485\"\r\n\"Amazon Web Services\",\"a2772445-9bb1-4176-9481-b262cb59118a\",\"New access key created to user\",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"4e3c81bf-61a4-47f4-b20d-a5a414ea08aa\",\"CreateLoginProfile detected \",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"81a8880f-cc20-40ce-98d6-2fc6a1c5b9a4\",\"Suspicious EC2 launched without a key pair\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"b5b172b1-d976-4113-af1f-02f7bf7d2092\",\"ECR image scan findings low\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"4fbbae0a-ce5b-4b2a-b5e6-700920561680\",\"ECR image scan findings medium\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"c9ccaebf-314c-446d-b3f6-314560ccb0e1\",\"Excessive execution of discovery events \",\"Discovery\",\"T1526\"\r\n\"Amazon Web Services\",\"13afb771-5d55-4d69-a745-83d2fc69a923\",\"Failed brute force on S3 bucket\",\"Discovery\",\"T1619\"\r\n\"Amazon Web Services\",\"bf130d1d-702b-4af6-9528-8bc4229e59f4\",\"Multiple failed login attempts to an existing user without MFA\",\"Credential Access\",\"T1110\"\r\n\"Amazon Web Services\",\"7e258a45-b356-44f6-9a62-2643cef7b869\",\"IAM AccessDenied discovery events\",\"Discovery\",\"T1087\"\r\n\"Amazon Web Services\",\"d022a62c-643b-4e8a-b583-0230e32a96e4\",\"Changes made to AWS IAM objects\",\"PrivilegeEscalation DefenseEvasion\",\"T1078 T1484\"\r\n\"Amazon Web Services\",\"e0a67cd7-b4e5-4468-aae0-26cb16a1bbd2\",\"Changes made to AWS IAM policy \",\"PrivilegeEscalation DefenseEvasion\",\"T1078 T1484\"\r\n\"Amazon Web Services\",\"e1a91db8-f2b3-4531-bff6-da133d4f4f1a\",\"IAM Privilege Escalation by Instance Profile attachment\",\"PrivilegeEscalation\",\"T1098\"\r\n\"Amazon Web Services\",\"d82ea1db-f600-4c9e-8ba8-d271e9c12eb8\",\"Lambda function throttled\",\"Impact\",\"T1498\"\r\n\"Amazon Web Services\",\"77d0aadc-aaea-4346-b61a-bf7ac6b71bba\",\"Lambda layer imported from external account\",\"Persistence\",\"T1525\"\r\n\"Amazon Web Services\",\"2dd2143b-6667-4a7a-b04f-98d22caeffac\",\"Lambda UpdateFunctionCode\",\"Execution\",\"T1204\"\r\n\"Amazon Web Services\",\"838f59d4-fe47-422b-819d-1be502940547\",\"Login profile updated\",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"3b7df29e-a798-4b6b-9ef7-73b9a3cf56a2\",\"Modification of route-table attributes\",\"Defense Evasion\",\"T1562\"\r\n\"Amazon Web Services\",\"05167149-4670-4a9f-b34e-5a0a92243194\",\"Modification of subnet attributes\",\"Defense Evasion\",\"T1562\"\r\n\"Amazon Web Services\",\"a3a19731-9e82-49b6-9142-2dd570feefd5\",\"Modification of vpc attributes\",\"Defense Evasion\",\"T1562\"\r\n\"Amazon Web Services\",\"49bae199-ea04-4a2e-95a6-e3a1f68ab259\",\"Network ACL deleted\",\"Defense Evasion\",\"T1562\"\r\n\"Amazon Web Services\",\"4055466c-8a84-44c6-91d0-46469f3ba0b9\",\"New AccessKey created for Root user\",\"Persistence\",\"T1078\"\r\n\"Amazon Web Services\",\"e73ebd34-4f04-4684-a5f0-dba820127ce8\",\"CreatePolicyVersion with excessive permissions\",\"Privilege Escalation\",\"T1484\"\r\n\"Amazon Web Services\",\"0db42a94-e7c8-4bf1-99a7-1a2fb4158212\",\"Privileged role attached to Instance\",\"PrivilegeEscalation\",\"T1098\"\r\n\"Amazon Web Services\",\"b9b0fd12-d72d-4f66-a013-c1acdeea2670\",\"RDS instance master password changed\",\"Privilege Escalation\",\"T1484\"\r\n\"Amazon Web Services\",\"70c36558-e6d8-48b4-98b3-185d555cd5af\",\"Risky role \",\"Persistence\",\"T1098\"\r\n\"Amazon Web Services\",\"356aa5a8-fa6f-4eb9-baa9-ffcf725e3e82\",\"S3 bucket has been deleted\",\"Impact\",\"T1485\"\r\n\"Amazon Web Services\",\"6eb59239-78c5-401d-acfa-5cb9b3d31cd4\",\"S3 bucket encryption modified\",\"Impact\",\"T1486\"\r\n\"Amazon Web Services\",\"82ecf967-d6e9-4757-8f5d-42c562a8f05f\",\"Suspicious activity of STS token related to EC2\",\"Credential Access\",\"T1528\"\r\n\"Amazon Web Services\",\"67af1633-311f-4a94-bc8f-f904a54637b2\",\"Suspicious activity of STS token related to ECS\",\"Credential Access\",\"T1528\"\r\n\"Amazon Web Services\",\"0cd3eb95-6c8e-4eeb-8338-a0decdc0a328\",\"Suspicious activity of STS token related to Glue\",\"Credential Access\",\"T1528\"\r\n\"Amazon Web Services\",\"46685737-676a-4084-8e98-31b2998062db\",\"Suspicious activity of STS Token related to Kubernetes worker node\",\"Credential Access\",\"T1528\"\r\n\"Amazon Web Services\",\"70a6e84f-6f3b-4ce1-83d6-ea6df9e7a9dd\",\"Suspicious activity of STS token related to Lambda\",\"Credential Access\",\"T1528\"\r\n\"Amazon Web Services\",\"5b6ee21d-da53-46eb-827c-eab2a9ba3d2f\",\"Suspicious credential token access of valid IAM Roles\",\"InitialAccess DefenseEvasion\",\"T1078\"\r\n\"Amazon Web Services\",\"e0d57543-acbd-428b-bb96-24a67506f84d\",\"Unused or Unsupported Cloud Regions\",\"DefenseEvasion\",\"T1535\"\r\n\"Apache Log4j Vulnerability Detection\",\"38cc38c3-bd6c-470e-ae1a-3136a9ded97f \",\"Possible exploitation of Apache log4j component detected\",\"Persistence Execution \",\"T1059 T1053 \"\r\n\"Apache Log4j Vulnerability Detection\",\"78882f9a-f3ef-4010-973c-3f6336f5bef7\",\"Suspicious Base64 download activity detected\",\"Persistence Execution\",\"T1059 T1053\"\r\n\"Apache Log4j Vulnerability Detection\",\"6fee32b3-3271-4a3f-9b01-dbd9432a1707\",\"Possible Container Miner related artifacts detected\",\"Impact Execution\",\"T1496 T1203\"\r\n\"Apache Log4j Vulnerability Detection\",\"e178baf5-3cf3-4960-8ca4-8da6d90d8206\",\"Suspicious manipulation of firewall detected via Syslog data\",\"DefenseEvasion\",\"T1562\"\r\n\"Apache Log4j Vulnerability Detection\",\"09e45ec6-ac42-4b5a-be69-54623c4aa062\",\"Possible Linux attack toolkit detected via Syslog data\",\"Reconnaissance Execution\",\"T1595 T1203\"\r\n\"Apache Log4j Vulnerability Detection\",\"bf094505-fd2e-484f-b72a-acd79ee00ce8\",\"Network Connection to New External LDAP Server\",\"InitialAccess\",\"T1190\"\r\n\"Apache Log4j Vulnerability Detection\",\"19abc034-139e-4e64-a05d-cb07ce8b003b\",\"Malicious Connection to LDAP port for CVE-2021-44228 vulnerability\",\"CommandAndControl\",\"T1071\"\r\n\"Apache Log4j Vulnerability Detection\",\"020b05d3-6447-402c-87b6-f8faff7c7e19\",\"Linux security related process termination activity detected\",\"DefenseEvasion\",\"T1489\"\r\n\"Apache Log4j Vulnerability Detection\",\"3e43fe23-c6c0-45ca-b680-263e8afada95\",\"Suspicious Shell script detected\",\"Persistence Execution\",\"T1059 T1053\"\r\n\"Apache Log4j Vulnerability Detection\",\"1d4d383e-0ca6-4d3a-a861-8f37aeef18cb\",\"Azure WAF Log4j CVE-2021-44228 hunting\",\"InitialAccess\",\"T1190\"\r\n\"ApacheHTTPServer\",\"afe13b7c-38b8-11ec-8d3d-0242ac130003\",\"Apache - Top files requested with errors\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"456ab502-38b8-11ec-8d3d-0242ac130003\",\"Apache - Top Top files requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"ae48a600-3ae9-11ec-8d3d-0242ac130003\",\"Apache - Rare files requested \",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"5ce3f2ed-0c81-407f-ae12-6ea00a6d9873\",\"Apache - Rare user agents with client errors\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"4c1a164e-3ae9-11ec-8d3d-0242ac130003\",\"Apache - Rare URLs requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"d2e85f1a-3ae8-11ec-8d3d-0242ac130003\",\"Apache - Rare user agents\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"017d1bee-3aea-11ec-8d3d-0242ac130003\",\"Apache - Requests to unexisting files \",\"InitialAccess\",\"T1190 T1133\"\r\n\"ApacheHTTPServer\",\"c21ea046-3ae7-11ec-8d3d-0242ac130003\",\"Apache - Unexpected Post Requests\",\"Persistence CommandAndControl\",\"T1100 T1505 T1071\"\r\n\"ApacheHTTPServer\",\"28961fc8-3892-11ec-8d3d-0242ac130003\",\"Apache - Top URLs with client errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"ApacheHTTPServer\",\"ccdd22c6-3896-11ec-8d3d-0242ac130003\",\"Apache - Top URLs with server errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"AtlassianJiraAudit\",\"3fdc31f0-a166-4a4d-b861-f3cd262fd4a1\",\"Jira - Blocked tasks\",\"Impact\",\"T1499\"\r\n\"AtlassianJiraAudit\",\"aadc0945-a399-47ba-b285-c0c09ee06375\",\"Jira - New users\",\"Persistence\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"103ccb8d-f910-4978-aba7-1ad598db822b\",\"Jira - Project versions released\",\"Impact\",\"T1565\"\r\n\"AtlassianJiraAudit\",\"e78cb74b-576b-4e35-a46c-8d328b2d4040\",\"Jira - Project versions\",\"Impact\",\"T1565\"\r\n\"AtlassianJiraAudit\",\"eb409b8b-0267-4e95-b3a9-ee1a72c32409\",\"Jira - Updated projects\",\"Impact\",\"T1565\"\r\n\"AtlassianJiraAudit\",\"d208b406-1509-455c-8c7d-7ffe2f893f24\",\"Jira - Updated users\",\"PrivilegeEscalation Impact\",\"T1531 T1078\"\r\n\"AtlassianJiraAudit\",\"3e6ff26d-05dc-4921-9a60-444a0e28cd45\",\"Jira - Updated workflow schemes\",\"Impact\",\"T1565\"\r\n\"AtlassianJiraAudit\",\"d4dd32bb-84a4-4fdc-9118-3039cbabb4f8\",\"Jira - Updated workflows\",\"Impact\",\"T1565\"\r\n\"AtlassianJiraAudit\",\"2265bbd2-7e97-4d69-bdfc-eeb646730d8f\",\"Jira - Users' IP addresses\",\"Persistence\",\"T1078\"\r\n\"AtlassianJiraAudit\",\"2f875fa8-ced3-4059-b453-616dbc6eb276\",\"Jira - Workflow schemes added to projects\",\"Impact\",\"T1565\"\r\n\"Attacker Tools Threat Protection Essentials\",\"dde206fc-3f0b-4175-bb5d-42d2aae9d4c9\",\"Cobalt Strike DNS Beaconing\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"Attacker Tools Threat Protection Essentials\",\"24ae555c-5e33-4b5d-827a-44206e39f6b4\",\"Potential Impacket Execution\",\"CredentialAccess\",\"T1557.001 T1040 T1003.001 T1003.002 T1003.003 T1003.004 T1558.003\"\r\n\"Authomize\",\"b3430fb5-78aa-4729-8595-f66c06138478\",\"Admin SaaS account detected\",\"PrivilegeEscalation\",\"T1089\"\r\n\"Authomize\",\"bf03796a-3ed7-440f-bfc3-0c702cf762a9\",\"ateral Movement Risk - Role Chain Length\",\"PrivilegeEscalation\",\"T1089\"\r\n\"Authomize\",\"ab80b41c-23e5-4264-ac23-806aad2a57af\",\"IaaS admin detected\",\"PrivilegeEscalation\",\"T1089\"\r\n\"Authomize\",\"fad675f5-b743-40c6-873d-019de93f18db\",\"IaaS shadow admin detected\",\"PrivilegeEscalation\",\"T1089\"\r\n\"Authomize\",\"485e7cab-131e-40ce-9482-791e681b7967\",\"Password Exfiltration over SCIM application\",\"CredentialAccess\",\"T1555 T1040 T1552 T1555.003 T1552.005\"\r\n\"Authomize\",\"7457a420-8c28-4ce2-a55e-d050e5a6bc4f\",\"Privileged Machines Exposed to the Internet\",\"Discovery\",\"T1613\"\r\n\"Azure Activity\",\"ef7ef44e-6129-4d8e-94fe-b5530415d8e5\",\"Microsoft Sentinel Analytics Rules Administrative Operations\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"43cb0347-bdcc-4e83-af5a-cebbd03971d8\",\"Anomalous Azure Operation Hunting Model\",\"LateralMovement CredentialAccess\",\"T1570 T1078.004\"\r\n\"Azure Activity\",\"5d2399f9-ea5c-4e67-9435-1fba745f3a39\",\"Azure storage key enumeration\",\"Discovery\",\"T1087\"\r\n\"Azure Activity\",\"1b8779c9-abf2-444f-a21f-437b8f90ac4a\",\"AzureActivity Administration From VPS Providers\",\"InitialAccess\",\"T1078\"\r\n\"Azure Activity\",\"e94d6756-981c-4f02-9a81-d006d80c8b41\",\"Azure Network Security Group NSG Administrative Operations\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"efe843ca-3ce7-4896-9f8b-f2c374ae6527\",\"Azure VM Run Command executed from Azure IP address\",\"LateralMovement CredentialAccess\",\"T1570 T1078.004\"\r\n\"Azure Activity\",\"17201aa8-0916-4078-a020-7ea3a9262889\",\"Microsoft Sentinel Connectors Administrative Operations\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"5a1f9655-c893-4091-8dc0-7f11d7676506\",\"Microsoft Sentinel Workbooks Administrative Operations\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"57784ba5-7791-422e-916f-65ef94fe1dbb\",\"Azure Virtual Network Subnets Administrative Operations\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"0278e3b8-9899-45c5-8928-700cd80d2d80\",\"Common deployed resources\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"a09e6368-065b-4f1e-a4ce-b1b3a64b493b\",\"Creation of an anomalous number of resources\",\"Impact\",\"T1496\"\r\n\"Azure Activity\",\"860cda84-765b-4273-af44-958b7cca85f7\",\"Granting permissions to account\",\"Persistence PrivilegeEscalation\",\"T1098\"\r\n\"Azure Activity\",\"9e146876-e303-49af-b847-b029d1a66852\",\"Port opened for an Azure Resource\",\"CommandAndControl Impact\",\"T1071 T1571 T1496\"\r\n\"Azure Activity\",\"81fd68a2-9ad6-4a1c-7bd7-18efe5c99081\",\"Rare Custom Script Extension\",\"Execution\",\"T1059\"\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"0a57accf-3548-4e38-a861-99687c958f59\",\"Palo Alto - high-risk ports\",\"InitialAccess Discovery\",\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"2f8522fc-7807-4f0a-b53d-458296edab8d\",\"Palo Alto - potential beaconing detected\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"Azure Firewall\",\"932fe71a-7a8c-4f35-bf88-321ab68ff562\",\"First Time Source IP to Destination Using Port\",\"Exfiltration CommandAndControl\",\r\n\"Azure Firewall\",\"f055e82b-5ef6-4395-bc9e-99f7e451343a\",\"First Time Source IP to Destination\",\"Exfiltration CommandAndControl\",\r\n\"Azure Firewall\",\"d006f4f8-86bb-4c9d-9826-837762ddad6b\",\"Source IP Abnormally Connects to Multiple Destinations\",\"Execution LateralMovement\",\r\n\"Azure Firewall\",\"8812a547-13e6-4d0c-b38d-476fb7351c52\",\"Uncommon Port for Organization\",\"Defense Evasion Exfiltration CommandAndControl\",\r\n\"Azure Firewall\",\"3d93fa57-53e5-4d5e-96d4-ad734a8df3a4\",\"Uncommon Port to IP\",\"Exfiltration CommandAndControl\",\r\n\"Azure SQL Database solution for sentinel\",\"724c7010-0afe-4d46-95ab-32f6737e658b\",\"Anomalous Query Execution Time\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"4cda0673-37f9-4765-af1f-556de2295cd7\",\"Boolean Blind SQL Injection\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"af55d5b0-6b4a-4874-8299-9d845bf7c1fd\",\"Anomalous Query Execution Time\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"2a21303e-be48-404f-a6f6-883a6acfe5ad\",\"Prevalence Based SQL Query Size Anomaly\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"db5b0a77-1b1d-4a31-8ebb-c508ebc3bb38\",\"Suspicious SQL Stored Procedures\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"e0944dec-3c92-4b2d-8e81-a950afeaba69\",\"Time Based SQL Query Size Anomaly\",\"InitialAccess\",\"T1190\"\r\n\"Azure SQL Database solution for sentinel\",\"9670ac84-e035-47f5-8eb5-9d863a8a7893\",\"Affected rows stateful anomaly on database - hunting query\",\"Impact\",\"T1485 T1565 T1491\"\r\n\"Azure SQL Database solution for sentinel\",\"137tyi7c-7225-434b-8bfc-fea28v95ebd8\",\"Response rows stateful anomaly on database - hunting query\",\"Exfiltration\",\"T1537 T1567\"\r\n\"Azure kubernetes Service\",\"765dce51-689a-44b5-9b38-c9ae9441c7fc\",\"Azure RBAC AKS created role details\",\"Persistence\",\"T1098\"\r\n\"Azure kubernetes Service\",\"c3ac03d5-dbf2-49ab-a2de-83396a20a5fb\",\"Determine users with cluster admin role\",\"Persistence\",\"T1098\"\r\n\"AzureDevOpsAuditing\",\"940386c3-4b2c-4147-ac8e-dcddedaaae52\",\"Azure DevOps - Build Check Deleted\",\"DefenseEvasion\",\"T1578\"\r\n\"AzureDevOpsAuditing\",\"47857f1f-f8e6-470d-b132-03a8a606b3f4\",\"Azure DevOps - Build Deleted After Pipeline Modification\",\"Persistence\",\"T1053\"\r\n\"AzureDevOpsAuditing\",\"20be967c-4923-4c4b-8e1d-e1c95d537dc3\",\"Azure DevOps - Internal Upstream Package Feed Added\",\"InitialAccess\",\"T1195\"\r\n\"AzureDevOpsAuditing\",\"76f626e0-4c78-47d4-aeb6-eaa59f4f2ecb\",\"Azure DevOps - New Agent Pool Created\",\"DefenseEvasion\",\"T1578\"\r\n\"AzureDevOpsAuditing\",\"5b6ab1d9-018b-46c6-993b-3198626fc54e\",\"Azure DevOps - New PAT Operation\",\"DefenseEvasion\",\"T1078\"\r\n\"AzureDevOpsAuditing\",\"3d1aa540-b4c7-4789-8c4c-4174b3c2371f\",\"Azure DevOps - New Package Feed Created\",\"InitialAccess\",\"T1195\"\r\n\"AzureDevOpsAuditing\",\"0c149cc9-78ba-4be1-9f7b-018288e3a829\",\"Azure DevOps - New Release Approver\",\"DefenseEvasion\",\"T1078\"\r\n\"AzureDevOpsAuditing\",\"2dfa9c23-1590-4589-995a-d1486be66028\",\"Azure DevOps - New Release Pipeline Created\",\"Persistence Execution PrivilegeEscalation\",\"T1053\"\r\n\"AzureDevOpsAuditing\",\"0fa523de-ce23-49d0-87a4-e890028e1e50\",\"Azure DevOps - Variable Created and Deleted\",\"DefenseEvasion\",\"T1578\"\r\n\"AzureDevOpsAuditing\",\"7b634263-9971-4887-8ecf-0d83ab9c7370\",\"Azure DevOps- Addtional Org Admin added \",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"AzureDevOpsAuditing\",\"cf0c493b-a8af-4b32-8c7e-d4303f3a406f\",\"Azure DevOps Display Name Changes\",\"Persistence DefenseEvasion\",\"T1098 T1036\"\r\n\"AzureDevOpsAuditing\",\"df205daf-fcf3-4b95-a7fd-043b70f6c209\",\"Azure DevOps Pull Request Policy Bypassing\",\"Execution\",\"T1098\"\r\n\"AzureDevOpsAuditing\",\"c78a3845-37d9-448e-a8cd-e9543f00bcc5\",\"Azure DevOps- Microsoft Entra ID Protection Conditional Access Disabled \",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"AzureDevOpsAuditing\",\"2380670e-e168-4a99-9529-6c4d127b3ce6\",\"Azure DevOps- Guest users access enabled\",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"AzureDevOpsAuditing\",\"42e69ff6-719d-4853-95a5-2b211e2bb031\",\"Azure DevOps- Project visibility changed to public\",\"Collection\",\"T1213\"\r\n\"AzureDevOpsAuditing\",\"800ae9c9-0280-4296-821f-c6e0a473fb41\",\"Azure DevOps- Public project enabled by admin\",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"AzureDevOpsAuditing\",\"3cdc5404-15ed-4656-8eb9-60bc8b495934\",\"Azure DevOps- Public project created\",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"Bitglass\",\"8702d847-e540-4a52-a419-6d617eb200ae\",\"Bitglass - Applications used\",\"Exfiltration\",\"T1078\"\r\n\"Bitglass\",\"5fc73535-738c-46ce-88a2-69bda3fada02\",\"Bitglass - Insecure web protocol\",\"Exfiltration\",\"T1567\"\r\n\"Bitglass\",\"70a04a5c-4a1c-4640-a5b0-20e183c856c8\",\"Bitglass - Login failures\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"fee15f4d-143f-4a2d-8f3d-dcf9e716f192\",\"Bitglass - New applications\",\"Exfiltration\",\"T1078\"\r\n\"Bitglass\",\"006f32a7-6c23-4f10-bafc-9eabece8a8de\",\"Bitglass - New users\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"126de8f9-6c61-44a9-960e-b294e6b12e9b\",\"Bitglass - Privileged login failures\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"3f21e7e2-0226-412c-87f0-262700a64db0\",\"Bitglass - Risky users\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"c862b799-aced-40fd-b600-d85d06d3505c\",\"Bitglass - Risky users\",\"InitialAccess\",\"T1078\"\r\n\"Bitglass\",\"1b45c098-8d65-4c50-9f7b-9108e71ecf60\",\"Bitglass - Uncategorized resources\",\"InitialAccess\",\"T1566\"\r\n\"Bitglass\",\"be63a941-4e04-4e86-af4c-a6b8a0ea5213\",\"Bitglass - User devices\",\"InitialAccess\",\"T1078\"\r\n\"Box\",\"949aec39-304d-4fba-94b3-15337d05e3f1\",\"Box - IP list for admin users\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"Box\",\"4b4a1802-8fcc-4eeb-9ccd-b5bb16f4b64b\",\"Box - Deleted users\",\"Impact\",\"T1531\"\r\n\"Box\",\"d8ef8d5c-97f3-4552-afca-75d44339fa8f\",\"Box - Inactive admin users\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Box\",\"c0a4169e-c713-484b-95a9-d8f437b52d66\",\"Box - Inactive users\",\"InitialAccess\",\"T1078\"\r\n\"Box\",\"c8e19aa5-3424-4b90-8594-79ee4613f429\",\"Box - New users\",\"PrivilegeEscalation Persistence\",\"T1078\"\r\n\"Box\",\"6b91dda7-d9c5-4197-9dea-0c41f7c55176\",\"Box - Suspicious or sensitive files\",\"Exfiltration\",\"T1048\"\r\n\"Box\",\"47e0a82d-fd66-4d6e-a64a-ac377f136426\",\"Box - Downloaded data volume per user\",\"Exfiltration Collection\",\"T1020 T1119 T1530\"\r\n\"Box\",\"5ff08015-2d1e-4c2b-862f-2759e6132d0e\",\"Box - New users\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Box\",\"484f9c1c-a8d6-4a78-b526-d38958ade100\",\"Box - Uploaded data volume per user\",\"Exfiltration Collection\",\"T1530 T1537\"\r\n\"Box\",\"09fee766-d5ba-4e8c-8e9e-363915aee1f4\",\"Box - Users with owner permissions\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"0ef8dee1-eb94-44c8-b59b-2eb096a4b983\",\"S3 Bucket outbound Data transfer anomaly\",\"Exfiltration\",\"T1020\"\r\n\"Business Email Compromise - Financial Fraud\",\"669e1338-b1a2-4d73-b720-a1e60d5d1474\",\"Suspicious Data Access to S3 Bucket from Unknown IP\",\"Collection\",\"T1530\"\r\n\"Business Email Compromise - Financial Fraud\",\"0576750e-6b61-4545-845f-f5b8f29a0cc4\",\"Email Forwarding Configuration with SAP download\",\"InitialAccess Collection Exfiltration\",\"T1078 T1114 T1020\"\r\n\"Business Email Compromise - Financial Fraud\",\"b7918a0a-c6fe-4b6d-9111-b0b0c477f1a8\",\"Login attempts using Legacy Auth\",\"InitialAccess Persistence\",\"T1078 T1098\"\r\n\"Business Email Compromise - Financial Fraud\",\"f50a26d7-ffdb-4471-90b9-3be78c60e4f2\",\"Office Mail Rule Creation with suspicious archive mail move activity\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Business Email Compromise - Financial Fraud\",\"2843e796-3d6c-4a78-a815-1db783b346a3\",\"High count download from a SAP Privileged account\",\"InitialAccess Exfiltration\",\"T1078 T1030\"\r\n\"Business Email Compromise - Financial Fraud\",\"99885ff5-00cf-49e8-9452-6de6aba2a5c7\",\"Successful Signin From Non-Compliant Device\",\"InitialAccess\",\"T1078.004\"\r\n\"Business Email Compromise - Financial Fraud\",\"8eace93b-f38c-47b7-a21d-739556d31db6\",\"User Accounts - New Single Factor Auth\",\"InitialAccess\",\"T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"f56b2223-0d4d-4347-9de4-822d195624ee\",\"User Accounts - Unusual authentications occurring when countries do not conduct normal business operations.