Linux coverage
426 of 1,429 Linux detection rules across 5 vendors map to a specific auditd record type or Sysmon-for-Linux event; the remaining 1,003 are grouped by MITRE technique.
Attributed to a catalog event
426 rules that resolve to a specific Linux Auditd record type or Sysmon-for-Linux event, mapped to that catalog event.Linux Auditd (kernel audit records)
ADD_USER 2 rules
BPRM_FCAPS 1 rule
CWD 7 rules
T1548, T1548.003T1098, T1098.004T1548, T1548.003T1053, T1053.003T1574, T1574.006T1546, T1546.004T1059, T1059.004, T1489, T1499, T1529DAEMON_ABORT 1 rule
DAEMON_END 1 rule
DAEMON_START 1 rule
EXECVE 58 rules
T1055, T1055.009, T1685T1123T1027, T1027.001T1686T1070, T1070.003T1070, T1070.003, T1070.004, T1685.006T1115T1115T1552, T1552.001T1560, T1560.001T1048, T1048.003T1059, T1059.004T1059, T1059.004, T1222, T1222.002, T1548, T1548.001T1222, T1222.002T1070, T1070.006T1059T1564, T1564.001T1140T1115T1030T1083T1083T1222, T1222.002T1555, T1555.005T1555, T1555.005T1552, T1552.004T1200T1083T1068T1574, T1574.006PATH 20 rules
T1685T1059, T1106T1548, T1548.003T1098, T1098.004T1548, T1548.003T1053, T1053.003T1574, T1574.006T1546, T1546.004T1003, T1056, T1056.001T1059, T1059.004, T1489, T1499, T1529T1685T1574, T1574.006T1201T1059, T1059.004, T1489, T1499, T1529T1068, T1548, T1548.001T1082T1082T1543, T1543.002T1546, T1546.004T1574, T1574.001PROCTITLE 21 rules
T1070, T1070.003T1070, T1070.003, T1070.004, T1685.006T1059, T1059.004T1059T1136, T1136.001T1480T1222, T1222.002T1485T1485T1222, T1222.002T1548, T1548.003T1003, T1003.008T1053, T1053.006T1569, T1569.002T1548, T1548.001T1485T1548, T1548.003T1547, T1547.006T1543, T1543.002T1018T1030, T1048, T1048.003, T1567, T1567.002SERVICE_STOP 7 rules
SYSCALL 27 rules
T1055, T1055.009, T1685T1123T1685, T1685.006T1136, T1136.001T1068T1053, T1053.002T1068T1030T1548, T1548.003T1053, T1053.003T1547, T1547.006T1547, T1547.006T1014, T1082T1547, T1547.006T1016T1033T1068, T1548, T1548.001T1046T1068T1547, T1547.006T1068, T1548, T1548.001T1584, T1587T1059, T1059.004T1543, T1543.003T1030T1057, T1082T1505, T1505.003TTY 1 rule
USER_AUTH 2 rules
USER_CMD 2 rules
USER_END 2 rules
USER_LOGIN 1 rule
USER_START 3 rules
USER_TTY 1 rule
Sysmon for Linux
File created 47 rules
T1105, T1195, T1195.002T1195, T1554, T1574, T1574.006T1133, T1190T1070, T1070.004, T1485T1053, T1053.003T1053, T1053.003T1070, T1070.004, T1485T1070, T1070.004, T1485T1070, T1070.004, T1485T1070, T1070.004, T1485T1548T1548, T1548.003T1542, T1542.001, T1542.003T1547, T1547.006T1037, T1037.004T1546, T1546.004T1037, T1037.005, T1547T1070, T1070.004, T1485T1070, T1070.004, T1485T1014, T1589, T1589.001T1037, T1059, T1059.004, T1547T1068, T1574, T1574.007T1098, T1098.004T1036, T1059, T1059.004T1053, T1053.006T1548, T1548.003T1036T1037, T1059, T1059.004, T1547T1037, T1547T1053, T1053.003Network connection 6 rules
T1090, T1102, T1572T1090, T1102, T1567, T1568, T1568.002, T1572T1496T1059, T1059.004T1059, T1059.004T1571Process Create 246 rules
T1592, T1592.004T1190T1059, T1190T1685, T1685.004T1068, T1547, T1547.006T1059, T1059.004, T1059.006, T1105, T1195, T1195.002T1059, T1059.004T1083T1059T1222, T1222.002T1115T1090T1082T1552, T1552.001T1007T1027, T1105T1105T1059, T1190T1485T1027T1489, T1685T1686T1082T1105T1059, T1059.012, T1136T1059, T1059.012, T1098T1007, T1033, T1059, T1059.012T1007, T1033, T1059, T1059.012