\",\"InitialAccess\",\"T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"8c5bc38a-438d-48fb-ae3f-7f356d3e5ba9\",\"User detection added to privilege groups based in Watchlist \",\"Reconnaissance PrivilegeEscalation\",\"T1548\"\r\n\"Business Email Compromise - Financial Fraud\",\"09a7c5fc-0649-4f7d-a21b-36a754cef6b6\",\"User Login IP Address Teleportation\",\"InitialAccess\",\"T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"41fa6e2d-afe9-4398-9356-cec3a927e44e\",\"Microsoft Entra ID signins from new locations\",\"InitialAccess\",\"T1078\"\r\n\"Business Email Compromise - Financial Fraud\",\"bfacf634-c75e-4291-998c-ecbc0323d943\",\"Risky Sign-in with new MFA method\",\"Persistence\",\"T1078.004\"\r\n\"Cisco ISE\",\"72f60667-2a6d-421d-b98d-3d7c3b37a0e5\",\"CiscoISE - Authentication attempts to suspended user account\",\"InitialAccess CredentialAccess\",\r\n\"Cisco ISE\",\"98d1384d-5aef-430c-875c-3b4434afb003\",\"CiscoISE - Dynamic authorization failed\",\"InitialAccess\",\r\n\"Cisco ISE\",\"c6ebac93-18af-43e3-b757-d6cb147a74b9\",\"CiscoISE - Expired certificate in the client certificates chain\",,\r\n\"Cisco ISE\",\"9cb9ef9e-4f4d-4437-8abe-249589e72931\",\"CiscoISE - Failed authentication events\",\"CredentialAccess\",\r\n\"Cisco ISE\",\"64b63d2d-a867-4451-bf74-f2310398498e\",\"CiscoISE - Failed login attempts via SSH CLI (users)\",\"LateralMovement\",\r\n\"Cisco ISE\",\"3935b084-2fa1-461a-b920-1e20c1acff7b\",\"CiscoISE - Guest authentication failed\",\"CredentialAccess\",\r\n\"Cisco ISE\",\"377a4eb8-ced4-4e2b-a2f5-731db8f78275\",\"CiscoISE - Guest authentication succeeded\",\"InitialAccess Persistence PrivilegeEscalation DefenseEvasion\",\r\n\"Cisco ISE\",\"32abe28a-c1c8-4eb4-adfb-858abdbacbfe\",\"CiscoISE - Rare or new useragent\",\"InitialAccess\",\r\n\"Cisco ISE\",\"4fb45425-b758-41d8-80bc-843b5b0f119e\",\"CiscoISE - Sources with high number of Failed Authentication events\",\"CredentialAccess\",\r\n\"Cisco ISE\",\"abea259e-7d56-48d8-ae47-d159929eeed8\",\"CiscoISE - Attempts to suspend the log collector\",\"DefenseEvasion\",\r\n\"Cisco Secure Endpoint\",\"2b2415f3-6bfd-48df-8f9f-a1ccf67449f5\",\"Cisco SE - Infected hosts\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"f597ff7a-bddc-4cb1-83a8-62b0d7f4740d\",\"Cisco SE - Infected users\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"987681e4-3f0f-484c-95c1-88044b07759b\",\"Cisco SE - User Logins\",\"InitialAccess\",\"T1078\"\r\n\"Cisco Secure Endpoint\",\"d074fc1b-e276-48c8-9ef4-d691652a6625\",\"Cisco SE - Malicious files\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"0c478995-c9c0-44ad-b3e9-428d54851b0c\",\"Cisco SE - Modified agents on hosts\",\"DefenseEvasion\",\"T1562\"\r\n\"Cisco Secure Endpoint\",\"fd6f8d2b-416d-4ee6-8289-961022205d7e\",\"Cisco SE - Rare scanned files\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"1eae0963-16be-4d49-9491-6fc54f8254fd\",\"Cisco SE - Scanned files\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"31c92a55-375a-4199-8407-d2863476d85d\",\"Cisco SE - Suspicious powershel downloads\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"dc87c967-61d2-48e9-9fe1-26920944ca57\",\"Cisco SE - Uncommon application behavior\",\"Execution\",\"T1204.002\"\r\n\"Cisco Secure Endpoint\",\"3d3330e9-d11b-4b68-8861-251253950bd2\",\"Cisco SE - Vulnerable applications\",\"Execution\",\"T1204.002\"\r\n\"CiscoDuoSecurity\",\"421bbeed-ad5b-4acd-9f0b-6b609da33914\",\"Cisco Duo - Admin failure authentications\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"c6386cad-2dd2-436c-a938-bc66dda6c01a\",\"Cisco Duo - Delete actions\",\"Impact\",\"T1531\"\r\n\"CiscoDuoSecurity\",\"385b0938-3922-48ab-a57a-cb8650ab71a3\",\"Cisco Duo - Admin failure authentications\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"b8c43652-1b79-4b18-a348-a719bafad6d3\",\"Cisco Duo - Authentication errors\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"5653900e-4b21-408d-84da-e4db3da891bb\",\"Cisco Duo - Authentication error reasons\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"5d0b00fd-1dc0-4e1b-ae09-5cec3b4fadf6\",\"Cisco Duo - Deleted users\",\"Impact\",\"T1531\"\r\n\"CiscoDuoSecurity\",\"b8f46142-cebc-435d-9943-2ed74e1eaba7\",\"Cisco Duo - Fraud authentications\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"72c81132-bc09-4a2f-9c32-02e2e9ee7978\",\"Cisco Duo - New users\",\"InitialAccess Persistence\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"9de62fee-f601-43c9-8757-2098e59fedeb\",\"Cisco Duo - Devices with vulnerable OS\",\"InitialAccess\",\"T1078\"\r\n\"CiscoDuoSecurity\",\"c308e737-e620-4c89-ab1e-a186e901b087\",\"Cisco Duo - Devices with unsecure settings\",\"InitialAccess\",\"T1078\"\r\n\"CiscoSEG\",\"efb45608-3955-4915-8a46-ef5d7160cef7\",\"Cisco SEG - Dropped incoming mails\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"805b5625-8a04-4ca5-bab5-7c8cb383b3e3\",\"Cisco SEG - Dropped outgoing mails\",\"Exfiltration\",\"T1030\"\r\n\"CiscoSEG\",\"d7ea4577-1192-49da-96a2-b6d8219c6ac0\",\"Cisco SEG - DKIM failures\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"8bd157d3-2613-4a36-83e2-ec55332ed7f7\",\"Cisco SEG - DMARK failures\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"215a747d-5a5e-4596-b399-85ff5cc572bd\",\"Cisco SEG - SPF failures\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"4511f6a0-c174-4ccc-a851-24b14022e217\",\"Cisco SEG - Failed incoming TLS connections\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"aeb733e3-34e9-4724-97c7-c6ad31ea39e5\",\"Cisco SEG - Failed outgoing TLS connections\",\"Impact\",\"T1565\"\r\n\"CiscoSEG\",\"2389de0a-f53f-4a11-b01b-1adce5f26287\",\"Cisco SEG - Insecure protocol\",\"Impact\",\"T1565\"\r\n\"CiscoSEG\",\"7895ffa5-cd61-43cf-89e5-9630e79685fd\",\"Cisco SEG - Sources of spam mails\",\"InitialAccess\",\"T1566\"\r\n\"CiscoSEG\",\"064b1051-d8ac-4ef2-a537-30d32b4c27d9\",\"Cisco SEG - Top users receiving spam mails\",\"InitialAccess\",\"T1566\"\r\n\"CiscoUmbrella\",\"c92741e6-8454-40bb-8830-069cb86946c6\",\"Cisco Umbrella - Anomalous FQDNs for domain\",\"CommandAndControl\",\"T1071\"\r\n\"CiscoUmbrella\",\"c92741e6-8454-40bb-8830-069cb86946c6\",\"Cisco Umbrella - Anomalous FQDNs for domain\",\"CommandAndControl\",\"T1071\"\r\n\"CiscoUmbrella\",\"22e5e573-409b-433f-91de-50d6f0ad5a9e\",\"Cisco Umbrella - 'Blocked' User-Agents.\",\"Exfiltration\",\"T1020\"\r\n\"CiscoUmbrella\",\"26aebe0d-9a4f-456d-bbb9-9f4c9c5d28ca\",\"Cisco Umbrella - DNS Errors.\",\"InitialAccess\",\"T1189\"\r\n\"CiscoUmbrella\",\"bd1457df-3e81-4218-a079-0963200c8d67\",\"Cisco Umbrella - DNS requests to unreliable categories.\",\"InitialAccess\",\"T1189\"\r\n\"CiscoUmbrella\",\"55393e5b-3f7e-4d40-85e5-38ef9ecd8484\",\"Cisco Umbrella - Higher values of count of the Same BytesIn size\",\"CommandAndControl\",\"T1071\"\r\n\"CiscoUmbrella\",\"975419eb-7041-419c-b8f0-c4bf513cf2b2\",\"Cisco Umbrella - High values of Uploaded Data\",\"Exfiltration\",\"T1020\"\r\n\"CiscoUmbrella\",\"85421f18-2de4-42ff-9ef4-058924dcb1bf\",\"Cisco Umbrella - Possible connection to C2.\",\"CommandAndControl\",\"T1071\"\r\n\"CiscoUmbrella\",\"497d7250-87e1-49b1-a096-94f61c7ade9c\",\"Cisco Umbrella - Possible data exfiltration\",\"Exfiltration\",\"T1020\"\r\n\"CiscoUmbrella\",\"daf2f3cf-0f0d-45c1-b428-3c23d643859b\",\"Cisco Umbrella - Proxy 'Allowed' to unreliable categories.\",\"InitialAccess\",\"T1189\"\r\n\"CiscoUmbrella\",\"de2ec986-ee24-465f-adf2-b718997074c1\",\"Cisco Umbrella - Requests to uncategorized resources\",\"InitialAccess\",\"T1071\"\r\n\"CiscoWSA\",\"ebbd2b87-44c6-481a-8e4f-eaf5aa76e017\",\"Cisco WSA - Blocked files\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"686ec2d3-fdbb-4fa2-b834-ff1d0f2486fb\",\"Cisco WSA - Rare aplications\",\"CommandAndControl Exfiltration\",\"T1048 T1567\"\r\n\"CiscoWSA\",\"6d4d7689-5e1d-4687-b1fc-eb0b7340c9a3\",\"Cisco WSA - Top aplications\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"aaf6ba04-7a00-401e-a650-06e213f3bfbc\",\"Cisco WSA - Top URLs\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"deddf5e8-8fee-4ec5-9121-415eb954c34d\",\"Cisco WSA - Uncategorized URLs\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"9d08418d-e21e-4fd6-b9bc-d80ce786d2da\",\"Cisco WSA - Uploaded files\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"88edb5d8-3ad9-4004-aefa-43c289483935\",\"Cisco WSA - Rare URL with error\",\"InitialAccess CommandAndControl\",\"T1189 T1048\"\r\n\"CiscoWSA\",\"04582ef2-42be-4371-9ecf-635337c92ddb\",\"Cisco WSA - URL shorteners\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"8c35faed-a8cf-4d8d-8c67-f14f2ff6e7e9\",\"Cisco WSA - Potentially risky resources\",\"InitialAccess\",\"T1189\"\r\n\"CiscoWSA\",\"77ec347d-db28-4556-8a5a-dbc2ec7c9461\",\"Cisco WSA - User errors\",\"InitialAccess CommandAndControl\",\"T1189 T1048\"\r\n\"Claroty\",\"6b24f3aa-01db-4d26-9d60-538dd9a56391\",\"Claroty - Baseline deviation\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"8038c683-f4dc-481e-94c6-f906d880b0ec\",\"Claroty - Conflict assets\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"a81f3a44-049c-409d-8b98-b78aa256dacf\",\"Claroty - Critical Events\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"15569b45-4c34-4693-bf99-841e76b5da65\",\"Claroty - PLC logins\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"917364b7-2925-4c5d-a27c-64137a3b75b5\",\"Claroty - User failed logins\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"6c43a50e-2e59-48d9-848b-825f50927bbf\",\"Claroty - Network scan sources\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"8e70ddf9-32c3-4acd-9cb9-59570344335e\",\"Claroty - Network scan targets\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"de0fca32-85f3-45df-872e-41e980e5d8d3\",\"Claroty - Unapproved access\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"fad6cb81-9a05-4acb-9c5b-a7c62af28034\",\"Claroty - Unresolved alerts\",\"InitialAccess\",\"T1190\"\r\n\"Claroty\",\"3882ffbf-6228-4e1f-ab8f-8d79a26da0fb\",\"Claroty - Write and Execute operations\",\"InitialAccess\",\"T1190\"\r\n\"Cloud Identity Threat Protection Essentials\",\"c7941212-4ff9-4d2d-b38d-54d78fa087cc\",\"Application Granted EWS Permissions\",\"Collection PrivilegeEscalation\",\"T1078.004 T1114.002\"\r\n\"Cloud Identity Threat Protection Essentials\",\"b00f127c-46fa-40bd-9ab6-b266974d29cc\",\"Detect Disabled Account Sign-in Attempts by Account Name\",\"InitialAccess\",\"T1078\"\r\n\"Cloud Identity Threat Protection Essentials\",\"0cd51b2e-d3b2-4001-8e3f-5cbb604f69b2\",\"Detect Disabled Account Sign-in Attempts by IP Address\",\"InitialAccess\",\"T1078\"\r\n\"Cloud Identity Threat Protection Essentials\",\"86490334-5371-40a2-971a-3749c2654954\",\"Sign-ins From VPS Providers\",\"InitialAccess\",\"T1078\"\r\n\"Cloud Identity Threat Protection Essentials\",\"cdc9b092-8a16-4559-9e5e-831877e8209a\",\"Sign-ins from Nord VPN Providers\",\"InitialAccess\",\"T1078\"\r\n\"Cloud Identity Threat Protection Essentials\",\"4696e072-aca8-4a4f-bf05-89fddc5ac3c9\",\"Interactive STS refresh token modifications\",\"CredentialAccess\",\"T1550.001\"\r\n\"Cloud Identity Threat Protection Essentials\",\"a73c52f2-b3a5-4fe4-be7d-4d59b8558590\",\"Suspicious Sign-ins to Privileged Account\",\"InitialAccess\",\"T1078\"\r\n\"Cloud Identity Threat Protection Essentials\",\"2b6a3882-d601-4298-983b-880f6dc7acdb\",\"User Granted Access and Grants Access to Other Users\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Cloud Service Threat Protection Essentials\",\"8eff7055-9138-4edc-b8f0-48ea27e23c3c\",\"Azure Key Vault Access Policy Manipulation\",\"CredentialAccess\",\"T1555\"\r\n\"Cloud Service Threat Protection Essentials\",\"8d5996b2-7d4c-4dcf-bb0d-0d7fdf0e2c75\",\"Azure Resources Assigned Public IP Addresses\",\"Impact\",\"T1496\"\r\n\"Cloudflare\",\"5d72f483-929a-498a-b840-dff7deed2116\",\"Cloudflare - Client errors\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"Cloudflare\",\"20ef3865-fd1f-44a4-ac8f-8d026cf954e0\",\"Cloudflare - Client TLS errors\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"Cloudflare\",\"d72d0055-ae52-43b5-859e-db72e5ef183a\",\"Cloudflare - Files requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"a6f1938f-2f87-446c-83ac-624c277cfd32\",\"Cloudflare - Rare user agents\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"7c8f0bed-b25c-4d48-9afa-c505e141bf4b\",\"Cloudflare - Server errors\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"Cloudflare\",\"e1a9febc-6b37-47e6-b5a7-0eec7638ba82\",\"Cloudflare - Server TLS errors\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"Cloudflare\",\"eb7b88ab-47b1-483f-95b3-2b315d98d465\",\"Cloudflare - Top Network rules\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"8a72cdb0-97d9-4547-9eca-1bdea2ccd796\",\"Cloudflare - Top WAF rules\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"9fc7d945-0e82-4664-aca0-dc121a5cd7be\",\"Cloudflare - Unexpected countries\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Cloudflare\",\"0be3ddc1-99db-4153-ba3c-2c1e5c82560d\",\"Cloudflare - Unexpected edge response\",\"InitialAccess\",\"T1190 T1133\"\r\n\"ContinuousDiagnostics&Mitigation\",\"e15944a8-4172-4208-a928-631e01920d9c\",\"CDM_ContinuousDiagnostics&Mitigation_Posture\",\"Discovery\",\"T1082\"\r\n\"Corelight\",\"e9441d57-39f4-41fb-aaad-d02e47783d1a\",\"Corelight - Abnormal Email Subject\",\"InitialAccess\",\"T1566\"\r\n\"Corelight\",\"f37e076e-69f6-4fcf-81dc-ca2bc5929eb5\",\"Corelight - Compressed Files Transferred over HTTP\",\"Exfiltration\",\"T1560\"\r\n\"Corelight\",\"c5f3974b-f411-4a06-a3f8-ee14fcadd0e1\",\"Corelight - Top sources of data transferred\",\"Exfiltration\",\"T1560\"\r\n\"Corelight\",\"3e42a796-9a4c-4ebf-a0e0-5282947986b5\",\"Corelight - External Facing Services\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Corelight\",\"0c3ad86f-6b92-4ff5-8d41-86ff7e01d518\",\"Corelight - Files in logs\",\"InitialAccess Exfiltration\",\"T1566 T1560\"\r\n\"Corelight\",\"887e648f-32d7-4803-8cd4-2ceef7995872\",\"Corelight - File uploads by source\",\"Exfiltration\",\"T1560\"\r\n\"Corelight\",\"69736969-6ae0-48cd-a05a-743f7372ee84\",\"Corelight - Multiple Remote SMB Connections from single client\",\"Discovery\",\"T1135\"\r\n\"Corelight\",\"a518ea0c-f87a-4a79-8f45-2b5b6f44bd7f\",\"Corelight - Obfuscated binary file\",\"InitialAccess\",\"T1189 T1133\"\r\n\"Corelight\",\"9aab6aac-6dad-4749-b8cf-46840b6d978f\",\"Corelight - Rare PUT or POST\",\"Persistence\",\"T1100 T1505\"\r\n\"Corelight\",\"1ea3a384-77a4-4b0d-8e42-74d26b38ab5b\",\"Corelight - Repetitive DNS Failures\",\"CommandAndControl\",\"T1094 T1043\"\r\n\"CyberArkEPM\",\"20fc7ee2-5387-4c4c-8819-77fb7bfb8d2a\",\"CyberArkEPM - Elevation requests\",\"Execution PrivilegeEscalation\",\"T1204 T1078\"\r\n\"CyberArkEPM\",\"576cac40-d6f5-4ef9-9c3d-013b94656bea\",\"CyberArkEPM - Powershell downloads\",\"Execution\",\"T1204 T1059\"\r\n\"CyberArkEPM\",\"f1490e77-2a5e-4f07-afd9-c2bb20e26d30\",\"CyberArkEPM - Powershell scripts execution parameters\",\"Execution\",\"T1204 T1059\"\r\n\"CyberArkEPM\",\"8d72be65-d837-4e86-bca8-4a30e6834a22\",\"CyberArkEPM - Process hash changed\",\"DefenseEvasion\",\"T1036\"\r\n\"CyberArkEPM\",\"cff4d318-eaec-43c9-8c3e-84f74c789b98\",\"CyberArkEPM - Processes with Internet access attempts\",\"CommandAndControl\",\"T1095\"\r\n\"CyberArkEPM\",\"e96de960-f4d7-49a3-8de7-4f5b7e8537cf\",\"CyberArkEPM - Processes run as admin\",\"Execution PrivilegeEscalation\",\"T1204 T1078\"\r\n\"CyberArkEPM\",\"37031fed-f7cb-45fc-a1c2-e2eab46cbba2\",\"CyberArkEPM - Rare process vendors\",\"Execution\",\"T1204\"\r\n\"CyberArkEPM\",\"9cf63647-4e05-47cc-90ac-4a17cfd06a05\",\"CyberArkEPM - Rare process run by users\",\"Execution\",\"T1204\"\r\n\"CyberArkEPM\",\"bd8511dd-ee8f-4c76-a9c8-b8f263ec7355\",\"CyberArkEPM - Scripts executed on hosts\",\"Execution\",\"T1204\"\r\n\"CyberArkEPM\",\"e60cf50c-3ae0-44ac-9de1-ea13886973b8\",\"CyberArkEPM - Suspicious activity attempts\",\"Execution\",\"T1204\"\r\n\"Cybersixgill-Actionable-Alerts\",\"532133dd-a8ed-4062-bf0d-f04dc97bb71a\",\"Cybersixgill Actionable alerts\",,\r\n\"Cyborg Security HUNTER\",\"d7233f14-4705-403e-9db9-e0d677c9506b\",\"Attempted VBScript Stored in Non-Run CurrentVersion Registry Key Value\",\"DefenseEvasion\",\"T1112\"\r\n\"Cyborg Security HUNTER\",\"6d1c9f13-e43e-4b52-a443-5799465d573b\",\"Excessive Windows Discovery and Execution Processes - Potential Malware Installation\",\"Discovery\",\"T1016\"\r\n\"Cyborg Security HUNTER\",\"4894a60b-d2ee-4f24-be61-0d0c96a84e63\",\"LSASS Memory Dumping using WerFault.exe - Command Identification\",\"CredentialAccess\",\"T1003\"\r\n\"Cyborg Security HUNTER\",\"37cba0d1-8aa5-4f8f-bb26-25a45475ca9a\",\"Metasploit / Impacket PsExec Process Creation Activity\",\"Execution\",\"T1569.002\"\r\n\"Cyborg Security HUNTER\",\"b194088b-c846-4c72-a4b7-933627878db4\",\"Potential Maldoc Execution Chain Observed\",\"DefenseEvasion Execution InitialAccess\",\"T1059 T1059.001 T1059.004 T1059.005 T1059.006 T1059.007 T1218.011 T1566.001 T1566.002\"\r\n\"Cyborg Security HUNTER\",\"e186a8af-3d4a-4003-93b7-9b199e0b1dd1\",\"PowerShell Pastebin Download\",\"CommandandControl\",\"T1102\"\r\n\"Cyborg Security HUNTER\",\"d2d3bbc2-6e57-4043-ab24-988a6a6c88db\",\"Powershell Encoded Command Execution\",\"DefenseEvasion Execution\",\"T1027 T1059.001\"\r\n\"Cyborg Security HUNTER\",\"fc36d683-385a-4ec2-842d-2982dbed97a4\",\"Prohibited Applications Spawning cmd.exe or powershell.exe\",\"CommandandControl\",\"T1102\"\r\n\"Cyborg Security HUNTER\",\"3ac1e703-3ed0-45e1-ae1d-0fa60baf99fb\",\"Proxy VBScript Execution via CurrentVersion Registry Key\",\"DefenseEvasion Execution\",\"T1059.005 T1218.005\"\r\n\"Cyborg Security HUNTER\",\"3bc6e8ef-9e08-4626-89e9-fda87866cc82\",\"Rundll32 or cmd Executing Application from Explorer - Potential Malware Execution Chain\",\"Execution\",\"T1204.002\"\r\n\"DNS Essentials\",\"50f0cdfb-8b01-4eca-823d-2bbe6b8a5b95\",\"'[Anomaly] Anomalous Increase in DNS activity by clients (ASIM DNS Solution)'\",\"CommandAndControl\",\"T1568 T1008 T1048\"\r\n\"DNS Essentials\",\"0a8f5777-f38a-4c37-b531-411bdecef976\",\"CVE-2020-1350 (SIGRED) exploitation pattern (ASIM DNS Solution)\",\"CommandAndControl\",\"T1068 T1055\"\r\n\"DNS Essentials\",\"83e70a34-d96f-419d-815b-43d1499e88ed\",\"Connection to Unpopular Website Detected (ASIM DNS Solution)\",\"CommandAndControl\",\"T1095\"\r\n\"DNS Essentials\",\"4717929b-121d-4d90-b7ba-e3259ef16aca\",\"Top 25 DNS queries with most failures in last 24 hours (ASIM DNS Solution)\",\"CommandAndControl\",\"T1095\"\r\n\"DNS Essentials\",\"5366b848-0886-439f-b312-0b94bb687d06\",\"Top 25 Domains with large number of Subdomains (ASIM DNS Solution)\",\"CommandAndControl\",\"T1568 T1008 T1048\"\r\n\"DNS Essentials\",\"b31b5d70-4c75-4a5f-8af7-6a83f6eb372c\",\"Increase in DNS Requests by client than the daily average count (ASIM DNS Solution)\",\"CommandAndControl Exfiltration\",\"T1568 T1008 T1048\"\r\n\"DNS Essentials\",\"74e8773c-dfa9-45ca-bb60-5d767303e5b3\",\"Possible DNS Tunneling or Data Exfiltration Activity (ASIM DNS Solution)\",\"Exfiltration\",\"T1568 T1008 T1048\"\r\n\"DNS Essentials\",\"c4956c0b-4527-406c-b135-ef44002e1e70\",\"Potential beaconing activity (ASIM DNS Solution)\",\"CommandAndControl\",\"T1095 T1573 T1008 T1571 T1219\"\r\n\"DNS Essentials\",\"b35f6633-0d18-494c-a5e4-2828daf442bf\",\"Top 25 Sources(Clients) with high number of errors in last 24hours (ASIM DNS Solution)\",\"CommandAndControl\",\"T1095\"\r\n\"DNS Essentials\",\"4c8d6412-5a48-42c3-8b5e-1f29fb15c749\",\"Unexpected top level domains (ASIM DNS Solution)\",\"CommandAndControl\",\"T1095\"\r\n\"Egress Defend\",\"57ada8d5-7a26-4440-97fd-32c5c3fd0421\",\"Dangerous emails with links clicked\",\"Collection\",\"T1039\"\r\n\"Endpoint Threat Protection Essentials\",\"eb022863-9ae2-41d4-b633-29e4d024b76f\",\"Certutil (LOLBins and LOLScripts Normalized Process Events)\",\"CommandAndControl\",\"T1105\"\r\n\"Endpoint Threat Protection Essentials\",\"5db1f6f9-9de9-43a9-b7cc-357486b42fc6\",\"Windows System Shutdown/Reboot (Normalized Process Events)\",\"Impact\",\"T1529\"\r\n\"Endpoint Threat Protection Essentials\",\"56ebae61-89cf-42d9-99f4-3dff8ba33885\",\"Backup Deletion \",\"Impact\",\"T1490\"\r\n\"Endpoint Threat Protection Essentials\",\"0e429446-2798-49e4-924d-c37338f24e23\",\"Detect Certutil (LOLBins and LOLScripts) Usage\",\"CommandAndControl\",\"T1105\"\r\n\"Endpoint Threat Protection Essentials\",\"7108c86b-a3ef-42d0-b50b-3e251fb1f84c\",\"Download of New File Using Curl\",\"CommandAndControl\",\"T1071\"\r\n\"Endpoint Threat Protection Essentials\",\"299472c4-8382-4c5b-82d9-718cda193393\",\"Execution of File with One Character in the Name \",\"Execution\",\"T1059\"\r\n\"Endpoint Threat Protection Essentials\",\"f82c89fa-c969-4d12-832f-04d55d14522c\",\"Persisting via IFEO Registry Key \",\"Persistence\",\"T1546.012\"\r\n\"Endpoint Threat Protection Essentials\",\"e10e1d2f-265d-4d90-9037-7f3a6ed8a91e\",\"Potential Microsoft Security Services Tampering\",\"DefenseEvasion\",\"T1562.001\"\r\n\"Endpoint Threat Protection Essentials\",\"8f658a80-7fa9-4524-a95b-d9ab608e8850\",\"Remote Login Performed with WMI\",\"Execution\",\"T1047\"\r\n\"Endpoint Threat Protection Essentials\",\"7aad876a-a6fe-4c11-879e-8b29d35ff739\",\"Remote Scheduled Task Creation or Update using ATSVC Named Pipe\",\"Persistence\",\"T1053.002\"\r\n\"Endpoint Threat Protection Essentials\",\"0b827a49-427e-4721-b05e-b151a8af524e\",\"Scheduled Task Creation or Update from User Writable Directory\",\"Execution\",\"T1053.005\"\r\n\"Endpoint Threat Protection Essentials\",\"c2074fce-b5ba-4c0a-9332-d08b8fc43c53\",\"Rundll32 (LOLBins and LOLScripts)\",\"DefenseEvasion\",\"T1218.011\"\r\n\"Endpoint Threat Protection Essentials\",\"8f424a4c-0487-45a3-92b8-00a7a8745b69\",\"Suspicious Powershell Commandlet Execution \",\"Execution\",\"T1059\"\r\n\"Endpoint Threat Protection Essentials\",\"a953f304-12e4-48ae-bedc-d58fb1b0c6a6\",\"Unicode Obfuscation in Command Line\",\"DefenseEvasion\",\"T1027\"\r\n\"Endpoint Threat Protection Essentials\",\"e3e8c913-e5e9-4517-b4f7-dd1ec071888f\",\"Rare Windows Firewall Rule updates using Netsh\",\"Execution\",\"T1204\"\r\n\"Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel\",\"9fc7d945-0e82-4664-aca0-dc121a7rt5nt\",\"Fortiweb - Unexpected countries\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel\",\"3rg4d567-0e82-4664-aca0-dc121a7th3ht\",\"Fortiweb - identify owasp10 vulnerabilities\",\"InitialAccess\",\"T1190\"\r\n\"GitHub\",\"f0d30d3c-e6ad-480a-90e8-1bd7cc84881b\",\"GitHub First Time Invite Member and Add Member to Repo\",\"Persistence\",\"T1136\"\r\n\"GitHub\",\"b8508e24-47a6-4f8e-9066-3cc937197e7f\",\"GitHub Inactive or New Account Access or Usage\",\"Persistence\",\"T1136\"\r\n\"GitHub\",\"67da5c4e-49f2-476d-96ff-2dbe4b855a48\",\"GitHub Mass Deletion of repos or projects\",\"Impact\",\"T1485\"\r\n\"GitHub\",\"667e6a70-adc9-49b7-9cf3-f21927c71959\",\"GitHub OAuth App Restrictions Disabled\",\"Persistence DefenseEvasion\",\"T1505 T1562\"\r\n\"GitHub\",\"ec986fb7-34ed-4528-a5f3-a496e61d8860\",\"GitHub Update Permissions\",\"Persistence DefenseEvasion\",\"T1098 T1562\"\r\n\"GitHub\",\"a6e2afd3-559c-4e88-a693-39c1f6789ef1\",\"GitHub Repo switched from private to public\",\"Collection\",\"T1213\"\r\n\"GitHub\",\"c3237d88-fdc4-4dee-8b90-118ded2c507c\",\"GitHub First Time Repo Delete\",\"Impact\",\"T1485\"\r\n\"GitHub\",\"f18c4dfb-4fa6-4a9d-9bd3-f7569d1d685a\",\"GitHub User Grants Access and Other User Grants Access\",\"Persistence PrivilegeEscalation \",\"T1098 T1078\"\r\n\"GoogleCloudPlatformDNS\",\"74267de2-ff2e-415a-9e2a-5a99b471a1e2\",\"Google DNS - Errors\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"74267de2-ff2e-415a-9e2a-5a99b471a1e2\",\"Google DNS - Errors\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"8459cf31-9c5d-48a8-88ca-c4b1a6014031\",\"Google DNS - Requests to IP lookup resources\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"e909c48d-7bd4-45d0-bfb9-319b5fdc6332\",\"Google DNS - Requests to online shares\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"49d88918-03c8-4e22-9c8b-843e79cad6f5\",\"Google DNS - Rare domains\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"9e3145ef-f6bf-4dd0-8783-a0847f68cb54\",\"Google DNS - Domains with rare errors\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"53b91d17-f6a7-4439-8d9a-0aebf0abeea2\",\"Google DNS - Requests to TOR resources\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"3cff73de-8c4a-46f5-85d8-3f1c051876f1\",\"Google DNS - Server latency\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"e85a5d94-1f9f-4ce1-b54d-c61bbd24c41f\",\"Google DNS - Sources with high number of errors\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"1823db08-2ba4-4624-900f-9be0f950ea57\",\"Google DNS - Unexpected top level domains\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformDNS\",\"2aff9e01-d3bb-4455-94e3-66be758474bd\",\"Google DNS - Unusual top level domains\",\"CommandAndControl\",\"T1095\"\r\n\"GoogleCloudPlatformIAM\",\"0ab42aac-2c86-443c-80fa-ef8cdd0d997e\",\"GCP IAM - Changed roles\",\"PrivilegeEscalation\",\"T1078\"\r\n\"GoogleCloudPlatformIAM\",\"0ab42aac-2c86-443c-80fa-ef8cdd0d997e\",\"GCP IAM - Changed roles\",\"PrivilegeEscalation\",\"T1078\"\r\n\"GoogleCloudPlatformIAM\",\"b758750b-18e8-4aec-a831-c9a1a312d314\",\"GCP IAM - Deleted service accounts\",\"Impact\",\"T1531\"\r\n\"GoogleCloudPlatformIAM\",\"f228b2ca-3604-475a-8bd1-33b6c5dbcd3d\",\"GCP IAM - Disabled service accounts\",\"Impact\",\"T1531\"\r\n\"GoogleCloudPlatformIAM\",\"e9accd25-ecff-4076-b2da-3102bf95bec5\",\"GCP IAM - New custom roles\",\"PrivilegeEscalation\",\"T1078\"\r\n\"GoogleCloudPlatformIAM\",\"52518413-437b-4f79-86d3-28c8c1fafb66\",\"GCP IAM - New service accounts\",\"Persistence\",\"T1136\"\r\n\"GoogleCloudPlatformIAM\",\"33bf838b-a85e-4051-8646-07f4e47ee4ea\",\"GCP IAM - New service account keys\",\"LateralMovement\",\"T1550\"\r\n\"GoogleCloudPlatformIAM\",\"85e64fe8-aeed-4021-85de-fdf539917ca1\",\"GCP IAM - Rare IAM actions\",\"InitialAccess\",\"T1078\"\r\n\"GoogleCloudPlatformIAM\",\"ee96562f-cb40-42fd-80d6-dce38cb38f5c\",\"GCP IAM - Rare user agent\",\"DefenseEvasion\",\"T1078\"\r\n\"GoogleCloudPlatformIAM\",\"27234847-8d3f-4d33-a3ef-5d3ec2575154\",\"GCP IAM - Top service accounts by failed actions\",\"Discovery\",\"T1580 T1526\"\r\n\"GoogleCloudPlatformIAM\",\"2f906618-68e1-49ae-a961-8483cb7b6523\",\"GCP IAM - Top source IP addresses with failed actions\",\"Discovery\",\"T1580 T1526\"\r\n\"GoogleWorkspaceReports\",\"69e8a40f-6508-4f43-8eef-2f78ad6174df\",\"GWorkspace - Document Copied from Share Drive to Private Drive\",\"Exfiltration Impact\",\"T1537 T1565\"\r\n\"GoogleWorkspaceReports\",\"00d743e2-5dac-11ec-bf63-0242ac130002\",\"GWorkspace - Document shared externally\",\"Exfiltration Impact\",\"T1048 T1565\"\r\n\"GoogleWorkspaceReports\",\"e37c86ea-5dab-11ec-bf63-0242ac130002\",\"GWorkspace - Document shared publicy in web\",\"Exfiltration Impact\",\"T1048 T1565\"\r\n\"GoogleWorkspaceReports\",\"c7c65c78-5dab-11ec-bf63-0242ac130002\",\"GWorkspace - Document shared publicy with link\",\"Exfiltration Impact\",\"T1048 T1565\"\r\n\"GoogleWorkspaceReports\",\"b1235ce0-06a0-446b-baad-852874f57bd4\",\"GWorkspace - License Revoke and Assignment to User\",\"Exfiltration\",\"T1537\"\r\n\"GoogleWorkspaceReports\",\"bb6bf88e-5dab-11ec-bf63-0242ac130002\",\"GWorkspace - Multi IP addresses by user\",\"InitialAccess\",\"T1078\"\r\n\"GoogleWorkspaceReports\",\"29ce9d14-5dab-11ec-bf63-0242ac130002\",\"GWorkspace - Possible SCAM/SPAM or Phishing via Calendar\",\"InitialAccess\",\"T1566\"\r\n\"GoogleWorkspaceReports\",\"0b20d206-5dab-11ec-bf63-0242ac130002\",\"GWorkspace - Rare document types by users\",\"InitialAccess\",\"T1566\"\r\n\"GoogleWorkspaceReports\",\"2da2122e-5da9-11ec-bf63-0242ac130002\",\"GWorkspace - Shared private document\",\"Exfiltration Impact\",\"T1048 T1565\"\r\n\"GoogleWorkspaceReports\",\"26cea052-5da9-11ec-bf63-0242ac130002\",\"GWorkspace - Suspended users\",\"Impact\",\"T1531\"\r\n\"GoogleWorkspaceReports\",\"1efb71b6-5da9-11ec-bf63-0242ac130002\",\"GWorkspace - Uncommon user agent strings\",\"Persistence Collection\",\"T1185 T1176\"\r\n\"GoogleWorkspaceReports\",\"05189314-5e58-11ec-bf63-0242ac130002\",\"GWorkspace - Unknown login type\",\"InitialAccess DefenseEvasion LateralMovement\",\"T1550 T1078\"\r\n\"GoogleWorkspaceReports\",\"181bda98-5da9-11ec-bf63-0242ac130002\",\"GWorkspace - User reported calendar invite as spam\",\"InitialAccess\",\"T1566\"\r\n\"GoogleWorkspaceReports\",\"1087fb40-5da9-11ec-bf63-0242ac130002\",\"GWorkspace - Users with several devices\",\"InitialAcces\",\"T1078\"\r\n\"ImpervaCloudWAF\",\"e360c980-b515-4c27-921c-19d411bd059d\",\"Imperva - Top destinations with blocked requests\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"ImpervaCloudWAF\",\"4cf72a93-537a-4c1f-83a3-0a5b743fe93e\",\"Imperva - Applications with insecure web protocol version\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"1f99e54f-0e75-474e-8232-90963207f02b\",\"Imperva - Non HTTP/HTTPs applications\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"426a8b59-41ad-4022-bb01-cf914fd5687a\",\"Imperva - Rare applications\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"4a8a88af-4f40-40bd-aca8-e016dd6960de\",\"Imperva - Rare client applications\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"e68c3b84-7895-41d5-a9af-4ef776e82408\",\"Imperva - Rare destination ports\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"4cb3088c-445a-4a99-a90f-d583fe253a7d\",\"Imperva - request from known bots\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"ec5b9eb6-f43a-40fc-ae65-2af9ae1e77ae\",\"Imperva - Top sources with blocked requests\",\"InitialAccess Impact\",\"T1190 T1133 T1498\"\r\n\"ImpervaCloudWAF\",\"934f19a5-f4bc-47eb-a213-db918b097434\",\"Imperva - Top applications with error requests\",\"InitialAccess\",\"T1190\"\r\n\"ImpervaCloudWAF\",\"c359e40f-3a56-4e75-8dbb-41e5057bba64\",\"Imperva - Top sources with error requests\",\"InitialAccess\",\"T1190\"\r\n\"Jamf Protect\",\"2b0ec436-80d6-4e63-b3da-e35048724f37\",\"JamfProtect - macOS - AtomicStealer\",\"Exfiltration\",\"T1020\"\r\n\"Jamf Protect\",\"f0a1bacb-eb6a-4edc-99a9-839a77be3a33\",\"JamfProtect - macOS - DazzleSpy\",\"ResourceDevelopment\",\"T1587 T1587.001\"\r\n\"Jamf Protect\",\"8d9a199b-7968-476b-b02b-d030a010609c\",\"JamfProtect - macOS - JokerSpy\",\"Execution Masquerading\",\"T1059 T1036\"\r\n\"Jamf Protect\",\"60b1269f-374e-49dd-8b10-e4ef85d5bd65\",\"JamfProtect - macOS - KandyKorn\",\"Exfiltration\",\"T1020\"\r\n\"Jamf Protect\",\"ec2f21aa-a9c5-42fd-9ee1-c59f30b4fdd6\",\"JamfProtect - macOS - PureLand\",\"Exfiltration\",\"T1020\"\r\n\"Jamf Protect\",\"223f6758-e134-45e8-a9d6-4ca8455799fb\",\"JamfProtect - macOS - RustBucket\",\"Exfiltration\",\"T1020\"\r\n\"Jamf Protect\",\"09161cb2-f28a-437c-83e3-60b8545dc8f2\",\"JamfProtect - macOS - Turtle\",\"Exfiltration\",\"T1020\"\r\n\"LastPass\",\"b43fc364-69fc-4d3e-8834-6743ab5725e9\",\"Failed sign-ins into LastPass due to MFA.\",\"InitialAccess\",\"T1078\"\r\n\"LastPass\",\"d292d770-69a4-4399-9272-6e86c4e53e58\",\"Login into LastPass from a previously unknown IP.\",\"InitialAccess\",\"T1078 T1190\"\r\n\"LastPass\",\"e70f1b22-acd1-493f-bba5-b28bea988940\",\"Password moved to shared folders\",\"Collection\",\"T1039\"\r\n\"Legacy IOC based Threat Protection\",\"e2629949-2043-4421-8064-bca23c8491dd\",\"Dev-0056 Command Line Activity November 2021\",\"CommandAndControl\",\"T1071\"\r\n\"Legacy IOC based Threat Protection\",\"6bfea14f-2122-46b3-8f8b-3947e0fb6d92\",\"Dev-0322 Command Line Activity November 2021 (ASIM Version)\",\"Persistence LateralMovement CommandAndControl\",\"T1078 T1219 T1021\"\r\n\"Legacy IOC based Threat Protection\",\"78fa22f9-0c13-4847-bbe6-6a7aa1b47547\",\"Dev-0322 Command Line Activity November 2021\",\"Persistence LateralMovement CommandAndControl\",\"T1078 T1219 T1021\"\r\n\"Legacy IOC based Threat Protection\",\"9b72769e-6ab1-4736-988b-018d92dc5e62\",\"Dev-0322 File Drop Activity November 2021 (ASIM Version)\",\"Persistence CommandAndControl\",\"T1078 T1219\"\r\n\"Legacy IOC based Threat Protection\",\"5bf2d4d8-ea03-4673-aaf8-716a61446022\",\"Dev-0322 File Drop Activity November 2021\",\"Persistence CommandAndControl\",\"T1078 T1219\"\r\n\"Legacy IOC based Threat Protection\",\"b8b7574f-1cd6-4308-822a-ab07256106f8\",\"Retrospective hunt for Forest Blizzard IP IOCs\",\"CommandAndControl\",\"T1071\"\r\n\"Legacy IOC based Threat Protection\",\"767b8f6d-8029-4c92-afe1-282167d9d49a\",\"Connection from external IP to OMI related Ports\",\"Reconnaissance InitialAccess\",\"T1595 T1190\"\r\n\"Legacy IOC based Threat Protection\",\"bb30abbc-9af6-4a37-9536-e9207e023989\",\"Nylon Typhoon Command Line Activity November 2021\",\"Collection\",\"T1074.001\"\r\n\"Legacy IOC based Threat Protection\",\"f090f8f4a-b986-42d2-b536-e0795c723e25\",\"Known Nylon Typhoon Registry modifications patterns\",\"Persistence\",\"T1546.012\"\r\n\"Legacy IOC based Threat Protection\",\"278592b5-612b-48a4-bb38-4c01ff8ee2a5\",\"SolarWinds Inventory\",\"Execution\",\"T1072\"\r\n\"MailGuard 365\",\"5e3aa1a5-5b69-421e-a3ac-32b04cb10353\",\"MailGuard 365 - High Confidence Threats\",\"Reconnaissance\",\"T1598\"\r\n\"MailGuard 365\",\"daaae6ad-1fd0-4efa-b571-116689e67a20\",\"MailGuard 365 - Malware Threats\",\"InitialAccess Reconnaissance\",\"T1592 T1589 T1590 T1591 T1189 T1190\"\r\n\"MailGuard 365\",\"ee15ed10-d355-474e-b8ad-a8bbb76f6d38\",\"MailGuard 365 - Phishing Threats\",\"InitialAccess Reconnaissance Credential Access\",\"T1598 T1566\"\r\n\"Malware Protection Essentials\",\"ab8ddb26-050c-40aa-aaf0-bfb7e3eeb05f\",\"Executable Files Created in Uncommon Locations\",\"Persistence PrivilegeEscalation DefenseEvasion\",\"T1037 T1547 T1564\"\r\n\"Malware Protection Essentials\",\"64e199a8-b26c-462f-a65c-09ed9b53a47b\",\"Detect File Creation in Startup Folder\",\"Persistence PrivilegeEscalation DefenseEvasion\",\"T1547 T1112\"\r\n\"Malware Protection Essentials\",\"595aea5c-74c7-415b-8b12-10af1a338cdf\",\"Detect Files with Ramsomware Extensions\",\"Execution Impact\",\"T1204 T1486\"\r\n\"Malware Protection Essentials\",\"b43394b9-fa91-4d98-b331-619926a933bb\",\"Detect New Scheduled Task Creation that Run Executables From Non-Standard Location\",\"Execution PrivilegeEscalation Persistence\",\"T1053\"\r\n\"Malware Protection Essentials\",\"4dc0aae4-6375-4670-b138-8c42490ba206\",\"Detect New Scheduled Task Entry Creations\",\"Execution PrivilegeEscalation Persistence\",\"T1053\"\r\n\"Malware Protection Essentials\",\"54b222c4-0149-421e-9d6d-da66da50495a\",\"Detect Modification to System Files or Directories by User Accounts\",\"DefenseEvasion Persistence PrivilegeEscalation\",\"T1036 T1543\"\r\n\"MaturityModelForEventLogManagementM2131\",\"b3e0bfd4-52d2-4684-9514-716035cdbff2\",\"M2131_RecommendedDatatableNotLogged_EL0\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"f9e0ae98-6828-4d5a-b596-7c4586bb14f6\",\"M2131_RecommendedDatatableNotLogged_EL1\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"76326a24-1223-4066-88a3-3826e3768932\",\"M2131_RecommendedDatatableNotLogged_EL2\",\"Discovery\",\"T1082\"\r\n\"MaturityModelForEventLogManagementM2131\",\"8b415f2d-44c1-4edb-8ca6-ddf7d2d28b20\",\"M2131_RecommendedDatatableNotLogged_EL3\",\"Discovery\",\"T1082\"\r\n\"McAfee ePolicy Orchestrator\",\"dff3c841-6e3e-432e-ad68-3ddd7326bc01\",\"McAfee ePO - Agent Errors\",\"DefenseEvasion\",\"T1070\"\r\n\"McAfee ePolicy Orchestrator\",\"e838519b-1f03-417f-863b-6c1a141677ee\",\"McAfee ePO - Applications blocked or contained\",\"InitialAccess Execution\",\"T1204 T1189\"\r\n\"McAfee ePolicy Orchestrator\",\"851b63f1-cc5d-44d5-b505-9444a5e87076\",\"McAfee ePO - Email Treats\",\"InitialAccess\",\"T1566\"\r\n\"McAfee ePolicy Orchestrator\",\"e83b72a0-60dd-4d65-b1c2-582766f2f181\",\"McAfee ePO - Infected files by source\",\"InitialAccess\",\"T1189\"\r\n\"McAfee ePolicy Orchestrator\",\"2e7a56fb-ffff-491c-bdee-e772f83c47e2\",\"McAfee ePO - Infected Systems\",\"InitialAccess\",\"T1189 T1195\"\r\n\"McAfee ePolicy Orchestrator\",\"a65e4129-d936-4165-bc08-699f9151aa26\",\"McAfee ePO - Long term infected systems\",\"InitialAccess Persistence\",\"T1189\"\r\n\"McAfee ePolicy Orchestrator\",\"1ef23489-a840-4b43-b33d-a921da24c85c\",\"McAfee ePO - Sources with multiple threats\",\"InitialAccess\",\"T1189 T1195\"\r\n\"McAfee ePolicy Orchestrator\",\"5be4adb7-52ee-4416-b39d-0c03cf0fb661\",\"McAfee ePO - Objects not scanned\",\"DefenseEvasion\",\"T1562\"\r\n\"McAfee ePolicy Orchestrator\",\"901e6982-39ed-4759-9451-de1a3826182f\",\"McAfee ePO - Scan Errors\",\"DefenseEvasion\",\"T1562\"\r\n\"McAfee ePolicy Orchestrator\",\"80c5904d-6a36-4b7c-82d4-180023a1f8b4\",\"McAfee ePO - Threats detected and not blocked, cleaned or deleted\",\"Persistence PrivilegeEscalation\",\"T1574 T1055\"\r\n\"Microsoft 365\",\"271e8881-3044-4332-a5f4-42264c2e0315\",\"Anomalous access to other users' mailboxes\",\"Collection\",\"T1114.002\"\r\n\"Microsoft 365\",\"119d9e1c-afcc-4d23-b239-cdb4e7bf851c\",\"External user added and removed in a short timeframe\",\"Persistence\",\"T1136\"\r\n\"Microsoft 365\",\"6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45\",\"External user from a new organisation added to Teams\",\"Persistence\",\"T1136\"\r\n\"Microsoft 365\",\"9891684a-1e3a-4546-9403-3439513cbc70\",\"Mail redirect via ExO transport rule\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Microsoft 365\",\"9eb64924-ec8d-44d0-b1f2-10665150fb74\",\"Bots added to multiple teams\",\"Persistence Collection\",\"T1176 T1119\"\r\n\"Microsoft 365\",\"558f15dd-3171-4b11-bf24-31c0610a20e0\",\"User made Owner of multiple teams\",\"PrivilegeEscalation\",\"T1078\"\r\n\"Microsoft 365\",\"64990414-b015-4edf-bef0-343b741e68c5\",\"Multiple Teams deleted by a single user\",\"Impact\",\"T1485 T1489\"\r\n\"Microsoft 365\",\"a1551ae4-f61c-4bca-9c57-4d0d681db2e9\",\"Multiple users email forwarded to same destination\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Microsoft 365\",\"bf76e508-9282-4cf1-9cc1-5c20c3dea2ee\",\"Previously unseen bot or application added to Teams\",\"Persistence Collection\",\"T1176 T1119\"\r\n\"Microsoft 365\",\"641ecd2d-27c9-4f05-8433-8205096b09fc\",\"New Windows Reserved File\",\"CommandAndControl\",\"T1105\"\r\n\"Microsoft 365\",\"d49fc965-aef3-49f6-89ad-10cc4697eb5b\",\"Office Mail Forwarding - Hunting Version\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Microsoft 365\",\"90e198a9-efb6-4719-ad89-81b8e93633a7\",\"Files uploaded to teams and access summary\",\"InitialAccess Exfiltration\",\"T1199 T1102 T1078\"\r\n\"Microsoft 365\",\"3d6d0c04-7337-40cf-ace6-c471d442356d\",\"User added to Teams and immediately uploads file\",\"InitialAccess\",\"T1566\"\r\n\"Microsoft 365\",\"61c28cd7-3139-4731-8ea7-2cbbeabb4684\",\"Windows Reserved File\",\"CommandAndControl\",\"T1105\"\r\n\"Microsoft 365\",\"d12580c2-1474-4125-a8a3-553f50d91215\",\"Exes with double file extension and access summary\",\"DefenseEvasion\",\"T1036\"\r\n\"Microsoft 365\",\"723c5f46-133f-4f1e-ada6-5c138f811d75\",\"New Admin account activity seen which was not seen historically\",\"PrivilegeEscalation Collection\",\"T1078 T1114\"\r\n\"Microsoft 365\",\"e3d24cfd-b2a1-4ba7-8f80-0360892f9d57\",\"SharePointFileOperation via previously unseen IPs\",\"Exfiltration\",\"T1030\"\r\n\"Microsoft 365\",\"f2367171-1514-4c67-88ef-27434b6a1093\",\"SharePointFileOperation via devices with previously unseen user agents\",\"Exfiltration\",\"T1030\"\r\n\"Microsoft 365\",\"0a8f410d-38b5-4d75-90da-32b472b97230\",\"Non-owner mailbox login activity\",\"Collection Exfiltration\",\"T1114 T1020\"\r\n\"Microsoft 365\",\"49a4f65a-fe18-408e-afec-042fde93d3ce\",\"PowerShell or non-browser mailbox login activity\",\"Execution Persistence Collection\",\"T1059 T1098 T1114\"\r\n\"Microsoft 365\",\"e8ae1375-4640-430c-ae8e-2514d09c71eb\",\"SharePointFileOperation via clientIP with previously unseen user agents\",\"Exfiltration\",\"T1030\"\r\n\"MicrosoftDefenderForEndpoint\",\"4a3073ac-7383-48a9-90a8-eb6716183a54\",\"SUNBURST suspicious SolarWinds child processes\",\"Execution Persistence\",\r\n\"MicrosoftDefenderForEndpoint\",\"c63ae777-d5e0-4113-8c9a-c2c9d3d09fcd\",\"Probable AdFind Recon Tool Usage\",\"Discovery\",\"T1018\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"ea5d043f-80ef-452c-a31a-b584e485b2be\",\"Insider Risk_Entity Anomaly Followed by IRM Alert\",\"PrivilegeEscalation\",\"T1078\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"12b6582f-b715-4f91-98e1-1582ebad348a\",\"Insider Risk_ISP Anomaly to Exfil\",\"Exfiltration\",\"T1567\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"3bc01058-ce23-45ba-a7e9-409d844b12dc\",\"Insider Risk_Multiple Entity-Based Anomalies\",\"PrivilegeEscalation\",\"T1078\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"3201b17a-06e1-4a8d-8157-c69345baa808\",\"Insider Risk_Possible Sabotage\",\"Impact\",\"T1485\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"45ec52c2-99e1-4de1-9adc-bae0f79d4e23\",\"Insider Risk_Sign In Risk Followed By Sensitive Data Access\",\"Exfiltration\",\"T1567\"\r\n\"NGINX HTTP Server\",\"930f8b54-3bef-11ec-8d3d-0242ac130003\",\"NGINX - Abnormal request size\",\"Exfiltration Collection\",\"T1530 T1537\"\r\n\"NGINX HTTP Server\",\"aaacb354-3bea-11ec-8d3d-0242ac130003\",\"NGINX - Rare files requested \",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"fd2ae5f6-3bea-11ec-8d3d-0242ac130003\",\"NGINX - Rare URLs requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"39406080-fd5f-4236-99bf-7f26ea9a89d6\",\"NGINX - Requests from bots and crawlers\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"51d7d596-3beb-11ec-8d3d-0242ac130003\",\"NGINX - Requests to unexisting files \",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"168428b8-3bec-11ec-8d3d-0242ac130003\",\"NGINX - Top files requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"a7d4b6f2-3bec-11ec-8d3d-0242ac130003\",\"NGINX - Top files with error requests \",\"InitialAccess\",\"T1190 T1133\"\r\n\"NGINX HTTP Server\",\"d8dd00ec-3bec-11ec-8d3d-0242ac130003\",\"NGINX - Top URLs client errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"NGINX HTTP Server\",\"58ad26ee-3bed-11ec-8d3d-0242ac130003\",\"NGINX - Top URLs server errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"NGINX HTTP Server\",\"c8b5ce46-6f84-4944-ac89-ecaac8749b98\",\"NGINX - Uncommon user agent strings\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Nasuni\",\"64a3477e-d06f-4491-86a5-6f99702e267f\",\"Nasuni File Delete Activity\",\"Impact\",\"T1485\"\r\n\"Network Session Essentials\",\"5dca6047-24ed-4eb7-b44e-ec7f1bf42621\",\"Detect Outbound LDAP Traffic(ASIM Network Session schema)\",\"InitialAccess Execution\",\"T1071 T1059\"\r\n\"Network Session Essentials\",\"906c20c6-b62c-4af7-be91-d7300e3bded2\",\"Detect port misuse by anomaly (ASIM Network Session schema)\",\"CommandAndControl InitialAccess Execution\",\"T1905 T1190 T1059 T1203\"\r\n\"Network Session Essentials\",\"70e2a349-87f0-4266-809c-e92fc71e0830\",\"Detect port misuse by static threshold (ASIM Network Session schema)\",\"CommandAndControl InitialAccess Execution\",\"T1905 T1190 T1059 T1203\"\r\n\"Network Session Essentials\",\"cbe10c58-e96b-4827-853e-5c1f22fdcc74\",\"Detects several users with the same MAC address (ASIM Network Session schema)\",\"InitialAccess\",\r\n\"Network Session Essentials\",\"a61e9fc1-dd9e-4588-a497-2a34a1d811bf\",\"Mismatch between Destination App \",\"Discovery\",\r\n\"Network Session Essentials\",\"96f9fdd1-bb5b-4d32-8790-666457dc00c0\",\"Protocols passing authentication in cleartext (ASIM Network Session schema)\",\"CommandAndControl\",\"T1071\"\r\n\"Network Session Essentials\",\"6fd69768-fdf1-4cfd-805f-b243be3f0c6d\",\"Remote Desktop Network Traffic(ASIM Network Session schema)\",\"LateralMovement\",\"T1021 T1021.001\"\r\n\"Network Threat Protection Essentials\",\"39156a1d-c9e3-439e-967b-be7dcba918d9\",\"Base64 encoded IPv4 address in request url\",\"CommandAndControl\",\"T1071.001\"\r\n\"Network Threat Protection Essentials\",\"c46eeb45-c324-4a84-9df1-248c6d1507bb\",\"Risky base64 encoded command in URL\",\"CommandAndControl\",\"T1071.001\"\r\n\"Network Threat Protection Essentials\",\"df75ac6c-7b0b-40d2-82e4-191c012f1a07\",\"Exploit and Pentest Framework User Agent\",\"InitialAccess CommandAndControl Execution\",\"T1189 T1071 T1203\"\r\n\"Okta Single Sign-On\",\"5309ea6b-463c-4449-a3c4-2fc8ee0080ee\",\"Admin privilege granted (Okta)\",\"Persistence\",\"T1098\"\r\n\"Okta Single Sign-On\",\"c5134bac-044d-447a-a260-d1d439653ae7\",\"Create API Token (Okta) \",\"PrivilegeEscalation\",\"T1134\"\r\n\"Okta Single Sign-On\",\"96fb9b37-e2b7-45f6-9b2a-cb9cdfd2b0fc\",\"Initiate impersonation session (Okta) \",\"InitialAccess\",\"T1195\"\r\n\"Okta Single Sign-On\",\"6a9199ec-bc32-4935-9f82-4aa848edb3fc\",\"Okta login attempts using Legacy Auth\",\"CredentialAccess\",\"T1556\"\r\n\"Okta Single Sign-On\",\"37381608-bcd7-46bc-954e-1fd418023c26\",\"Okta Login from multiple locations\",\"CredentialAccess\",\"T1110\"\r\n\"Okta Single Sign-On\",\"708c33ec-22a2-4739-b248-c14919500cdd\",\"Sign-ins from Nord VPN Providers\",\"InitialAccess\",\"T1078\"\r\n\"Okta Single Sign-On\",\"f262fc3a-0acc-4c8b-9a73-fdc09f55fff2\",\"Logins originating from VPS Providers\",\"InitialAccess\",\"T1078\"\r\n\"Okta Single Sign-On\",\"4355f601-1421-4ac4-b2ce-88f0859cc101\",\"New device registration from unfamiliar location\",\"Persistence\",\"T1098\"\r\n\"Okta Single Sign-On\",\"18667b4a-18e5-4982-ba75-92ace62bc79c\",\"Rare MFA Operations (Okta)\",\"Persistence\",\"T1098\"\r\n\"Okta Single Sign-On\",\"38da2aa3-4778-4d88-9178-3c5c14758b05\",\"User password reset(Okta)\",\"Persistence\",\"T1098\"\r\n\"Oracle Cloud Infrastructure\",\"3bdfa923-3fc8-4651-8954-dab2bef2bdd1\",\"OCI - Destination ports (inbound traffic)\",\"InitialAccess\",\"T1190\"\r\n\"Oracle Cloud Infrastructure\",\"fff09b57-24ff-4e47-8a29-6292b0310e19\",\"OCI - Destination ports (outbound traffic)\",\"Exfiltration\",\"T1020\"\r\n\"Oracle Cloud Infrastructure\",\"3df69415-2dec-4457-9433-97a3c15a4b70\",\"OCI - Launched instances\",\"Impact\",\"T1499\"\r\n\"Oracle Cloud Infrastructure\",\"e4353276-19a5-4833-a271-be507170269e\",\"OCI - Update activities\",\"Impact\",\"T1499\"\r\n\"Oracle Cloud Infrastructure\",\"eed33749-85c4-47cc-9776-12eeb3172888\",\"OCI - Delete operations\",\"Impact\",\"T1485\"\r\n\"Oracle Cloud Infrastructure\",\"4f7c20dc-702c-491d-908e-3b5f8bdc73ab\",\"OCI - Deleted users\",\"Impact\",\"T1531\"\r\n\"Oracle Cloud Infrastructure\",\"c411dc09-a8ca-44f9-a594-242b5e90ada8\",\"OCI - New users\",\"InitialAccess Persistence\",\"T1078\"\r\n\"Oracle Cloud Infrastructure\",\"01dc84d2-ef1d-4df6-9499-e1c4a305f01f\",\"OCI - User source IP addresses\",\"Impact\",\"T1499\"\r\n\"Oracle Cloud Infrastructure\",\"51101a78-a802-4a83-ac02-ef31416ffbc7\",\"OCI - Terminated instances\",\"Impact\",\"T1529\"\r\n\"Oracle Cloud Infrastructure\",\"7b17d83a-7a88-4867-accf-494736bcec50\",\"OCI - Updated instances\",\"DefenseEvasion\",\"T1578\"\r\n\"OracleDatabaseAudit\",\"b43e074f-b630-4a16-80e5-138f4b6b64fb\",\"OracleDBAudit - Action by Ip\",\"InitialAccess DefenseEvasion Collection Impact\",\"T1485 T1005 T1119 T1078\"\r\n\"OracleDatabaseAudit\",\"e0b49a22-1c63-4572-b913-b3f31b8e9edf\",\"OracleDBAudit - Action by user\",\"InitialAccess DefenseEvasion Collection Impact\",\"T1485 T1005 T1119 T1078\"\r\n\"OracleDatabaseAudit\",\"859c26cc-a779-4259-b981-6c6bc8f6402b\",\"OracleDBAudit - Active Users\",\"InitialAccess DefenseEvasion\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"48fa6c2c-6e30-49e1-bc94-744212f99bfe\",\"OracleDBAudit - Users connected to databases during non-operational hours\",\"InitialAccess DefenseEvasion Collection Impact\",\"T1485 T1005 T1119 T1078\"\r\n\"OracleDatabaseAudit\",\"e74b944a-c438-4949-b4d0-cdfe3a9354c9\",\"OracleDBAudit - Dropped Tables\",\"Impact\",\"T1485\"\r\n\"OracleDatabaseAudit\",\"2c7bbbe1-17cb-44ec-be63-fbb37b609403\",\"OracleDBAudit - Inactive Users\",\"InitialAccess\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"ba5e1a88-2054-4bda-a6e0-20008148ae6e\",\"OracleDBAudit - Audit large queries\",\"InitialAccess DefenseEvasion\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"b8fcb5b8-254c-4d49-865e-403b8453f487\",\"OracleDBAudit - Top tables queries\",\"Collection\",\"T1005 T1119\"\r\n\"OracleDatabaseAudit\",\"6be9634e-6661-4bff-98f1-4a743d7231a5\",\"OracleDBAudit - Users with new privileges\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"OracleDatabaseAudit\",\"46bbb4e9-fdeb-45dc-b4df-e4cee0f90ef0\",\"OracleDBAudit - Users Privileges Review\",\"InitialAccess PrivilegeEscalation\",\"T1078 \"\r\n\"OracleWebLogicServer\",\"5c2f090d-2072-4ad9-a749-394593d7091b\",\"Oracle - Request to forbidden files\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"419a91d4-5741-11ec-bf63-0242ac130002\",\"Oracle - Abnormal request size\",\"Exfiltration Collection\",\"T1530 T1537\"\r\n\"OracleWebLogicServer\",\"877125e6-5779-11ec-bf63-0242ac130002\",\"Oracle - Critical event severity\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"41aec744-5778-11ec-bf63-0242ac130002\",\"Oracle - Error messages\",\"DefenseEvasion\",\"T1070\"\r\n\"OracleWebLogicServer\",\"34d32bf0-5741-11ec-bf63-0242ac130002\",\"Oracle - Top files requested by users with error\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"0a58d21c-5741-11ec-bf63-0242ac130002\",\"Oracle - Rare user agents with client errors\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"f917b23e-5740-11ec-bf63-0242ac130002\",\"Oracle - Rare URLs requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"e6c42fe0-5740-11ec-bf63-0242ac130002\",\"Oracle - Rare user agents\",\"InitialAccess\",\"T1190 T1133\"\r\n\"OracleWebLogicServer\",\"b89b3474-5740-11ec-bf63-0242ac130002\",\"Oracle - Top URLs client errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"OracleWebLogicServer\",\"a5767caa-5740-11ec-bf63-0242ac130002\",\"Oracle - Top URLs server errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"PaloAlto-PAN-OS\",\"2f8522fc-7807-4f0a-b53d-458296edab8d\",\"Palo Alto - potential beaconing detected\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"PaloAlto-PAN-OS\",\"0a57accf-3548-4e38-a861-99687c958f59\",\"Palo Alto - high-risk ports\",\"InitialAccess Discovery\",\r\n\"PaloAltoCDL\",\"97760cb0-511e-11ec-bf63-0242ac130002\",\"PaloAlto - Critical event result\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"2af5e154-511f-11ec-bf63-0242ac130002\",\"PaloAlto - File permission with PUT or POST request \",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"a8887944-4c72-11ec-81d3-0242ac130003\",\"PaloAlto - Destination ports by IPs \",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"7cbd46ce-5121-11ec-bf63-0242ac130002\",\"PaloAlto - Incomplete application protocol\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"04456860-5122-11ec-bf63-0242ac130002\",\"PaloAlto - Multiple Deny result by user\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"555bf415-e171-4ad2-920f-1a4a96a9644c\",\"PaloAlto - Agent versions\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"6e4b6758-23a5-409b-a444-9bdef78e9dcc\",\"PaloAlto - Outdated config vesions\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"0a18756a-5123-11ec-bf63-0242ac130002\",\"PaloAlto - Rare application layer protocols\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"93ae5df2-4c74-11ec-81d3-0242ac130003\",\"PaloAlto - Rare files observed \",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoCDL\",\"ce9d58ce-51cd-11ec-bf63-0242ac130002\",\"PaloAlto - Rare ports by user\",\"InitialAccess\",\"T1190 T1133\"\r\n\"PaloAltoPrismaCloud\",\"f2e509e5-6eda-4626-a167-2875eb9c48af\",\"Palo Alto Prisma Cloud - Access keys used\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"21b4c55b-3a86-40a4-81c4-31945e8f7562\",\"Palo Alto Prisma Cloud - Top sources of failed logins\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"4c17ad45-fe78-4639-98cc-3b2fd173b053\",\"Palo Alto Prisma Cloud - Top users by failed logins\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"23a0867f-a522-4b34-acf4-0eadf75fc1e7\",\"Palo Alto Prisma Cloud - High risk score opened alerts\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"dde04bfe-7237-4205-a447-258201e369e4\",\"Palo Alto Prisma Cloud - High severity alerts\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"fd92609a-71bd-4da7-8388-e80147757e63\",\"Palo Alto Prisma Cloud - New users\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"4a09caf2-08a2-4c1d-981d-bb734de12a29\",\"Palo Alto Prisma Cloud - Opened alerts\",\"InitialAccess\",\"T1078\"\r\n\"PaloAltoPrismaCloud\",\"08ab5107-5c4e-4baf-b0f4-bf75c044f8b1\",\"Palo Alto Prisma Cloud - Top recources with alerts\",\"InitialAccess\",\"T1133\"\r\n\"PaloAltoPrismaCloud\",\"d0a145c5-546d-48df-a5d7-8866f3bbe24f\",\"Palo Alto Prisma Cloud - Updated resources\",\"InitialAccess\",\"T1133\"\r\n\"PingFederate\",\"e309c774-8f31-41c3-b270-7efc934de96a\",\"Ping Federate - Authentication URLs\",\"CredentialAccess\",\"T1110\"\r\n\"PingFederate\",\"b04e339c-942d-439a-bc27-dbee2961927c\",\"Ping Federate - Failed Authentication\",\"InitialAccess\",\"T1566\"\r\n\"PingFederate\",\"a52d874d-dc45-438f-b395-92d1a3ebcf76\",\"Ping Federate - New users\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"31bb34b4-26f7-4b83-a667-d596e05eb28a\",\"Ping Federate - Password reset requests\",\"InitialAccess Persistence\",\"T1078 T1098\"\r\n\"PingFederate\",\"86c8a38a-96bd-445d-8d12-e35b7290832b\",\"Ping Federate - Rare source IP addresses\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"b0a25cd9-08f4-470d-bd04-47da22810b5f\",\"Ping Federate - SAML subjects\",\"CredentialAccess\",\"T1528\"\r\n\"PingFederate\",\"ce92624d-ae52-4b8e-ba36-3e5bdb6a793a\",\"Ping Federate - Top source IP addresses\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"378e53cd-c28a-46d7-8160-1920240bf09e\",\"Ping Federate - Requests from unusual countries\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"0bce5bd0-cc19-43de-a5ab-47dbc5c6c600\",\"Ping Federate - Authentication from unusual sources\",\"InitialAccess\",\"T1078\"\r\n\"PingFederate\",\"6698f022-adf4-48a3-a8da-a4052ac999b4\",\"Ping Federate - Users recently reseted password\",\"InitialAccess Persistence\",\"T1078 T1098\"\r\n\"Prancer PenSuiteAI Integration\",\"322591e4-5b68-4574-be00-2e1b618eab7c\",\"Hunting Query for Failed CSPM Scan Items\",\"Collection\",\"T0811\"\r\n\"Prancer PenSuiteAI Integration\",\"37cb2dea-7a62-4a8d-923b-d588c6372608\",\"Hunting Query for High Severity PAC findings\",\"Collection\",\"T0811\"\r\n\"Proofpoint On demand(POD) Email Security\",\"0794a162-8635-43fd-81ed-2cf2604575b1\",\"ProofpointPOD - Emails with high score of 'adult' filter classifier value\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"eb74aaab-ebf4-4763-9b03-b1a33fe48600\",\"ProofpointPOD - Emails with high score of 'malware' filter classifier value\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"a0d56fcd-edb3-46f1-aaa3-12d606a48ff1\",\"ProofpointPOD - Emails with high score of 'phish' filter classifier value\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"c9ff3690-b754-4c91-b866-4d07098da074\",\"ProofpointPOD - Emails with high score of 'spam' filter classifier value\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"bc619ce8-0807-4b13-93ea-0d7b79c7ee68\",\"ProofpointPOD - Emails with high score of 'suspect' filter classifier value\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"dd9674cf-898b-4c80-96f1-f70bec66e6fc\",\"ProofpointPOD - Large size outbound emails\",\"Exfiltration\",\r\n\"Proofpoint On demand(POD) Email Security\",\"d324e435-31d3-4aa3-907c-76f4917820a9\",\"ProofpointPOD - Recipients with high number of discarded or rejected emails\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"c334e1e8-a7da-4c23-a9c0-fdda26b07606\",\"ProofpointPOD - Recipients with large number of corrupted emails\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"af7f133a-5fed-4ebf-8272-4330c884c7ca\",\"ProofpointPOD - Senders with large number of corrupted messages\",\"InitialAccess\",\r\n\"Proofpoint On demand(POD) Email Security\",\"7b281f4a-6a9a-439f-8b4f-f08eb24f2fb7\",\"ProofpointPOD - Suspicious file types in attachments\",\"InitialAccess\",\r\n\"Recorded Future\",\"d641a534-ead8-41aa-a7c8-2b35e6b64c9f\",\"RecordedFuture Threat Hunting Domain All Actors\",,\r\n\"Recorded Future\",\"905da21a-c7d2-4f5b-b8fc-c8321da3ee83\",\"RecordedFuture Threat Hunting Hash All Actors\",,\r\n\"Recorded Future\",\"7b5eb44d-3533-440e-9774-73a4d99bc2b2\",\"RecordedFuture Threat Hunting IP All Actors\",,\r\n\"Recorded Future\",\"dbc2438a-0d16-4890-aaae-cbe0dc433b08\",\"RecordedFuture Threat Hunting URL All Actors\",,\r\n\"SecurityThreatEssentialSolution\",\"f347ff55-6443-46b6-9abb-4f8f9b3209f8\",\"Threat Essentials - Signins From VPS Providers\",\"InitialAccess\",\"T1078\"\r\n\"SecurityThreatEssentialSolution\",\"1eaad895-7796-466b-8bf3-cec0fa78d0e4\",\"Threat Essentials - Signins from Nord VPN Providers\",\"InitialAccess\",\"T1078\"\r\n\"SenservaPro\",\"1BDB9A37-DC72-4C5A-A222-08443865DC0D\",\"Application not using client credentials\",\"Impact\",\"T1529 T1485\"\r\n\"SenservaPro\",\"95226772-981E-41AB-80E3-5B6A6F1D26D9\",\"Azure secure score admin MFA V2\",\"Impact\",\"T1529 T1498\"\r\n\"SenservaPro\",\"E7BDD9F9-CB83-46E3-9A8E-F14198D3C530\",\"Azure secure score block legacy authentication\",\"CredentialAccess\",\"T1212 T1556\"\r\n\"SenservaPro\",\"0810700D-F0E9-44AE-874F-45985921EFDE\",\"Azure secure score integrated apps\",\"Exfiltration\",\"T1020\"\r\n\"SenservaPro\",\"6111B528-DA13-4FA0-A2E6-4CB32D943F58\",\"Azure secure score MFA registration V2\",\"CredentialAccess\",\"T1056\"\r\n\"SenservaPro\",\"27982ECB-493E-4DAE-BB21-6F0B77B25526\",\"Azure secure score one admin\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"54F23B1D-F8D3-46C5-85F9-24126446A688\",\"Azure secure score PW age policy new\",\"CredentialAccess\",\"T1555 T1606 T1040\"\r\n\"SenservaPro\",\"AD9CDDB0-6DAA-4616-A397-B9DF7D6082F4\",\"Azure secure score role overlap\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"EF37B9A3-C792-4F2F-8A4E-F8416DE43455\",\"Azure Secure Score Self Service Password Reset\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"28C19364-EF24-4798-A656-D9C798559D98\",\"Azure secure score sign in risk policy\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"B91AC293-3855-4AB6-A9EE-E107930765D7\",\"Azure secure score user risk policy\",\"Impact\",\"T1529\"\r\n\"SenservaPro\",\"9B6558C4-BA23-40AC-B95F-42F8A29A3B35\",\"Non-admin guest\",\"InitialAccess\",\"T1078\"\r\n\"SenservaPro\",\"B604620B-0D87-4FFD-BE2E-7E40E81CE559\",\"Service principal not using client credentials\",\"InitialAccess\",\"T1078\"\r\n\"SenservaPro\",\"29AEBD0F-25AE-4D81-B0C2-2FB7F45F0340\",\"Stale last password change\",\"InitialAccess\",\"T1566\"\r\n\"SenservaPro\",\"4CA722E6-B165-42CD-8EB2-88304A0FC3DA\",\"UserAccountDisabled\",\"InitialAccess\",\"T1078\"\r\n\"SentinelOne\",\"7fc83c11-1d80-4d1e-9d4b-4f48bbf77abe\",\"Sentinel One - Agent not updated\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"4b2ed4b6-10bf-4b2c-b31e-ae51b575dfd4\",\"Sentinel One - Agent status\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"660e92b5-1ef6-471f-b753-44a34af82c41\",\"Sentinel One - Alert triggers (files, processes,strings)\",\"InitialAccess\",\"T1204\"\r\n\"SentinelOne\",\"e45ff570-e8a6-4f8e-9c08-7ee92ef86060\",\"Sentinel One - Hosts not scanned recently\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"9c3a38e4-0975-4f96-82ee-90ce68bec76a\",\"Sentinel One - New rules\",\"DefenseEvasion\",\"T1562\"\r\n\"SentinelOne\",\"8d1ca735-e29a-4bea-a2ec-93162790b686\",\"Sentinel One - Deleted rules\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"17c77743-8bdb-4d29-a3cb-a7a08676122f\",\"Sentinel One - Scanned hosts\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"acd0a127-461e-48c8-96fa-27d14595abe0\",\"Sentinel One - Sources by alert count\",\"InitialAccess\",\"T1204\"\r\n\"SentinelOne\",\"f3a7cedd-6fc3-4661-a0ad-c1738e531917\",\"Sentinel One - Uninstalled agents\",\"DefenseEvasion\",\"T1070\"\r\n\"SentinelOne\",\"56500e23-4e64-45a5-a444-98a1acb2f700\",\"Sentinel One - Users by alert count\",\"InitialAccess\",\"T1204\"\r\n\"SlackAudit\",\"cefd7f18-9359-4a99-bd18-965983bb724d\",\"SlackAudit - Applications installed\",\"InitialAccess\",\"T1133\"\r\n\"SlackAudit\",\"f2b2cd0d-6190-44aa-8e0e-265de45ee379\",\"SlackAudit - Deactivated users\",\"Impact\",\"T1531\"\r\n\"SlackAudit\",\"7865b00c-26c8-46db-9422-bb9e4ee696ac\",\"SlackAudit - Downloaded files stats\",\"InitialAccess\",\"T1189 T1133\"\r\n\"SlackAudit\",\"b62b5a97-41e5-47cb-9b90-aa079f65f0c0\",\"SlackAudit - Failed logins with unknown user\",\"CredentialAccess\",\"T1110\"\r\n\"SlackAudit\",\"d65400c2-50a3-46cc-b3e6-1cb72b953e72\",\"SlackAudit - New User created\",\"Persistence\",\"T1136\"\r\n\"SlackAudit\",\"31e54776-f2db-4465-b951-410880e009ad\",\"SlackAudit - Suspicious files downloaded\",\"InitialAccess\",\"T1189\"\r\n\"SlackAudit\",\"aa9bc100-012a-4348-820d-06606fc11299\",\"SlackAudit - Uploaded files stats\",\"Exfiltration\",\"T1048\"\r\n\"SlackAudit\",\"85850974-acbf-47bd-a635-4e3511b553c0\",\"SlackAudit - User logins by IP\",\"InitialAccess Persistence\",\"T1078\"\r\n\"SlackAudit\",\"7adbe474-debf-47c2-9d76-49efd4d2953b\",\"SlackAudit - User Permission Changed \",\"PrivilegeEscalation\",\"T1078\"\r\n\"SlackAudit\",\"ef815b70-e6f6-427b-ac9f-56d73472c4c3\",\"SlackAudit - Users joined channels without invites\",\"InitialAccess Persistence\",\"T1133\"\r\n\"Snowflake\",\"6aae5700-79da-4b41-98cc-f77bf7489f01\",\"Snowflake - Privileged users' source IP addresses\",\"InitialAccess\",\"T1078\"\r\n\"Snowflake\",\"09cc7b43-2ea1-464f-a72c-2ec187405505\",\"Snowflake - Deleted databases\",\"Impact\",\"T1485\"\r\n\"Snowflake\",\"5736df91-ec99-4fb2-b162-a17607d20ee8\",\"Snowflake - Deleted tables\",\"Impact\",\"T1485\"\r\n\"Snowflake\",\"fcc5f12b-bfa7-45f1-8722-a72eb77a5a4a\",\"Snowflake - Rarely used account \",\"InitialAccess\",\"T1078\"\r\n\"Snowflake\",\"b4a062d1-c95b-4b55-b984-a7efbc2e3a0f\",\"Snowflake - Failed logins\",\"InitialAccess\",\"T1078\"\r\n\"Snowflake\",\"6e8315eb-86a0-4a15-925d-a36c29d13bbd\",\"Snowflake - Credit consuming queries\",\"Impact\",\"T1499\"\r\n\"Snowflake\",\"8f8a8ac1-82aa-4569-b3ec-46dbf2676bf0\",\"Snowflake - Time consuming queries\",\"Impact\",\"T1499\"\r\n\"Snowflake\",\"98f57314-b6d3-4f3a-8e10-c691d8c946d5\",\"Snowflake - Unknown query type\",\"Impact\",\"T1499\"\r\n\"Snowflake\",\"112311cc-6361-4c56-9520-1147371b01ac\",\"Snowflake - Rarely used privileged users\",\"InitialAccess\",\"T1078\"\r\n\"Snowflake\",\"169b4c88-10f5-42c2-a45f-0959689ca22a\",\"Snowflake - Users' source IP addresses\",\"InitialAccess\",\"T1078\"\r\n\"SonicWall Firewall\",\"dedb8fb9-3caa-4b00-ae88-1898eed78917\",\"Outbound SSH/SCP Connections\",\"Exfiltration\",\"T1020 T1048\"\r\n\"Syslog\",\"1ef1c38f-26dd-4e28-b884-5b3665352648\",\"Crypto currency miners EXECVE\",\"Persistence Execution\",\"T1059 T1053\"\r\n\"Syslog\",\"005d6e3c-7453-46f6-aef3-f59695594545\",\"Suspicious crytocurrency mining related threat activity detected\",\"DefenseEvasion\",\"T1489\"\r\n\"Syslog\",\"d0ae35df-0eaf-491f-b23e-8190e4f3ffe9\",\"Rare process running on a Linux host\",\"Execution Persistence\",\"T1059 T1053 T1037\"\r\n\"Syslog\",\"0d298a1d-1a08-4f4b-8b28-687bfe0012e8\",\"SCX Execute RunAs Providers\",\"InitialAccess Execution\",\"T1190 T1203\"\r\n\"Syslog\",\"eb09da09-6f6c-4502-bf74-f7b9f1343539\",\"Linux scheduled task Aggregation\",\"Persistence Execution\",\"T1059 T1053 T1037\"\r\n\"Syslog\",\"6f0f1821-5981-408a-930b-8b2ca60e9e6c\",\"Editing Linux scheduled tasks through Crontab\",\"Persistence Execution\",\"T1059 T1053 T1037\"\r\n\"Syslog\",\"7aaa7675-1580-47d8-a404-039cb7284279\",\"Squid commonly abused TLDs\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"Syslog\",\"edbeec9f-86b9-475d-8a42-cc7b95ad2baa\",\"Squid malformed requests\",\"Discovery\",\"T1046\"\r\n\"Syslog\",\"e472c490-4792-4f12-8b6b-6ab3e0404d35\",\"Squid data volume timeseries anomalies\",\"CommandAndControl Exfiltration\",\"T1071 T1030\"\r\n\"Threat Intelligence\",\"410da56d-4a63-4d22-b68c-9fb1a303be6d\",\"TI Map File Entity to OfficeActivity Event\",\"Impact\",\r\n\"Threat Intelligence\",\"233441b9-cc92-4c9b-87fa-73b855fcd4b8\",\"TI Map File Entity to Security Event\",\"Impact\",\r\n\"Threat Intelligence\",\"18f7de84-de55-4983-aca3-a18bc846b4e0\",\"TI Map File Entity to Syslog Event\",\"Impact\",\r\n\"Threat Intelligence\",\"172a321b-c46b-4508-87c6-e2691c778107\",\"TI Map File Entity to VMConnection Event\",\"Impact\",\r\n\"Threat Intelligence\",\"689a9475-440b-4e69-8ab1-a5e241685f39\",\"TI Map File Entity to WireData Event\",\"Impact\",\r\n\"Tomcat\",\"72ae8a54-4879-11ec-81d3-0242ac130003\",\"Tomcat - Request to forbidden file\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"d5e1eb24-487a-11ec-81d3-0242ac130003\",\"Tomcat - Abnormal request size\",\"Exfiltration Collection\",\"T1530 T1537\"\r\n\"Tomcat\",\"7be944be-487f-11ec-81d3-0242ac130003\",\"Tomcat - Catalina errors\",\"DefenseEvasion\",\"T1070\"\r\n\"Tomcat\",\"c2e8ad40-4880-11ec-81d3-0242ac130003\",\"Tomcat - Rare files requested \",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"ed6686b4-4880-11ec-81d3-0242ac130003\",\"Tomcat - Rare URLs requested\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"191bd49e-4881-11ec-81d3-0242ac130003\",\"Tomcat - Top files with error requests \",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"60725e58-4881-11ec-81d3-0242ac130003\",\"Tomcat - Top URLs client errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"Tomcat\",\"919725a4-4881-11ec-81d3-0242ac130003\",\"Tomcat - Top URLs server errors\",\"Impact InitialAccess\",\"T1498 T1190 T1133\"\r\n\"Tomcat\",\"d214c244-4881-11ec-81d3-0242ac130003\",\"Tomcat - Uncommon user agent strings\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"033d672c-4882-11ec-81d3-0242ac130003\",\"Tomcat - Rare user agents with client errors\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Tomcat\",\"2be563f0-4882-11ec-81d3-0242ac130003\",\"Tomcat - Rare user agents with server errors\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Trend Micro Apex One\",\"96451e96-67b5-11ec-90d6-0242ac120003\",\"ApexOne - Behavior monitoring actions by files\",\"Execution\",\"T1204\"\r\n\"Trend Micro Apex One\",\"0caa3472-67b6-11ec-90d6-0242ac120003\",\"ApexOne - Behavior monitoring operations by users\",\"Execution\",\"T1204\"\r\n\"Trend Micro Apex One\",\"14a4a824-67b6-11ec-90d6-0242ac120003\",\"ApexOne - Behavior monitoring triggered policy by command line\",\"Execution\",\"T1204\"\r\n\"Trend Micro Apex One\",\"433ccdb0-67b6-11ec-90d6-0242ac120003\",\"ApexOne - Behavior monitoring event types by users\",\"Privilege Escalation Persistence\",\"T1546\"\r\n\"Trend Micro Apex One\",\"40d8ad3e-67b4-11ec-90d6-0242ac120003\",\"ApexOne - Channel type by users\",\"CommandandControl\",\"T1071\"\r\n\"Trend Micro Apex One\",\"6c7f9bfe-67b5-11ec-90d6-0242ac120003\",\"ApexOne - Data loss prevention action by IP\",\"Collection\",\"T1213\"\r\n\"Trend Micro Apex One\",\"be89944e-4e75-4d0a-b2d6-ae757d22ed43\",\"ApexOne - Rare application protocols by Ip address\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Trend Micro Apex One\",\"506955be-648f-11ec-90d6-0242ac120003\",\"ApexOne - Spyware detection\",\"Execution\",\"T1204\"\r\n\"Trend Micro Apex One\",\"7bf0f260-61a0-11ec-90d6-0242ac120003\",\"ApexOne - Suspicious files events\",\"Execution\",\"T1204\"\r\n\"Trend Micro Apex One\",\"8bb86556-67b4-11ec-90d6-0242ac120003\",\"ApexOne - Top sources with alerts\",\"Execution InitialAccess PrivilegeEscalation DefenseEvasion CommandAndControl Exfiltration\",\"T1204 T1189 T1068 T1202 T1112 T1055 T1071 T1095 T1537 T1567\"\r\n\"Trend Micro Cloud App Security\",\"765f1769-cbe2-4c1a-a708-1769c2c48d79\",\"Trend Micro CAS - Files stored on cloud fileshare services\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"8c386a11-7282-41ae-8181-2bfcafe20aad\",\"Trend Micro CAS - Infected files received via email\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"440f5440-e452-4b19-a8a4-5e39b5676657\",\"Trend Micro CAS - Ransomware threats\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"08df251e-56c6-4e06-a41b-2c86344cb383\",\"Trend Micro CAS - Rare files received via email services\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"496a35f6-bc85-47f9-a48f-9a55d3c9530f\",\"Trend Micro CAS - Risky users\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"993ca829-5d6a-4432-b192-e5dcf7bfea0c\",\"Trend Micro CAS - Security risk scan threats\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"dfd91afc-66f0-4661-90d7-82f9b5bf3d8f\",\"Trend Micro CAS - Suspicious files on sharepoint\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"5b2dc14b-a55c-4002-8c2a-94f521baa0f4\",\"Trend Micro CAS - Files received via email services\",\"InitialAccess\",\"T1566\"\r\n\"Trend Micro Cloud App Security\",\"001be88a-e98f-4e9a-ad30-62b9ad8222a5\",\"Trend Micro CAS - DLP violations\",\"Exfiltration\",\"T1048\"\r\n\"Trend Micro Cloud App Security\",\"5ce1415f-cdea-4740-a481-73c1394248c2\",\"Trend Micro CAS - Virtual Analyzer threats\",\"InitialAccess\",\"T1566\"\r\n\"UEBA Essentials\",\"8741deeb-332e-4061-8873-5086040920e3\",\"Anomalous Microsoft Entra ID Account Manipulation\",\"Persistence\",\"T1098\"\r\n\"UEBA Essentials\",\"0454c8d8-d0a6-42a4-8d03-f5b4fdcbd173\",\"Anomalous Microsoft Entra ID Account Creation\",\"Persistence\",\"T1136\"\r\n\"UEBA Essentials\",\"bd6fda76-c0df-41b0-b8cd-808190e1ded0\",\"Anomalous Activity Role Assignment\",\"PrivilegeEscalation\",\"T1548\"\r\n\"UEBA Essentials\",\"f8ab176c-1f3f-4cb5-8dc1-f50d30bcae0d\",\"Anomalous Code Execution\",\"Execution\",\"T1059\"\r\n\"UEBA Essentials\",\"8cf3c78e-cd10-4bfb-bd69-d62dc7f375f1\",\"Anomalous Data Access\",\"Collection\",\"T1530\"\r\n\"UEBA Essentials\",\"fcb704ae-ac17-400a-9ed9-3c46bd0a3960\",\"Anomalous Defensive Mechanism Modification\",\"DefenseEvasion\",\"T1562\"\r\n\"UEBA Essentials\",\"77a58c08-bc8e-48b3-8fe9-6c38fd011cd9\",\"Anomalous Failed Logon\",\"CredentialAccess\",\"T1110.001\"\r\n\"UEBA Essentials\",\"eeea7fb9-21cf-4023-91dc-3f55d7548d14\",\"Anomalous Geo Location Logon\",\"InitialAccess\",\"T1078\"\r\n\"UEBA Essentials\",\"2e20ec77-8d50-4959-a70d-79c341ee2c37\",\"Anomalous Login to Devices\",\"PrivilegeEscalation\",\"T1078\"\r\n\"UEBA Essentials\",\"22b0262c-b6b5-4f15-82a4-93663e9965d7\",\"Anomalous Password Reset\",\"Impact\",\"T1531\"\r\n\"UEBA Essentials\",\"c01d95d3-ee85-4e7f-9aed-e62356f1de76\",\"Anomalous RDP Activity\",\"LateralMovement\",\"T1021\"\r\n\"UEBA Essentials\",\"782f3bad-31f7-468f-8f58-3b74fc931914\",\"Anomalous Resource Access\",\"LateralMovement\",\"T1550\"\r\n\"UEBA Essentials\",\"5aa5083c-1de6-42bb-a128-2ec2aba1de39\",\"Anomalous Role Assignment\",\"Persistence\",\"T1098\"\r\n\"UEBA Essentials\",\"bb3bb9da-9598-4d1f-af78-7cc2fd413b0b\",\"Anomalous Sign-in Activity\",\"Persistence\",\"T1078\"\r\n\"UEBA Essentials\",\"028ac38c-f5a4-483b-a58a-aa83d500bf27\",\"Anomalies on users tagged as VIP \",,\r\n\"UEBA Essentials\",\"9ba2b304-7767-4d54-b03c-b0161ae87cc7\",\"Anomalous action performed in tenant by privileged user\",,\r\n\"UEBA Essentials\",\"7c303408-f913-42f8-8d7b-9eb64a229c4d\",\"Dormant account activity from uncommon country\",,\r\n\"UEBA Essentials\",\"741fdf32-e002-4577-ac9b-839fb49f128e\",\"Anomalous connection from highly privileged user\",,\r\n\"UEBA Essentials\",\"c3b09dd3-ee50-41ae-b863-8603620e5f48\",\"Anomalous login activity originated from Botnet,Tor proxy or C2\",,\r\n\"UEBA Essentials\",\"8a255821-844a-4b6a-a529-0fdaff23219b\",\"New account added to admin group \",,\r\n\"UEBA Essentials\",\"f0ad3b3f-72ac-48b1-9f01-ad408b3af88e\",\"Terminated employee accessing High Value Asset \",,\r\n\"UEBA Essentials\",\"e091e85d-4376-48cd-9bff-4beaa2ed4280\",\"Activity from terminated employees after their termination date \",,\r\n\"UEBA Essentials\",\"202ee40b-e6d8-4968-9a79-cf24c5c09db9\",\"Anomalous update Key Vault activity by high blast radius user \",,\r\n\"Ubiquiti UniFi\",\"1e55cd44-36ee-47c5-98e6-7d6bb5f9cb37\",\"Ubiquiti - DNS requests timed out\",\"CommandAndControl Exfiltration\",\"T1572 T1041 T1071\"\r\n\"Ubiquiti UniFi\",\"2ad0b4eb-cc60-4d81-9fbe-d1d6f5f6da3a\",\"Ubiquiti - Hidden internal DNS server\",\"CommandAndControl\",\"T1071\"\r\n\"Ubiquiti UniFi\",\"cb1b48ad-141e-4349-bc12-59d05dec949f\",\"Ubiquiti - Rare internal ports\",\"CommandAndControl\",\"T1571\"\r\n\"Ubiquiti UniFi\",\"c10b0205-0cba-4701-abe0-77d540aa327e\",\"Ubiquiti - Top blocked destinations\",\"CommandAndControl Exfiltration\",\"T1090 T1041\"\r\n\"Ubiquiti UniFi\",\"1711aa1d-fd4f-4142-ba4e-4f959a43783d\",\"Ubiquiti - Top blocked external services\",\"CommandAndControl Exfiltration\",\"T1041 T1071\"\r\n\"Ubiquiti UniFi\",\"f81cdd1a-9d8b-4a64-8a11-68d11e9ce9a3\",\"Ubiquiti - Top blocked internal services\",\"InitialAccess CommandAndControl\",\"T1595 T1572 T1571 T1071\"\r\n\"Ubiquiti UniFi\",\"d306cfb0-cabf-4fd8-ad93-a8002129974e\",\"Ubiquiti - Top blocked sources\",\"CommandAndControl Exfiltration\",\"T1572 T1571 T1071\"\r\n\"Ubiquiti UniFi\",\"c7bb439e-fb88-4ca2-bbc3-47779ac42a22\",\"Ubiquiti - Top firewall rules\",\"CommandAndControl Exfiltration\",\"T1572 T1571 T1071\"\r\n\"Ubiquiti UniFi\",\"5bf4b982-a9e6-4877-b2c0-bdbe4d0f27db\",\"Ubiquiti - Unusual number of subdomains for top level domain (TLD)\",\"CommandAndControl\",\"T1071\"\r\n\"Ubiquiti UniFi\",\"e51aa189-40cc-465c-89eb-cb22db2f53ca\",\"Ubiquiti - Vulnerable devices\",\"InitialAccess\",\"T1190\"\r\n\"VMWareESXi\",\"a0f32708-e6fb-427f-94d2-b09cf64acdf8\",\"VMware ESXi - List of dormant users.\",\"InitialAccess\",\"T1078\"\r\n\"VMWareESXi\",\"6702f91d-c764-497b-8d67-1cce8a33b895\",\"VMware ESXi - Download errors\",\"InitialAccess\",\"T1190\"\r\n\"VMWareESXi\",\"b5424011-314b-4ddc-95db-12d2b6f1ce96\",\"VMware ESXi - NFC download activities\",\"InitialAccess\",\"T1190\"\r\n\"VMWareESXi\",\"fc6c0440-1bb6-4661-89e9-4cb2c8f1e5e2\",\"VMware ESXi - Root logins failures\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"VMWareESXi\",\"e04a7f8e-1a47-4390-943d-a6cabbf4ec6e\",\"VMware ESXi - Root logins\",\"InitialAccess PrivilegeEscalation\",\"T1078\"\r\n\"VMWareESXi\",\"d69f0373-f424-4f17-a34a-8379974fec6e\",\"VMware ESXi - List of unused VMs\",\"InitialAccess\",\"T1190\"\r\n\"VMWareESXi\",\"3467bb11-7cbf-49f7-9e71-c3d0da327af5\",\"VMware ESXi - VM high resource load\",\"Impact\",\"T1499\"\r\n\"VMWareESXi\",\"b8d23b5d-3fb0-4265-9f4f-8878bc87471d\",\"VMware ESXi - List of powered off VMs\",\"Impact\",\"T1529\"\r\n\"VMWareESXi\",\"9148aa96-1480-4150-9ed7-bacaae322260\",\"VMware ESXi - List of powered on VMs\",\"InitialAccess\",\"T1190\"\r\n\"VMWareESXi\",\"9a90ccdd-2091-447f-bea2-e8a5125c8dde\",\"VMware ESXi - List of virtual disks (images)\",\"Impact\",\"T1496\"\r\n\"VMware SD-WAN and SASE\",\"c514ecc9-fa74-4977-976b-847895ee7e71\",\"VMware Edge Cloud Orchestrator - High number of login failures from a source IP address\",\"CredentialAccess InitialAccess\",\"T1078\"\r\n\"Vectra AI Stream\",\"9e8038a8-926f-48cd-9075-5f69b15f5192\",\"Vectra AI - Potential Exfiltration over DNS\",\"CommandAndControl Exfiltration\",\"T1048.003 T1071.004\"\r\n\"Vectra AI Stream\",\"e10782ff-f379-4b59-bccf-4724b73e21f9\",\"Vectra AI - Malicious Tools File Copy \",\"CredentialAccess LateralMovement Collection\",\"T1570\"\r\n\"Vectra AI Stream\",\"59aae46b-38a4-4540-b6da-caa59bc34685\",\"Vectra AI - Potential LLMNR/NBT-NS Poisoning and SMB Relay\",\"CredentialAccess Collection\",\"T1557.001\"\r\n\"Vectra AI Stream\",\"797a5246-351e-407a-92cd-f60f9d9f890c\",\"Vectra AI - Possible PoshC2 Tunnel\",\"CommandAndControl\",\"T1071.001\"\r\n\"Vectra AI Stream\",\"489d1c70-5fe2-426b-afbe-371ab58605fe\",\"Vectra AI - Potential DCSync Attack\",\"CredentialAccess\",\"T1003.006\"\r\n\"Vectra AI Stream\",\"98ce0ffc-eb1d-458e-835f-6c72ff4d53d1\",\"Vectra AI - Possible Kali Linux Detected\",\"Exfiltration\",\"T1048.003\"\r\n\"Vectra AI Stream\",\"b8661942-b3ba-48a4-ae9d-db7c326ebd46\",\"Vectra AI - Beaconing Behaviors\",\"CommandAndControl\",\"T1095 T1071 T1573 T1008 T1095 T1571 T1219\"\r\n\"Vectra AI Stream\",\"3826de45-7300-44d7-800d-a2b457439dda\",\"Vectra AI - Suspicious Long DNS Queries\",\"CommandAndControl Exfiltration\",\"T1071.004 T1048.003\"\r\n\"Vectra AI Stream\",\"b8bacbda-3faa-49fb-b000-9334b2b51c8e\",\"Vectra AI - Suspicious number of sub-domains\",\"CommandAndControl Exfiltration\",\"T1071.004 T1048.003\"\r\n\"Vectra AI Stream\",\"5e3e6cd2-1fba-44c0-8ddf-ad599a06a9df\",\"Vectra AI - Suspicious Unsecured Credentials Group Policy Preferences\",\"CredentialAccess\",\"T1552.006\"\r\n\"Web Session Essentials\",\"69e53015-a309-4a8f-a94d-df61a9217e2f\",\"Empty User Agent Detected (ASIM Web Session)\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Web Session Essentials\",\"43c2832e-6c01-4dc1-bd9e-bc3f330c2b31\",\"Excessive number of forbidden requests detected (ASIM Web Session)\",\"Persistence CredentialAccess\",\"T1110 T1556\"\r\n\"Web Session Essentials\",\"e8adb0d9-c4fa-4557-97d0-cb9e221a63b2\",\"Detect IPAddress in the requested URL (ASIM Web Session)\",\"Exfiltration CommandAndControl\",\"T1041 T1071.001 T1001\"\r\n\"Web Session Essentials\",\"05f5cccd-ee93-4293-b7ad-05820aaa54a4\",\"Detect Kali Linux UserAgent (ASIM Web Session)\",\"Execution\",\"T1059 T1203\"\r\n\"Web Session Essentials\",\"8ece8108-7bf7-4571-8f32-ebfd92a6b1ad\",\"Beaconing traffic based on common user agents visiting limited number of domains (ASIM Web Session)\",\"CommandAndControl\",\"T1071.001 T1571\"\r\n\"Web Session Essentials\",\"75929222-fee5-4f97-a2cc-cb6f29444385\",\"Potential beaconing detected - Similar sent bytes (ASIM Web Session)\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"Web Session Essentials\",\"6338ca43-ae7c-4a91-9fe4-0f1ad4edf4a5\",\"Potential beaconing detected (ASIM Web Session)\",\"CommandAndControl\",\"T1071 T1571\"\r\n\"Web Session Essentials\",\"b653c2e0-ae0f-490b-9b2e-836858d28976\",\"Request from bots and crawlers (ASIM Web Session)\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Web Session Essentials\",\"6e813653-df72-4b14-954e-5619d1b6d586\",\"Detect threat information in web requests (ASIM Web Session)\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Web Shells Threat Protection\",\"cc087e7c-4db0-4bf9-9e48-287a9c9c3fbc\",\"Webshell Detection\",\"Persistence PrivilegeEscalation\",\"T1505\"\r\n\"Web Shells Threat Protection\",\"6911d1df-4204-43b2-a64c-3cb102551ddd\",\"Possible Webshell usage attempt related to SpringShell(CVE-2022-22965)\",\"Execution\",\"T1059.007\"\r\n\"Web Shells Threat Protection\",\"e0c947c3-fe83-46ff-bbda-a43224a785fd\",\"Web Shell Activity\",\"Persistence InitialAccess\",\"T1505\"\r\n\"Web Shells Threat Protection\",\"42e7df5b-80f6-49a5-946a-08026ec24807\",\"Exchange IIS Worker Dropping Webshells\",\"Execution Persistence\",\r\n\"Web Shells Threat Protection\",\"60d15bd4-1fad-4a70-bc3b-094dc1c5e554\",\"UMWorkerProcess Creating Webshell\",\"Execution Persistence Exploit\",\r\n\"Windows Security Events\",\"a308d780-1c39-4fa7-8c21-bb54f174b065\",\"AD Account Lockout\",\"Impact\",\"T1531\"\r\n\"Windows Security Events\",\"9ce755c1-d2e6-4e2f-82d5-7871ec1aef91\",\"Commands executed by WMI on new hosts - potential Impacket\",\"Execution LateralMovement\",\"T1047 T1021.006\"\r\n\"Windows Security Events\",\"5a3615af-21c9-427e-8bf1-ed2350992bb4\",\"Crash dump disabled on host\",\"DefenseEvasion\",\"T1070\"\r\n\"Windows Security Events\",\"7e5f3a9a-542c-417a-a429-4ed500c5c4d8\",\"Domain controller installation media creation \",\"CredentialAccess\",\"T1003\"\r\n\"Windows Security Events\",\"892cd37e-f9e1-49c3-b0b2-d74f52ac7b71\",\"VIP account more than 6 failed logons in 10\",\"CredentialAccess\",\r\n\"Windows Security Events\",\"a4dbc292-87eb-11ec-a8a3-0242ac120002\",\"Decoy User Account Authentication Attempt\",\"LateralMovement\",\"T1021\"\r\n\"Windows Security Events\",\"e7dd442a-0af8-48eb-8358-9e91f4911849\",\"Discord download invoked from cmd line\",\"Execution CommandAndControl Exfiltration\",\"T1204 T1102 T1567\"\r\n\"Windows Security Events\",\"8afd1086-fc9a-4d26-b3ff-5c794c79a59a\",\"Exchange PowerShell Snapin Added\",\"Collection\",\"T1119\"\r\n\"Windows Security Events\",\"e7642e6e-cf27-46ec-a4b9-e4475228fead\",\"Summary of failed user logons by reason of failure\",\"CredentialAccess LateralMovement\",\"T1110\"\r\n\"Windows Security Events\",\"cb47a115-2616-4d56-890d-b28c14bc83e4\",\"Group added to Built in Domain Local or Global Group\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Windows Security Events\",\"2e2fab4b-83dd-4cf8-b2dd-063d0fd15513\",\"Host Exporting Mailbox and Removing Export\",\"Collection\",\"T1114\"\r\n\"Windows Security Events\",\"62e2df59-1535-4c8e-ac6c-c91faeed0179\",\"Hosts with new logons\",\"CredentialAccess LateralMovement\",\"T1110\"\r\n\"Windows Security Events\",\"ce38c16c-a560-46c0-88d6-7757b88f08e9\",\"Establishing internal proxies\",\"CommandandControl\",\"T1090\"\r\n\"Windows Security Events\",\"a344e28e-095d-47fb-84a8-d06edd31d2cb\",\"Invoke-PowerShellTcpOneLine Usage.\",\"Exfiltration\",\"T1011\"\r\n\"Windows Security Events\",\"ccbc73a1-d303-4613-aed4-478e996f454e\",\"KrbRelayUp Local Privilege Escalation Service Creation\",\"PrivilegeEscalation\",\"T1543\"\r\n\"Windows Security Events\",\"3712595d-6f47-416b-963a-605201ed2764\",\"Least Common Parent And Child Process Pairs\",\"Execution\",\r\n\"Windows Security Events\",\"088d30e9-c02b-46b1-bd1f-d5b6d6b782f0\",\"Least Common Processes by Command Line\",\"Execution\",\r\n\"Windows Security Events\",\"6d04a1ef-1b4d-4ff8-a76c-ad7d1a396136\",\"Least Common Processes Including Folder Depth\",\"Execution\",\r\n\"Windows Security Events\",\"c29a03c6-d074-4934-afae-df1aeb30da70\",\"Potential Exploitation of MS-RPRN printer bug\",\"PrivilegeEscalation\",\"T1134\"\r\n\"Windows Security Events\",\"9e3fab4b-94dd-4cf9-b2aa-063d0fd25513\",\"Multiple Explicit Credential Usage - 4648 events\",\"Discovery LateralMovement\",\"T1078\"\r\n\"Windows Security Events\",\"f885fb16-dfd3-4c90-83d9-7a66b9d9b654\",\"New Child Process of W3WP.exe\",\"Execution\",\"T1203\"\r\n\"Windows Security Events\",\"87c1f90a-f868-4528-a9c1-15520249cae6\",\"Nishang Reverse TCP Shell in Base64\",\"Exfiltration\",\"T1011\"\r\n\"Windows Security Events\",\"c2112ca3-aae0-4079-9bff-d74c54bb5fe5\",\"Powercat Download\",\"Exfiltration\",\"T1011\"\r\n\"Windows Security Events\",\"05208917-82de-46f7-a190-a65739a690f4\",\"Entropy for Processes for a given Host\",\"Execution\",\r\n\"Windows Security Events\",\"af02987c-949d-47d5-b0ae-64d8e1b674e2\",\"Rare Processes Run by Service Accounts\",\"Execution\",\r\n\"Windows Security Events\",\"0ff22697-dc58-4623-b844-a767629840cd\",\"Rare Process Path\",\"Execution\",\r\n\"Windows Security Events\",\"5550b630-7b8a-444e-a585-ec8c7533c028\",\"Hosts Running a Rare Process with Commandline\",\"Execution Persistence Discovery LateralMovement Collection\",\r\n\"Windows Security Events\",\"82e04ff9-a289-4005-9fcd-f1deec72e3fc\",\"Hosts Running a Rare Process\",\"Execution Persistence Discovery LateralMovement Collection\",\r\n\"Windows Security Events\",\"1e4a5be3-4a60-4099-b286-2d3642575889\",\"Remote Task Creation/Update using Schtasks Process\",\"Persistence\",\"T1053\"\r\n\"Windows Security Events\",\"5a9ccb48-1316-46e1-89d1-aca0355c305e\",\"Service installation from user writable directory\",\"Execution\",\"T1569.002\"\r\n\"Windows Security Events\",\"58fe8fc8-54fa-48cd-bac3-197f8d862429\",\"Suspected LSASS Dump\",\"CredentialAccess\",\"T1003\"\r\n\"Windows Security Events\",\"6cdef739-18f6-4b3a-8fdc-93e9a4302dbf\",\"Suspicious command line tokens in LolBins or LolScripts\",\"Execution\",\"T1218\"\r\n\"Windows Security Events\",\"e7bfbc3f-98c7-4aaa-a64c-de9c058b86b2\",\"Suspicious Windows Login Outside Normal Hours\",\"InitialAccess LateralMovement\",\"T1078\"\r\n\"Windows Security Events\",\"dd6fb889-43ef-44e1-a01d-093ab4bb12b2\",\"Suspicious Enumeration using Adfind Tool\",\"Execution Discovery Discovery\",\"T1059 T1087 T1482 T1201 T1069 T1074\"\r\n\"Windows Security Events\",\"d0f13bb9-e713-4f89-b610-1806326a1dea\",\"Summary of user logons by logon type\",\"CredentialAccess LateralMovement\",\"T1110\"\r\n\"Windows Security Events\",\"8d69a665-074a-443b-aae6-5dd9bdd5cfb1\",\"User Account added to Built in Domain Local or Global Group\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Windows Security Events\",\"6135a90e-ba30-4f36-9b6a-3a350050704b\",\"Long lookback User Account Created and Deleted within 10mins\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Windows Security Events\",\"d57f675c-ad6c-44d0-95fb-3bf707e70155\",\"User account added or removed from a security group by an unauthorized user\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Windows Security Events\",\"42ae9690-89ce-4063-9a90-465badad5395\",\"User created by unauthorized user\",\"Persistence PrivilegeEscalation\",\"T1098 T1078\"\r\n\"Windows Security Events\",\"e8d36582-c403-4466-bd44-ebede5b6fa6e\",\"VIP account more than 6 failed logons in 10\",\"CredentialAccess\",\"T1110\"\r\n\"Windows Security Events\",\"14fab7a3-cb11-41d6-a19a-b55a4a0ef3b1\",\"Windows System Shutdown/Reboot(Sysmon)\",\"Impact\",\"T1529\"\r\n\"Windows Security Events\",\"9fd6f61d-2cc3-48de-acf5-7194e78d6ea1\",\"Windows System Time changed on hosts\",\"DefenseEvasion\",\"T1070\"\r\n\"Windows Security Events\",\"36abe031-962d-482e-8e1e-a556ed99d5a3\",\"Cscript script daily summary breakdown\",\"Execution\",\r\n\"Windows Security Events\",\"a1e993de-770a-4434-83e9-9e3b47a6e470\",\"Enumeration of users and groups\",\"Discovery\",\r\n\"Windows Security Events\",\"60304ebf-ebdd-4869-a702-e0216d90ab46\",\"Masquerading files\",\"Execution\",\r\n\"Windows Security Events\",\"513e3a11-e1bb-4cfc-8af9-451da0407e6b\",\"New processes observed in last 24 hours\",\"Execution\",\r\n\"Windows Security Events\",\"5e76eaf9-79a7-448c-bace-28e5b53b8396\",\"Summary of users created using uncommon/undocumented commandline switches\",\"CredentialAccess LateralMovement\",\"T1110\"\r\n\"Windows Security Events\",\"d83f40fc-bbcc-4020-8d45-ad2d82355cb2\",\"PowerShell downloads\",\"Execution CommandAndControl\",\r\n\"Windows Security Events\",\"4e78daf1-8bba-4b5d-8a8b-c75fe9bbc2d9\",\"New PowerShell scripts encoded on the commandline\",\"Execution CommandAndControl\",\r\n\"Windows Security Events\",\"2ff4b10c-7056-4898-83fd-774104189fd5\",\"Uncommon processes - bottom 5%\",\"Execution\",\r\n\"Windows Server DNS\",\"8e9c4680-8c0b-4885-b183-3b09efd8fc2c\",\"DNS lookups for commonly abused TLDs\",\"CommandAndControl Exfiltration\",\"T1568 T1008 T1048\"\r\n\"Windows Server DNS\",\"1d9951b7-51f0-4aa7-af0c-654359aadfff\",\"DNS - domain anomalous lookup increase\",\"CommandAndControl Exfiltration\",\"T1568 T1008 T1048\"\r\n\"Windows Server DNS\",\"81b478a7-46e2-4f7f-a1aa-aba5e541232b\",\"DNS Full Name anomalous lookup increase\",\"CommandAndControl Exfiltration\",\"T1568 T1008 T1048\"\r\n\"Windows Server DNS\",\"543e1ec6-ee5e-4368-aaa6-405f0551ba5c\",\"Potential DGA detected\",\"CommandAndControl\",\"T1568 T1008\"\r\n\"Windows Server DNS\",\"fda90754-4e22-4bb1-8b99-2bb49a991eae\",\"High reverse DNS count by host\",\"Discovery\",\"T1046\"\r\n\"Windows Server DNS\",\"a0954a17-cc66-4d47-9651-8bf524bbdcc8\",\"Abnormally long DNS URI queries\",\"CommandAndControl Exfiltration\",\"T1568 T1008 T1048\"\r\n\"Windows Server DNS\",\"aaf84b80-7764-420c-98eb-239b5e194b3d\",\"DNS Domains linked to WannaCry ransomware campaign\",\"Impact\",\"T1496\"\r\n\"Windows Server DNS\",\"0fb54a5c-5599-4ff9-80a2-f788c3ed285e\",\"Solorigate DNS Pattern\",\"CommandAndControl\",\"T1568\"\r\n\"Windows Server DNS\",\"29a1815a-3ada-4182-a178-e52c483d2f95\",\"Solorigate Encoded Domain in URL\",\"CommandAndControl\",\"T1568\"\r\n\"ZeroNetworks\",\"3dd14edf-788d-4f42-868f-28f3208b92a9\",\"Zero Networks Segment - Excessive access by user\",\"LateralMovement\",\"T1210 T1570 T0866\"\r\n\"ZeroNetworks\",\"0e68d210-a8ec-4e13-9f46-61011c020b87\",\"Zero Networks Segment - Excessive access to a built-in group by user\",\"LateralMovement\",\"T1210 T1570 T0866\"\r\n\"ZeroNetworks\",\"fcbbd670-d4e6-4f3a-9008-d8905e84cf79\",\"Zero Networks Segment - Inbound Block Rules Deleted\",\"DefenseEvasion\",\"T1562\"\r\n\"ZeroNetworks\",\"d8945c8f-bba4-4e02-ad09-228b067ebcf2\",\"Zero Networks Segment - Outbound Block Rules Deleted\",\"DefenseEvasion\",\"T1562\"\r\n\"Zscaler Private Access (ZPA)\",\"181dc982-4631-11ec-81d3-0242ac130003\",\"Zscaler - Abnormal total bytes size\",\"Exfiltration Collection\",\"T1530 T1537\"\r\n\"Zscaler Private Access (ZPA)\",\"6ae7b9e0-462a-11ec-81d3-0242ac130003\",\"Zscaler - Applications using by accounts\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"5467efc0-422c-11ec-81d3-0242ac130003\",\"Zscaler - Connection close reasons\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"20733e72-4231-11ec-81d3-0242ac130003\",\"Zscaler - Destination ports by IP \",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"bf8ce3e8-422a-11ec-81d3-0242ac130003\",\"Zscaler - Users by source location countries \",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"26d5244a-462f-11ec-81d3-0242ac130003\",\"Zscaler - Top connectors\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"baf67720-4623-11ec-81d3-0242ac130003\",\"Zscaler - Top source IP\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"d311eb1e-4231-11ec-81d3-0242ac130003\",\"Zscaler - Rare urlhost\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"018e11f4-4627-11ec-81d3-0242ac130003\",\"Zscaler - Users access groups\",\"InitialAccess\",\"T1190 T1133\"\r\n\"Zscaler Private Access (ZPA)\",\"22545900-422d-11ec-81d3-0242ac130003\",\"Zscaler - Server error by user\",\"InitialAccess\",\"T1190 T1133\""
          },
          "apiVersion": "2022-08-01"
        },
        {
          "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/_ucases_')]",
          "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists",
          "kind": "",
          "properties": {
              "displayName": "_ucases_",
              "source": "csv",
              "description": "_ucases_",
              "provider": "Microsoft",
              "isDeleted": false,
              "labels": [
              ],
              "defaultDuration": "P1000Y",
              "contentType": "Text/Csv",
              "numberOfLinesToSkip": 0,
              "itemsSearchKey": "usecasename",
              "rawContent": "usecasename,tactic\r\n\"all\",\"DefenseEvasion InitialAccess Impact Collection Discovery Persistence CommandAndControl LateralMovement Reconnaissance Execution PrivilegeEscalation CredentialAccess Exfiltration\"\r\n\"Credential Exploitation\",\"ResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion CredentialAccess\"\r\n\"LateralMovement\",\"Reconnaissance ResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion CredentialAccess Discovery LateralMovement\"\r\n\"Rapid Encryption\",\"ReconnaissanceResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion Credential AccessDiscovery LateralMovement Collection CommandControl Exfiltration Impact\"\r\n\"CommandControl Communication\",\"ReconnaissanceResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion CredentialAccess Discovery LateralMovement Collection CommandControl\"\r\n\"Insider Risk\",\"Execution Persistence PrivilegeEscalation DefenseEvasion DiscoveryLateralMovement Collection Exfiltration Impact\"\r\n\"Anomalous Privilege Escalation\",\"Reconnaissance ResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation\"\r\n\"Third-Party Abuses\",\"InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion Credential AccessDiscovery LateralMovement Collection CommandControl Exfiltration Impact\"\r\n\"Overexposure\",\"Reconnaissance ResourceDevelopment InitialAccess PrivilegeEscalation DiscoveryLateralMovement Collection\"\r\n\"Data Exfiltration\",\"ReconnaissanceResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion Credential AccessDiscovery LateralMovement Collection CommandControl Exfiltration\"\r\n\"Mobile Data Security\",\"Reconnaissance ResourceDevelopment InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion Credential AccessDiscovery LateralMovement Collection CommandControl Exfiltration Impact\"\r\n\"Communication Abuse\",\"InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion Credential AccessDiscovery LateralMovement Collection CommandControl Exfiltration Impact\"\r\n\"Web Application Abuse\",\"InitialAccess Execution Persistence PrivilegeEscalation DefenseEvasion Discovery LateralMovement Collection CommandControl Exfiltration Impact\""
          },
          "apiVersion": "2022-08-01"
        },
        {
          "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/_wbooks_')]",
          "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists",
          "kind": "",
          "properties": {
              "displayName": "_wbooks_",
              "source": "csv",
              "description": "_wbooks_",
              "provider": "Microsoft",
              "isDeleted": false,
              "labels": [
              ],
              "defaultDuration": "P1000Y",
              "contentType": "Text/Csv",
              "numberOfLinesToSkip": 0,
              "itemsSearchKey": "solution",
              "rawContent": "solution,name\r\n\"1Password\",\"1Password\"\r\n\"42Crunch API Protection\",\"42CrunchAPIProtectionWorkbook\"\r\n\"AI Analyst Darktrace\",\"AIA-Darktrace\"\r\n\"AIShield AI Security Monitoring\",\"AIShield\"\r\n\"ARGOSCloudSecurity\",\"ARGOSCloudSecurityWorkbook\"\r\n\"AgileSec Analytics Connector\",\"InfoSecGlobal\"\r\n\"Alsid For AD\",\"AlsidIoA\"\r\n\"Alsid For AD\",\"AlsidIoE\"\r\n\"Amazon Web Services\",\"AmazonWebServicesNetworkActivities\"\r\n\"Amazon Web Services\",\"AmazonWebServicesUserActivities\"\r\n\"Apache Log4j Vulnerability Detection\",\"Log4jImpactAssessment\"\r\n\"Apache Log4j Vulnerability Detection\",\"Log4jPostCompromiseHunting\"\r\n\"ApacheHTTPServer\",\"ApacheHTTPServer\"\r\n\"AristaAwakeSecurity\",\"AristaAwakeSecurityWorkbook\"\r\n\"Armorblox\",\"ArmorbloxOverview\"\r\n\"AtlassianJiraAudit\",\"AtlassianJiraAudit\"\r\n\"Authomize\",\"Authomize\"\r\n\"Azure Activity\",\"AzureActivity\"\r\n\"Azure Activity\",\"AzureServiceHealthWorkbook\"\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"CloudNGFW-NetworkThreat\"\r\n\"Azure Cloud NGFW by Palo Alto Networks\",\"CloudNGFW-Overview\"\r\n\"Azure DDoS Protection\",\"AzDDoSStandardWorkbook\"\r\n\"Azure Firewall\",\"Azure Firewall Workbook - Deployment Template\"\r\n\"Azure Firewall\",\"Azure Firewall Workbook - Structured Logs - Deployment Template\"\r\n\"Azure Firewall\",\"AzureFirewallWorkbook-StructuredLogs\"\r\n\"Azure Firewall\",\"AzureFirewallWorkbook\"\r\n\"Azure Key Vault\",\"AzureKeyVaultWorkbook\"\r\n\"Azure SQL Database solution for sentinel\",\"Workbook-AzureSQLSecurity\"\r\n\"Azure Web Application Firewall (WAF)\",\"WebApplicationFirewallFirewallEvents\"\r\n\"Azure Web Application Firewall (WAF)\",\"WebApplicationFirewallGatewayAccessEvents\"\r\n\"Azure Web Application Firewall (WAF)\",\"WebApplicationFirewallOverview\"\r\n\"Azure Web Application Firewall (WAF)\",\"WebApplicationFirewallWAFTypeEvents\"\r\n\"Azure kubernetes Service\",\"AksSecurity\"\r\n\"AzureSecurityBenchmark\",\"AzureSecurityBenchmark\"\r\n\"BETTER Mobile Threat Defense (MTD)\",\"BETTER_MTD_Workbook\"\r\n\"Barracuda CloudGen Firewall\",\"Barracuda\"\r\n\"BitSight\",\"BitSightWorkbook\"\r\n\"Bitglass\",\"Bitglass\"\r\n\"Bitwarden\",\"BitwardenEventLogsAuthentication\"\r\n\"Bitwarden\",\"BitwardenEventLogsOrganization\"\r\n\"Bitwarden\",\"BitwardenEventLogsVaultItems\"\r\n\"BloodHound Enterprise\",\"BloodHoundEnterpriseAttackPath\"\r\n\"BloodHound Enterprise\",\"BloodHoundEnterprisePosture\"\r\n\"Box\",\"Box\"\r\n\"Check Point\",\"CheckPoint\"\r\n\"Cisco ETD\",\"CiscoETD\"\r\n\"Cisco ISE\",\"CiscoISE\"\r\n\"Cisco SD-WAN\",\"CiscoSDWAN\"\r\n\"CiscoASA\",\"Cisco\"\r\n\"CiscoDuoSecurity\",\"CiscoDuo\"\r\n\"CiscoMeraki\",\"CiscoMerakiWorkbook\"\r\n\"CiscoSEG\",\"CiscoSEG\"\r\n\"CiscoUmbrella\",\"CiscoUmbrella\"\r\n\"CiscoWSA\",\"CiscoWSA\"\r\n\"Citrix Analytics for Security\",\"Citrix\"\r\n\"Citrix Web App Firewall\",\"CitrixWAF\"\r\n\"Cloudflare\",\"Cloudflare\"\r\n\"CofenseIntelligence\",\"CofenseIntelligenceThreatIndicators\"\r\n\"CofenseTriage\",\"CofenseTriageThreatIndicators\"\r\n\"Cognni\",\"CognniIncidentsWorkbook\"\r\n\"ContinuousDiagnostics&Mitigation\",\"ContinuousDiagnostics%26Mitigation\"\r\n\"Contrast Protect\",\"ContrastProtect\"\r\n\"Corelight\",\"Corelight\"\r\n\"CrowdStrike Falcon Endpoint Protection\",\"CrowdStrikeFalconEndpointProtection\"\r\n\"CyberArk Enterprise Password Vault (EPV) Events\",\"CyberArkEPV\"\r\n\"CyberArkEPM\",\"CyberArkEPM\"\r\n\"CybersecurityMaturityModelCertification(CMMC)2.0\",\"CybersecurityMaturityModelCertification_CMMCV2\"\r\n\"Cybersixgill-Actionable-Alerts\",\"ActionableAlertsDashboard\"\r\n\"Cybersixgill-Actionable-Alerts\",\"ActionableAlertsList\"\r\n\"Cynerio\",\"CynerioOverviewWorkbook\"\r\n\"DNS Essentials\",\"DNSSolutionWorkbook\"\r\n\"Darktrace\",\"DarktraceWorkbook\"\r\n\"Dataminr Pulse\",\"DataminrPulseAlerts\"\r\n\"Delinea Secret Server\",\"DelineaWorkbook\"\r\n\"Digital Shadows\",\"DigitalShadows\"\r\n\"DigitalGuardianDLP\",\"DigitalGuardian\"\r\n\"Dynatrace\",\"Dynatrace\"\r\n\"ESETPROTECT\",\"ESETPROTECT\"\r\n\"EatonForeseer\",\"EatonForeseerHealthAndAccess\"\r\n\"Egress Defend\",\"DefendMetrics\"\r\n\"Egress Iris\",\"PreventWorkbook\"\r\n\"Eset Security Management Center\",\"esetSMCWorkbook\"\r\n\"ExtraHop Reveal(x)\",\"ExtraHopDetectionSummary\"\r\n\"F5 BIG-IP\",\"F5BIGIPSystemMetrics\"\r\n\"F5 BIG-IP\",\"F5Networks\"\r\n\"Flare\",\"FlareSystemsFireworkOverview\"\r\n\"Forcepoint CASB\",\"ForcepointCASB\"\r\n\"Forcepoint CSG\",\"ForcepointCloudSecuirtyGateway\"\r\n\"Forcepoint DLP\",\"ForcepointDLP\"\r\n\"Forcepoint NGFW\",\"ForcepointNGFW\"\r\n\"Forcepoint NGFW\",\"ForcepointNGFWAdvanced\"\r\n\"Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel\",\"Fortigate\"\r\n\"Fortinet FortiNDR Cloud\",\"FortinetFortiNdrCloudWorkbook\"\r\n\"Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel\",\"Fortiweb-workbook\"\r\n\"Gigamon Connector\",\"Gigamon\"\r\n\"GitHub\",\"GitHub\"\r\n\"GitHub\",\"GitHubAdvancedSecurity\"\r\n\"GoogleCloudPlatformDNS\",\"GCPDNS\"\r\n\"GoogleCloudPlatformIAM\",\"GCP_IAM\"\r\n\"GoogleWorkspaceReports\",\"GoogleWorkspace\"\r\n\"GreyNoiseThreatIntelligence\",\"GreyNoiseOverview\"\r\n\"IONIX\",\"IONIXOverviewWorkbook\"\r\n\"IllumioSaaS\",\"IllumioAuditableEvents\"\r\n\"IllumioSaaS\",\"IllumioFlowData\"\r\n\"Illusive Platform\",\"IllusiveADS\"\r\n\"Illusive Platform\",\"IllusiveASM\"\r\n\"ImpervaCloudWAF\",\"Imperva WAF Cloud Overview\"\r\n\"Infoblox Cloud Data Connector\",\"InfobloxCDCB1TDWorkbook\"\r\n\"Infoblox NIOS\",\"Infoblox-Workbook-V2\"\r\n\"Infoblox SOC Insights\",\"InfobloxSOCInsightsWorkbook\"\r\n\"IoTOTThreatMonitoringwithDefenderforIoT\",\"IoTOTThreatMonitoringwithDefenderforIoT\"\r\n\"IronNet IronDefense\",\"IronDefenseAlertDashboard\"\r\n\"IronNet IronDefense\",\"IronDefenseAlertDetails\"\r\n\"Island\",\"IslandAdminAuditOverview\"\r\n\"Island\",\"IslandUserActivityOverview\"\r\n\"Jamf Protect\",\"JamfProtectDashboard\"\r\n\"LastPass\",\"LastPassWorkbook\"\r\n\"Lookout\",\"LookoutEvents\"\r\n\"MailGuard 365\",\"MailGuard365Dashboard\"\r\n\"Malware Protection Essentials\",\"MalwareProtectionEssentialsWorkbook\"\r\n\"MaturityModelForEventLogManagementM2131\",\"MaturityModelForEventLogManagement_M2131\"\r\n\"McAfee ePolicy Orchestrator\",\"McAfeeePOOverview\"\r\n\"Microsoft 365\",\"ExchangeOnline\"\r\n\"Microsoft 365\",\"Office365\"\r\n\"Microsoft 365\",\"SharePointAndOneDrive\"\r\n\"Microsoft Defender Threat Intelligence\",\"MicrosoftThreatIntelligence\"\r\n\"Microsoft Defender XDR\",\"MDO Insights\"\r\n\"Microsoft Defender XDR\",\"MicrosoftDefenderForEndPoint\"\r\n\"Microsoft Defender XDR\",\"MicrosoftDefenderForIdentity\"\r\n\"Microsoft Defender for Cloud Apps\",\"MicrosoftCloudAppSecurity\"\r\n\"Microsoft Defender for Office 365\",\"MicrosoftDefenderForOffice365\"\r\n\"Microsoft Entra ID\",\"AzureActiveDirectoryAuditLogs\"\r\n\"Microsoft Entra ID\",\"AzureActiveDirectorySignins\"\r\n\"Microsoft Exchange Security - Exchange On-Premises\",\"Microsoft Exchange Admin Activity\"\r\n\"Microsoft Exchange Security - Exchange On-Premises\",\"Microsoft Exchange Least Privilege with RBAC\"\r\n\"Microsoft Exchange Security - Exchange On-Premises\",\"Microsoft Exchange Search AdminAuditLog\"\r\n\"Microsoft Exchange Security - Exchange On-Premises\",\"Microsoft Exchange Security Review\"\r\n\"Microsoft Exchange Security - Exchange Online\",\"Microsoft Exchange Admin Activity - Online\"\r\n\"Microsoft Exchange Security - Exchange Online\",\"Microsoft Exchange Least Privilege with RBAC - Online\"\r\n\"Microsoft Exchange Security - Exchange Online\",\"Microsoft Exchange Search AdminAuditLog - Online\"\r\n\"Microsoft Exchange Security - Exchange Online\",\"Microsoft Exchange Security Review - Online\"\r\n\"Microsoft PowerBI\",\"MicrosoftPowerBIActivityWorkbook\"\r\n\"Microsoft Purview\",\"MicrosoftPurview\"\r\n\"MicrosoftPurviewInsiderRiskManagement\",\"InsiderRiskManagement\"\r\n\"MimecastAudit\",\"MimecastAudit\"\r\n\"MimecastSEG\",\"MimecastSEGworkbook\"\r\n\"MimecastTIRegional\",\"MimecastTIRegional\"\r\n\"MimecastTTP\",\"MimecastTTPWorkbook\"\r\n\"NGINX HTTP Server\",\"NGINX\"\r\n\"NISTSP80053\",\"NISTSP80053\"\r\n\"NetClean ProActive\",\"NetCleanProActiveWorkbook\"\r\n\"Netskope\",\"NetskopeEvents\"\r\n\"Netskopev2\",\"NetskopeDashboard\"\r\n\"Network Session Essentials\",\"NetworkSessionEssentials\"\r\n\"Okta Single Sign-On\",\"OktaSingleSignOn\"\r\n\"Onapsis Platform\",\"OnapsisAlarmsOverview\"\r\n\"OneIdentity\",\"OneIdentity\"\r\n\"Oracle Cloud Infrastructure\",\"OracleCloudInfrastructureOCI\"\r\n\"OracleDatabaseAudit\",\"OracleDatabaseAudit\"\r\n\"OracleWebLogicServer\",\"OracleWorkbook\"\r\n\"Orca Security Alerts\",\"OrcaAlerts\"\r\n\"PCI DSS Compliance\",\"PCIDSSCompliance\"\r\n\"Palo Alto - XDR (Cortex)\",\"PaloAltoXDR\"\r\n\"PaloAlto-PAN-OS\",\"PaloAltoNetworkThreat\"\r\n\"PaloAlto-PAN-OS\",\"PaloAltoOverview\"\r\n\"PaloAltoCDL\",\"PaloAltoCDL\"\r\n\"PaloAltoPrismaCloud\",\"PaloAltoPrismaCloudOverview\"\r\n\"Perimeter 81\",\"Perimeter81OverviewWorkbook\"\r\n\"PingFederate\",\"PingFederate\"\r\n\"Prancer PenSuiteAI Integration\",\"PrancerSentinelAnalytics\"\r\n\"ProofPointTap\",\"ProofpointTAP\"\r\n\"Proofpoint On demand(POD) Email Security\",\"ProofpointPOD\"\r\n\"Pulse Connect Secure\",\"PulseConnectSecure\"\r\n\"QualysVM\",\"QualysVMv2\"\r\n\"ReversingLabs\",\"ReversingLabs-CapabilitiesOverview/ReversingLabs-CapabilitiesOverview\"\r\n\"SAP\",\"SAPVMIcon.svg\"\r\n\"SOC Handbook\",\"AnalyticsEfficiency\"\r\n\"SOC Handbook\",\"AnomaliesVisualization\"\r\n\"SOC Handbook\",\"AnomalyData\"\r\n\"SOC Handbook\",\"AttackSurfaceReduction\"\r\n\"SOC Handbook\",\"AzureSentinelCost\"\r\n\"SOC Handbook\",\"AzureSentinelSecurityAlerts\"\r\n\"SOC Handbook\",\"IncidentOverview\"\r\n\"SOC Handbook\",\"IntsightsIOCWorkbook\"\r\n\"SOC Handbook\",\"InvestigationInsights\"\r\n\"SOC Handbook\",\"MITREAttack\"\r\n\"SOC Handbook\",\"SecurityOperationsEfficiency\"\r\n\"SOC Handbook\",\"SecurityStatus\"\r\n\"SOC Handbook\",\"SentinelCentral\"\r\n\"SOC-Process-Framework\",\"Building_a_SOCLargeStaff\"\r\n\"SOC-Process-Framework\",\"Building_a_SOCMediumStaff\"\r\n\"SOC-Process-Framework\",\"Building_a_SOCPartTimeStaff\"\r\n\"SOC-Process-Framework\",\"Building_a_SOCSmallStaff\"\r\n\"SOC-Process-Framework\",\"SOCIRPlanning\"\r\n\"SOC-Process-Framework\",\"SOCProcessFramework\"\r\n\"SOC-Process-Framework\",\"UpdateSOCMaturityScore\"\r\n\"SalemCyber\",\"SalemDashboard\"\r\n\"Salesforce Service Cloud\",\"SalesforceServiceCloud\"\r\n\"SecurityBridge App\",\"SecurityBridgeThreatDetectionforSAP\"\r\n\"SecurityScorecard Cybersecurity Ratings\",\"SecurityScorecardWorkbook\"\r\n\"Semperis Directory Services Protector\",\"SemperisDSPADChanges\"\r\n\"Semperis Directory Services Protector\",\"SemperisDSPADChanges\"\r\n\"Semperis Directory Services Protector\",\"SemperisDSPNotifications\"\r\n\"Semperis Directory Services Protector\",\"SemperisDSPQuickviewDashboard\"\r\n\"Semperis Directory Services Protector\",\"SemperisDSPSecurityIndicators\"\r\n\"Semperis Directory Services Protector\",\"SemperisDSPWorkbook\"\r\n\"Semperis Directory Services Protector\",\"workbooksMetadata\"\r\n\"SenservaPro\",\"SenservaProAnalyticsWorkbook\"\r\n\"SenservaPro\",\"SenservaProMultipleWorkspaceWorkbook\"\r\n\"SenservaPro\",\"SenservaProSecureScoreMultiTenantWorkbook\"\r\n\"SentinelOne\",\"SentinelOne\"\r\n\"SentinelSOARessentials\",\"AutomationHealth\"\r\n\"SentinelSOARessentials\",\"IncidentOverview\"\r\n\"SentinelSOARessentials\",\"IncidentTasksWorkbook\"\r\n\"SentinelSOARessentials\",\"SecurityOperationsEfficiency\"\r\n\"SlackAudit\",\"SlackAudit\"\r\n\"Snowflake\",\"Snowflake\"\r\n\"SonicWall Firewall\",\"SonicWallFirewall\"\r\n\"SonraiSecurity\",\"Sonrai\"\r\n\"Sophos XG Firewall\",\"SophosXGFirewall\"\r\n\"Squadra Technologies SecRmm\",\"SquadraTechnologiesSecRMM\"\r\n\"Symantec Endpoint Protection\",\"SymantecEndpointProtection\"\r\n\"Symantec VIP\",\"SymantecVIP\"\r\n\"SymantecProxySG\",\"SymantecProxySG\"\r\n\"Syslog\",\"LinuxMachines\"\r\n\"Talon\",\"TalonInsights\"\r\n\"Tanium\",\"TaniumWorkbook\"\r\n\"Teams\",\"MicrosoftTeams\"\r\n\"TenableAD\",\"TenableAdIoA\"\r\n\"TenableAD\",\"TenableAdIoE\"\r\n\"Theom\",\"Theom\"\r\n\"Threat Intelligence\",\"ThreatIntelligence\"\r\n\"ThreatAnalysis&Response\",\"DynamicThreatModeling%26Response\"\r\n\"ThreatAnalysis&Response\",\"ThreatAnalysis%26Response\"\r\n\"ThreatConnect\",\"ThreatConnectOverview\"\r\n\"Tomcat\",\"Tomcat\"\r\n\"Trend Micro Apex One\",\"TrendMicroApexOne\"\r\n\"Trend Micro Cloud App Security\",\"TrendMicroCAS\"\r\n\"Trend Micro Deep Security\",\"TrendMicroDeepSecurityAttackActivity\"\r\n\"Trend Micro Deep Security\",\"TrendMicroDeepSecurityOverview\"\r\n\"Trend Micro Vision One\",\"TrendMicroXDROverview\"\r\n\"Ubiquiti UniFi\",\"Ubiquiti\"\r\n\"VMWareESXi\",\"VMWareESXi\"\r\n\"VMware Carbon Black Cloud\",\"VMwareCarbonBlack\"\r\n\"VMware SD-WAN and SASE\",\"VMwareSASESOCDashboard\"\r\n\"VMware vCenter\",\"vCenter\"\r\n\"Valence Security\",\"ValenceAlertsWorkbook\"\r\n\"VaronisSaaS\",\"VaronisSaaS\"\r\n\"Vectra AI Detect\",\"AIVectraDetectWorkbook\"\r\n\"Vectra AI Stream\",\"AIVectraStreamWorkbook\"\r\n\"Vectra XDR\",\"VectraXDR\"\r\n\"Votiro\",\"Votiro Monitoring Dashboard\"\r\n\"Web Session Essentials\",\"WebSessionEssentials\"\r\n\"Windows Firewall\",\"WindowsFirewall\"\r\n\"Windows Security Events\",\"EventAnalyzer\"\r\n\"Windows Security Events\",\"IdentityAndAccess\"\r\n\"Windows Server DNS\",\"Dns\"\r\n\"WithSecureElementsViaFunction\",\"WithSecureTopComputersByInfections\"\r\n\"Wiz\",\"WizFindings\"\r\n\"ZeroNetworks\",\"ZNSegmentAudit\"\r\n\"ZeroTrust(TIC3.0)\",\"ZeroTrustTIC3\"\r\n\"Zimperium Mobile Threat Defense\",\"ZimperiumWorkbooks\"\r\n\"ZoomReports\",\"ZoomReports\"\r\n\"Zscaler Internet Access\",\"ZscalerFirewall\"\r\n\"Zscaler Internet Access\",\"ZscalerOffice365Apps\"\r\n\"Zscaler Internet Access\",\"ZscalerThreats\"\r\n\"Zscaler Internet Access\",\"ZscalerWebOverview\"\r\n\"Zscaler Private Access (ZPA)\",\"ZscalerZPA\"\r\n\"Zscaler Private Access (ZPA)\",\"ZscalerZPABlack.png\"\r\n\"Zscaler Private Access (ZPA)\",\"ZscalerZPAWhite.png\"\r\n\"archTIS\",\"NucleusCyber_NCProtect_Workbook\"\r\n\"iboss\",\"ibossMalwareAndC2\"\r\n\"iboss\",\"ibossWebUsage\"\r\n\"vArmour Application Controller\",\"vArmour_AppContoller_Workbook\""
          },
          "apiVersion": "2022-08-01"
        },
        {
          "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/_tactec_')]",
          "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists",
          "kind": "",
          "properties": {
              "displayName": "_tactec_",
              "source": "csv",
              "description": "_tactec_",
              "provider": "Microsoft",
              "isDeleted": false,
              "labels": [
              ],
              "defaultDuration": "P1000Y",
              "contentType": "Text/Csv",
              "numberOfLinesToSkip": 0,
              "itemsSearchKey": "id",
              "rawContent": "id,name,tactics\r\n\"T1548\",\"Abuse Elevation Control Mechanism\",\"DefenseEvasion PrivilegeEscalation\"\r\n\"T1134\",\"Access Token Manipulation\",\"DefenseEvasion PrivilegeEscalation\"\r\n\"T1531\",\"Account Access Removal\",\"Impact\"\r\n\"T1087\",\"Account Discovery\",\"Discovery\"\r\n\"T1098\",\"Account Manipulation\",\"Persistence PrivilegeEscalation\"\r\n\"T1650\",\"Acquire Access\",\"ResourceDevelopment\"\r\n\"T1583\",\"Acquire Infrastructure\",\"ResourceDevelopment\"\r\n\"T1595\",\"Active Scanning\",\"Reconnaissance\"\r\n\"T1557\",\"Adversary-in-the-Middle\",\"Collection CredentialAccess\"\r\n\"T1071\",\"Application Layer Protocol\",\"CommandandControl\"\r\n\"T1010\",\"Application Window Discovery\",\"Discovery\"\r\n\"T1560\",\"Archive Collected Data\",\"Collection\"\r\n\"T1123\",\"Audio Capture\",\"Collection\"\r\n\"T1119\",\"Automated Collection\",\"Collection\"\r\n\"T1020\",\"Automated Exfiltration\",\"Exfiltration\"\r\n\"T1197\",\"BITS Jobs\",\"DefenseEvasion Persistence\"\r\n\"T1547\",\"Boot or Logon Autostart Execution\",\"Persistence PrivilegeEscalation\"\r\n\"T1037\",\"Boot or Logon Initialization Scripts\",\"Persistence PrivilegeEscalation\"\r\n\"T1176\",\"Browser Extensions\",\"Persistence\"\r\n\"T1217\",\"Browser Information Discovery\",\"Discovery\"\r\n\"T1185\",\"Browser Session Hijacking\",\"Collection\"\r\n\"T1110\",\"Brute Force\",\"CredentialAccess\"\r\n\"T1612\",\"Build Image on Host\",\"DefenseEvasion\"\r\n\"T1115\",\"Clipboard Data\",\"Collection\"\r\n\"T1651\",\"Cloud Administration Command\",\"Execution\"\r\n\"T1580\",\"Cloud Infrastructure Discovery\",\"Discovery\"\r\n\"T1538\",\"Cloud Service Dashboard\",\"Discovery\"\r\n\"T1526\",\"Cloud Service Discovery\",\"Discovery\"\r\n\"T1619\",\"Cloud Storage Object Discovery\",\"Discovery\"\r\n\"T1059\",\"Command and Scripting Interpreter\",\"Execution\"\r\n\"T1092\",\"Communication Through Removable Media\",\"CommandandControl\"\r\n\"T1586\",\"Compromise Accounts\",\"ResourceDevelopment\"\r\n\"T1554\",\"Compromise Host Software Binary\",\"Persistence\"\r\n\"T1584\",\"Compromise Infrastructure\",\"ResourceDevelopment\"\r\n\"T1609\",\"Container Administration Command\",\"Execution\"\r\n\"T1613\",\"Container and Resource Discovery\",\"Discovery\"\r\n\"T1659\",\"Content Injection\",\"CommandandControl InitialAccess\"\r\n\"T1136\",\"Create Account\",\"Persistence\"\r\n\"T1543\",\"Create or Modify System Process\",\"Persistence PrivilegeEscalation\"\r\n\"T1555\",\"Credentials from Password Stores\",\"CredentialAccess\"\r\n\"T1485\",\"Data Destruction\",\"Impact\"\r\n\"T1132\",\"Data Encoding\",\"CommandandControl\"\r\n\"T1486\",\"Data Encrypted for Impact\",\"Impact\"\r\n\"T1565\",\"Data Manipulation\",\"Impact\"\r\n\"T1001\",\"Data Obfuscation\",\"CommandandControl\"\r\n\"T1074\",\"Data Staged\",\"Collection\"\r\n\"T1030\",\"Data Transfer Size Limits\",\"Exfiltration\"\r\n\"T1530\",\"Data from Cloud Storage\",\"Collection\"\r\n\"T1602\",\"Data from Configuration Repository\",\"Collection\"\r\n\"T1213\",\"Data from Information Repositories\",\"Collection\"\r\n\"T1005\",\"Data from Local System\",\"Collection\"\r\n\"T1039\",\"Data from Network Shared Drive\",\"Collection\"\r\n\"T1025\",\"Data from Removable Media\",\"Collection\"\r\n\"T1622\",\"Debugger Evasion\",\"DefenseEvasion Discovery\"\r\n\"T1491\",\"Defacement\",\"Impact\"\r\n\"T1140\",\"Deobfuscate/Decode Files or Information\",\"DefenseEvasion\"\r\n\"T1610\",\"Deploy Container\",\"DefenseEvasion Execution\"\r\n\"T1587\",\"Develop Capabilities\",\"ResourceDevelopment\"\r\n\"T1652\",\"Device Driver Discovery\",\"Discovery\"\r\n\"T1006\",\"Direct Volume Access\",\"DefenseEvasion\"\r\n\"T1561\",\"Disk Wipe\",\"Impact\"\r\n\"T1482\",\"Domain Trust Discovery\",\"Discovery\"\r\n\"T1484\",\"Domain or Tenant Policy Modification\",\"DefenseEvasion PrivilegeEscalation\"\r\n\"T1189\",\"Drive-by Compromise\",\"InitialAccess\"\r\n\"T1568\",\"Dynamic Resolution\",\"CommandandControl\"\r\n\"T1114\",\"Email Collection\",\"Collection\"\r\n\"T1573\",\"Encrypted Channel\",\"CommandandControl\"\r\n\"T1499\",\"Endpoint Denial of Service\",\"Impact\"\r\n\"T1611\",\"Escape to Host\",\"PrivilegeEscalation\"\r\n\"T1585\",\"Establish Accounts\",\"ResourceDevelopment\"\r\n\"T1546\",\"Event Triggered Execution\",\"Persistence PrivilegeEscalation\"\r\n\"T1480\",\"Execution Guardrails\",\"DefenseEvasion\"\r\n\"T1048\",\"Exfiltration Over Alternative Protocol\",\"Exfiltration\"\r\n\"T1041\",\"Exfiltration Over C2 Channel\",\"Exfiltration\"\r\n\"T1011\",\"Exfiltration Over Other Network Medium\",\"Exfiltration\"\r\n\"T1052\",\"Exfiltration Over Physical Medium\",\"Exfiltration\"\r\n\"T1567\",\"Exfiltration Over Web Service\",\"Exfiltration\"\r\n\"T1190\",\"Exploit Public-Facing Application\",\"InitialAccess\"\r\n\"T1203\",\"Exploitation for Client Execution\",\"Execution\"\r\n\"T1212\",\"Exploitation for CredentialAccess\",\"CredentialAccess\"\r\n\"T1211\",\"Exploitation for DefenseEvasion\",\"DefenseEvasion\"\r\n\"T1068\",\"Exploitation for PrivilegeEscalation\",\"PrivilegeEscalation\"\r\n\"T1210\",\"Exploitation of Remote Services\",\"LateralMovement\"\r\n\"T1133\",\"External Remote Services\",\"InitialAccess Persistence\"\r\n\"T1008\",\"Fallback Channels\",\"CommandandControl\"\r\n\"T1083\",\"File and Directory Discovery\",\"Discovery\"\r\n\"T1222\",\"File and Directory Permissions Modification\",\"DefenseEvasion\"\r\n\"T1657\",\"Financial Theft\",\"Impact\"\r\n\"T1495\",\"Firmware Corruption\",\"Impact\"\r\n\"T1187\",\"Forced Authentication\",\"CredentialAccess\"\r\n\"T1606\",\"Forge Web Credentials\",\"CredentialAccess\"\r\n\"T1592\",\"Gather Victim Host Information\",\"Reconnaissance\"\r\n\"T1589\",\"Gather Victim Identity Information\",\"Reconnaissance\"\r\n\"T1590\",\"Gather Victim Network Information\",\"Reconnaissance\"\r\n\"T1591\",\"Gather Victim Org Information\",\"Reconnaissance\"\r\n\"T1615\",\"Group Policy Discovery\",\"Discovery\"\r\n\"T1200\",\"Hardware Additions\",\"InitialAccess\"\r\n\"T1564\",\"Hide Artifacts\",\"DefenseEvasion\"\r\n\"T1665\",\"Hide Infrastructure\",\"CommandandControl\"\r\n\"T1574\",\"Hijack Execution Flow\",\"DefenseEvasion Persistence PrivilegeEscalation\"\r\n\"T1562\",\"Impair Defenses\",\"DefenseEvasion\"\r\n\"T1656\",\"Impersonation\",\"DefenseEvasion\"\r\n\"T1525\",\"Implant Internal Image\",\"Persistence\"\r\n\"T1070\",\"Indicator Removal\",\"DefenseEvasion\"\r\n\"T1202\",\"Indirect Command Execution\",\"DefenseEvasion\"\r\n\"T1105\",\"Ingress Tool Transfer\",\"CommandandControl\"\r\n\"T1490\",\"Inhibit System Recovery\",\"Impact\"\r\n\"T1056\",\"Input Capture\",\"Collection CredentialAccess\"\r\n\"T1559\",\"Inter-Process Communication\",\"Execution\"\r\n\"T1534\",\"Internal Spearphishing\",\"LateralMovement\"\r\n\"T1570\",\"Lateral Tool Transfer\",\"LateralMovement\"\r\n\"T1654\",\"Log Enumeration\",\"Discovery\"\r\n\"T1036\",\"Masquerading\",\"DefenseEvasion\"\r\n\"T1556\",\"Modify Authentication Process\",\"CredentialAccess DefenseEvasion Persistence\"\r\n\"T1578\",\"Modify Cloud Compute Infrastructure\",\"DefenseEvasion\"\r\n\"T1112\",\"Modify Registry\",\"DefenseEvasion\"\r\n\"T1601\",\"Modify System Image\",\"DefenseEvasion\"\r\n\"T1111\",\"Multi-Factor Authentication Interception\",\"CredentialAccess\"\r\n\"T1621\",\"Multi-Factor Authentication Request Generation\",\"CredentialAccess\"\r\n\"T1104\",\"Multi-Stage Channels\",\"CommandandControl\"\r\n\"T1106\",\"Native API\",\"Execution\"\r\n\"T1599\",\"Network Boundary Bridging\",\"DefenseEvasion\"\r\n\"T1498\",\"Network Denial of Service\",\"Impact\"\r\n\"T1046\",\"Network Service Discovery\",\"Discovery\"\r\n\"T1135\",\"Network Share Discovery\",\"Discovery\"\r\n\"T1040\",\"Network Sniffing\",\"CredentialAccess Discovery\"\r\n\"T1095\",\"Non-Application Layer Protocol\",\"CommandandControl\"\r\n\"T1571\",\"Non-Standard Port\",\"CommandandControl\"\r\n\"T1003\",\"OS Credential Dumping\",\"CredentialAccess\"\r\n\"T1027\",\"Obfuscated Files or Information\",\"DefenseEvasion\"\r\n\"T1588\",\"Obtain Capabilities\",\"ResourceDevelopment\"\r\n\"T1137\",\"Office Application Startup\",\"Persistence\"\r\n\"T1201\",\"Password Policy Discovery\",\"Discovery\"\r\n\"T1120\",\"Peripheral Device Discovery\",\"Discovery\"\r\n\"T1069\",\"Permission Groups Discovery\",\"Discovery\"\r\n\"T1566\",\"Phishing\",\"InitialAccess\"\r\n\"T1598\",\"Phishing for Information\",\"Reconnaissance\"\r\n\"T1647\",\"Plist File Modification\",\"DefenseEvasion\"\r\n\"T1653\",\"Power Settings\",\"Persistence\"\r\n\"T1542\",\"Pre-OS Boot\",\"DefenseEvasion Persistence\"\r\n\"T1057\",\"Process Discovery\",\"Discovery\"\r\n\"T1055\",\"Process Injection\",\"DefenseEvasion PrivilegeEscalation\"\r\n\"T1572\",\"Protocol Tunneling\",\"CommandandControl\"\r\n\"T1090\",\"Proxy\",\"CommandandControl\"\r\n\"T1012\",\"Query Registry\",\"Discovery\"\r\n\"T1620\",\"Reflective Code Loading\",\"DefenseEvasion\"\r\n\"T1219\",\"Remote Access Software\",\"CommandandControl\"\r\n\"T1563\",\"Remote Service Session Hijacking\",\"LateralMovement\"\r\n\"T1021\",\"Remote Services\",\"LateralMovement\"\r\n\"T1018\",\"Remote System Discovery\",\"Discovery\"\r\n\"T1091\",\"Replication Through Removable Media\",\"InitialAccess LateralMovement\"\r\n\"T1496\",\"Resource Hijacking\",\"Impact\"\r\n\"T1207\",\"Rogue Domain Controller\",\"DefenseEvasion\"\r\n\"T1014\",\"Rootkit\",\"DefenseEvasion\"\r\n\"T1053\",\"Scheduled Task/Job\",\"Execution Persistence PrivilegeEscalation\"\r\n\"T1029\",\"Scheduled Transfer\",\"Exfiltration\"\r\n\"T1113\",\"Screen Capture\",\"Collection\"\r\n\"T1597\",\"Search Closed Sources\",\"Reconnaissance\"\r\n\"T1596\",\"Search Open Technical Databases\",\"Reconnaissance\"\r\n\"T1593\",\"Search Open Websites/Domains\",\"Reconnaissance\"\r\n\"T1594\",\"Search Victim-Owned Websites\",\"Reconnaissance\"\r\n\"T1505\",\"Server Software Component\",\"Persistence\"\r\n\"T1648\",\"Serverless Execution\",\"Execution\"\r\n\"T1489\",\"Service Stop\",\"Impact\"\r\n\"T1129\",\"Shared Modules\",\"Execution\"\r\n\"T1072\",\"Software Deployment Tools\",\"Execution LateralMovement\"\r\n\"T1518\",\"Software Discovery\",\"Discovery\"\r\n\"T1608\",\"Stage Capabilities\",\"ResourceDevelopment\"\r\n\"T1528\",\"Steal Application Access Token\",\"CredentialAccess\"\r\n\"T1539\",\"Steal Web Session Cookie\",\"CredentialAccess\"\r\n\"T1649\",\"Steal or Forge Authentication Certificates\",\"CredentialAccess\"\r\n\"T1558\",\"Steal or Forge Kerberos Tickets\",\"CredentialAccess\"\r\n\"T1553\",\"Subvert Trust Controls\",\"DefenseEvasion\"\r\n\"T1195\",\"Supply Chain Compromise\",\"InitialAccess\"\r\n\"T1218\",\"System Binary Proxy Execution\",\"DefenseEvasion\"\r\n\"T1082\",\"System Information Discovery\",\"Discovery\"\r\n\"T1614\",\"System Location Discovery\",\"Discovery\"\r\n\"T1016\",\"System Network Configuration Discovery\",\"Discovery\"\r\n\"T1049\",\"System Network Connections Discovery\",\"Discovery\"\r\n\"T1033\",\"System Owner/User Discovery\",\"Discovery\"\r\n\"T1216\",\"System Script Proxy Execution\",\"DefenseEvasion\"\r\n\"T1007\",\"System Service Discovery\",\"Discovery\"\r\n\"T1569\",\"System Services\",\"Execution\"\r\n\"T1529\",\"System Shutdown/Reboot\",\"Impact\"\r\n\"T1124\",\"System Time Discovery\",\"Discovery\"\r\n\"T1080\",\"Taint Shared Content\",\"LateralMovement\"\r\n\"T1221\",\"Template Injection\",\"DefenseEvasion\"\r\n\"T1205\",\"Traffic Signaling\",\"CommandandControl DefenseEvasion Persistence\"\r\n\"T1537\",\"Transfer Data to Cloud Account\",\"Exfiltration\"\r\n\"T1127\",\"Trusted Developer Utilities Proxy Execution\",\"DefenseEvasion\"\r\n\"T1199\",\"Trusted Relationship\",\"InitialAccess\"\r\n\"T1552\",\"Unsecured Credentials\",\"CredentialAccess\"\r\n\"T1535\",\"Unused/Unsupported Cloud Regions\",\"DefenseEvasion\"\r\n\"T1550\",\"Use Alternate Authentication Material\",\"DefenseEvasion LateralMovement\"\r\n\"T1204\",\"User Execution\",\"Execution\"\r\n\"T1078\",\"Valid Accounts\",\"DefenseEvasion InitialAccess Persistence PrivilegeEscalation\"\r\n\"T1125\",\"Video Capture\",\"Collection\"\r\n\"T1497\",\"Virtualization/Sandbox Evasion\",\"DefenseEvasion Discovery\"\r\n\"T1600\",\"Weaken Encryption\",\"DefenseEvasion\"\r\n\"T1102\",\"Web Service\",\"CommandandControl\"\r\n\"T1047\",\"Windows Management Instrumentation\",\"Execution\"\r\n\"T1220\",\"XSL Script Processing\",\"DefenseEvasion\"\r\n\"T0866\",\"Exploitation of Remote Services\",\"InitialAccess\"\r\n\"T1546.009\",\"Event Triggered Execution\",\"Persistence\"\r\n\"T1078.004\",\"Valid Account\",\"InitialAccess\"\r\n\"T1136.003\",\"Create Account\",\"Peristence\"\r\n\"T1087.004\",\"Account Discovery\",\"Discovery\"\r\n\"T0865\",\"Spearphishing Attachment\",\"InitialAccess\"\r\n\"T0853\",\"Scriptining\",\" Execution\"\r\n\"T1078\",\"Valid Accounts\",\"InitialAccess\"\r\n\"T1218.010\",\"System Binary Proxy Execution: Regsvr32\",\"DefenseEvasion\"\r\n\"T1218.011\",\"System Binary Proxy Execution: Rundll32\",\"DefenseEvasion\"\r\n\"T1110.003\",\"Brute Force: Password Spraying\",\"CredentialAccess\"\r\n\"T1110.004\",\"Brute Force: Credential Stuffing\",\"CredentialAccess\"\r\n\"T1003.001\",\"OS Credential Dumping: LSASS Memory\",\"CredentialAccess\"\r\n\"T1204.002\",\"User Execution: Malicious File\",\"Execution\"\r\n\"T1574.002\",\"Hijack Execution Flow: DLL Side-Loading\",\"Persistence\"\r\n\"T0842\",\"Network Sniffing\",\"Discovery\"\r\n\"T1071.001\",\"Application Layer Protocol: Web Protocols\",\"CommandAndControl\"\r\n\"T1564.004\",\"Hide Artifacts: NTFS File Attributes\",\"DefenseEvasion\"\r\n\"T0886\",\"Remote Services\",\"InitialAccess\"\r\n\"T1098.001\",\"Account Manipulation: Additional Cloud Credentials\",\"Persistence\"\r\n\"T0857\",\"System Firmware\",\"Persistence\"\r\n\"T1098.003\",\"Account Manipulation: Additional Cloud Roles\",\"Persistence\"\r\n\"T1556.006\",\"Modify Authentication Process: Multi-Factor Authentication\",\"Persistence\"\r\n\"T1566.002\",\"Phishing: Spearphishing Link\",\"InitialAccess\"\r\n\"T1021.003\",\"Remote Services: Distributed Component Object Model\",\"LateralMovement\"\r\n\"T0890\",\"Exploitation for Privilege Escalation\",\"PrivilageEscalation\"\r\n\"T1548.002\",\"Abuse Elevation Control Mechanism: Bypass User Account Control\",\"PrivilageEscalation\"\r\n\"T1021.001\",\"Remote Services: Remote Desktop Protocol\",\"LateralMovement\"\r\n\"T1021.002\",\"Remote Services: SMB/Windows Admin Shares\",\"LateralMovement\"\r\n\"T1550.001\",\"Use Alternate Authentication Material: Application Access Token\",\"DefenseEvasion\"\r\n\"T1585.003\",\"Establish Accounts: Cloud Accounts\",\"ResourceDevelopment\"\r\n\"T0881\",\"Service Stop\",\"InhibitResponseFunction\"\r\n\"T0855\",\"Unauthorized Command Message\",\"ImpairProcessControl\"\r\n\"T1078.002\",\"Valid Accounts: Domain Accounts\",\"InitialAccess\"\r\n\"T1562.001\",\"Impair Defenses: Disable or Modify Tools\",\"DefenseEvasion\"\r\n\"T1562.008\",\"Impair Defenses: Disable or Modify Cloud Logs\",\"DefenseEvasion\"\r\n\"T1578.003\",\"Modify Cloud Compute Infrastructure: Delete Cloud Instance\",\"DefenseEvasion\"\r\n\"T1134.002\",\"Access Token Manipulation: Create Process with Token\",\"PrivilageEscalation\"\r\n\"T1036.003\",\"Masquerading: Rename System Utilities\",\"DefenseEvasion\"\r\n\"T0839\",\"Module Firmware\",\"Persistence\"\r\n\"T1134.003\",\"Access Token Manipulation: Make and Impersonate Token\",\"PrivilageEscalation\"\r\n\"T1566.001\",\"Phishing: Spearphishing Attachment\",\"InitialAccess\"\r\n\"T0806\",\"Brute Force I/O\",\"ImpairProcessControl\"\r\n\"T0814\",\"Denial of Service\",\"InhibitResponseFunction\"\r\n\"T1003.006\",\"OS Credential Dumping: DCSync\",\"CredentialAccess\"\r\n\"T1578.002\",\"Modify Cloud Compute Infrastructure: Create Cloud Instance\",\"DefenseEvasion\"\r\n\"T0837\",\"Loss of Protection\",\"Impact\"\r\n\"T1546.010\",\"Event Triggered Execution: AppInit DLLs\",\"Persistence\"\r\n\"T0882\",\"Theft of Operational Information\",\"Impact\"\r\n\"T1069.002\",\"Permission Groups Discovery: Domain Groups\",\"Discovery\"\r\n\"T1087.002\",\"Account Discovery: Domain Account\",\"Discovery\"\r\n\"T0871\",\"Execution through API\",\"Execution\"\r\n\"T1558.001\",\"Steal or Forge Kerberos Tickets: Golden Ticket\",\"CredentialAccess\"\r\n\"T0858\",\"Change Operating Mode\",\"Execution\"\r\n\"T1134.005\",\"Access Token Manipulation: SID-History Injection\",\"PrivilegeEscalation\"\r\n\"T1087.001\",\"Account Discovery: Local Account\",\"Discovery\"\r\n\"T1557.001\",\"Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay\",\"CredentialAccess\"\r\n\"T1547.001\",\"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder\",\"Persistence\"\r\n\"T1547.005\",\"Boot or Logon Autostart Execution: Security Support Provider\",\"Persistence\"\r\n\"T1547.009\",\"Boot or Logon Autostart Execution: Shortcut Modification\",\"Persistence\"\r\n\"T1059.001\",\"Command and Scripting Interpreter: PowerShell\",\"Execution\"\r\n\"T1059.003\",\"Command and Scripting Interpreter: Windows Command Shell\",\"Execution\"\r\n\"T1136.001\",\"Create Account: Local Account\",\"Persistence\"\r\n\"T1136.002\",\"Create Account: Domain Account\",\"Persistence\"\r\n\"T1543.003\",\"Create or Modify System Process: Windows Service\",\"Persistence\"\r\n\"T1555.003\",\"Credentials from Password Stores: Credentials from Web Browsers\",\"CredentialAccess\"\r\n\"T1484.001\",\"Domain or Tenant Policy Modification: Group Policy Modification\",\"PrivilageEscalation\"\r\n\"T1114.001\",\"Email Collection: Local Email Collection\",\"Collection\"\r\n\"T1573.002\",\"Encrypted Channel: Asymmetric Cryptography\",\"CommandAndControl\"\r\n\"T1546.008\",\"Event Triggered Execution: Accessibility Features\",\"Persistence\"\r\n\"T1567.001\",\"Exfiltration Over Web Service: Exfiltration to Code Repository\",\"Exfiltration\"\r\n\"T1567.002\",\"Exfiltration Over Web Service: Exfiltration to Cloud Storage\",\"Exfiltration\"\r\n\"T1574.001\",\"Hijack Execution Flow: DLL Search Order Hijacking\",\"Persistence\"\r\n\"T1574.004\",\"Hijack Execution Flow: Dylib Hijacking\",\"Persistence\"\r\n\"T1574.007\",\"Hijack Execution Flow: Path Interception by PATH Environment Variable\",\"Persistence\"\r\n\"T1574.008\",\"Hijack Execution Flow: Path Interception by Search Order Hijacking\",\"Persistence\"\r\n\"T1574.009\",\"Hijack Execution Flow: Path Interception by Unquoted Path\",\"Persistence\"\r\n\"T1070.006\",\"Indicator Removal: Timestomp\",\"DefenseEvasion\"\r\n\"T1056.001\",\"Input Capture: Keylogging\",\"CredentialAccess\"\r\n\"T1056.004\",\"Input Capture: Credential API Hooking\",\"CredentialAccess\"\r\n\"T1021.004\",\"Remote Services: SSH\",\"LateralMovement\"\r\n\"T1053.005\",\"Scheduled Task/Job: Scheduled Task\",\"Execution\"\r\n\"T1518.001\",\"Software Discovery: Security Software Discovery\",\"Discovery\"\r\n\"T1558.002\",\"Steal or Forge Kerberos Tickets: Silver Ticket\",\"CredentialAccess\"\r\n\"T1558.003\",\"Steal or Forge Kerberos Tickets: Kerberoasting\",\"CredentialAccess\"\r\n\"T1569.002\",\"System Services: Service Execution\",\"Execution\"\r\n\"T1127.001\",\"Trusted Developer Utilities Proxy Execution: MSBuild\",\"DefenseEvasion\"\r\n\"T1552.001\",\"Unsecured Credentials: Credentials In Files\",\"CredentialAccess\"\r\n\"T1552.004\",\"Unsecured Credentials: Private Keys\",\"CredentialAccess\"\r\n\"T1550.002\",\"Use Alternate Authentication Material: Pass the Hash\",\"DefenseEvasion\"\r\n\"T1102.002\",\"Web Service: Bidirectional Communication\",\"CommandAndControl\"\r\n\"T1110\",\"Brute Force\",\"CredentialAccess\"\r\n\"T1546.015\",\"Event Triggered Execution: Component Object Model Hijacking\",\"Persistence\"\r\n\"T1036.005\",\"Masquerading: Match Legitimate Name or Location\",\"DefenseEvasion\"\r\n\"T1556\",\"Modify Authentication Process\",\"Persistence\"\r\n\"T1587.001\",\"Develop Capabilities: Malware\",\"ResourceDevelopment\"\r\n\"T0863\",\"User Execution\",\"Execution\"\r\n\"T1592.004\",\"Gather Victim Host Information: Client Configurations\",\"Reconnaissance\"\r\n\"T1589.002\",\"Gather Victim Identity Information: Email Addresses\",\"Reconnaissance\"\r\n\"T1589.003\",\"Gather Victim Identity Information: Employee Names\",\"Reconnaissance\"\r\n\"T0885\",\"Commonly Used Port\",\"CommandAndControl\""
          },
          "apiVersion": "2022-08-01"
        }
    ],
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#"
  }