Not attributed to a catalog event
1,003 rules that target Linux but resolve to no specific catalog event (generic process / syslog fields, or a vendor the converter does not event-fold), grouped by the MITRE technique they detect.Reconnaissance
(no specific technique) 1 rule
T1589 Gather Victim Identity Information 1 rule
T1595 Active Scanning 2 rules
T1595.002 Active Scanning: Vulnerability Scanning 1 rule
Resource Development
T1587.001 Develop Capabilities: Malware 1 rule
T1588.001 Obtain Capabilities: Malware 2 rules
Initial Access
T1078 Valid Accounts 18 rules
T1078T1078T1078, T1550, T1552, T1552.001T1029, T1078, T1119, T1133, T1190T1078T1078T1078T1078T1078, T1110, T1110.001, T1110.003T1021, T1021.004, T1078T1021, T1021.004, T1078, T1133T1021, T1021.004, T1078, T1133T1078T1078T1078T1078T1078, T1098, T1556T1078T1078.003 Valid Accounts: Local Accounts 2 rules
T1133 External Remote Services 7 rules
T1059, T1133, T1548T1059, T1133, T1548T1133, T1190T1029, T1078, T1119, T1133, T1190T1021, T1021.004, T1078, T1133T1021, T1021.004, T1078, T1133T1021, T1021.004, T1133, T1546, T1546.004, T1563T1189 Drive-by Compromise 9 rules
T1189T1189T1102, T1189T1189T1189T1189T1055, T1070, T1189, T1195, T1543, T1685T1068, T1070, T1189, T1195, T1685T1041, T1071, T1189, T1566T1190 Exploit Public-Facing Application 33 rules
T1133, T1190T1029, T1078, T1119, T1133, T1190T1190T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1190, T1505, T1505.003T1068, T1190T1059, T1059.004, T1190T1190T1059, T1059.004, T1059.006, T1059.007, T1190, T1203T1046, T1057, T1082, T1110, T1110.001, T1110.002T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1554T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1068, T1190, T1210T1190, T1210T1105, T1190, T1505, T1505.003T1190T1059, T1190, T1505, T1505.003T1059, T1190, T1505, T1505.003T1190T1190T1190T1059, T1059.004, T1071, T1190, T1210, T1505T1068, T1190, T1210T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1037, T1059, T1190, T1554T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1190T1059, T1059.004, T1071, T1095, T1105, T1190T1195 Supply Chain Compromise 2 rules
T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools 4 rules
T1195.001T1105, T1195, T1195.001, T1195.002T1195, T1195.001, T1566, T1566.002T1059, T1059.007, T1195, T1195.001, T1555T1195.002 Supply Chain Compromise: Compromise Software Supply Chain 6 rules
T1195, T1195.002, T1543, T1546, T1546.016, T1574T1071, T1195, T1195.002, T1543, T1546, T1546.016T1071, T1195, T1195.002, T1543, T1546, T1546.016T1105, T1195, T1195.001, T1195.002T1195, T1195.002, T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1200 Hardware Additions 1 rule
T1566 Phishing 5 rules
T1566.002 Phishing: Spearphishing Link 1 rule
Execution
(no specific technique) 1 rule
T1053 Scheduled Task/Job 2 rules
T1053.002 Scheduled Task/Job: At 3 rules
T1053.003 Scheduled Task/Job: Cron 9 rules
T1053, T1053.003T1053, T1053.003, T1543, T1543.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1053, T1053.003T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1003, T1003.008, T1053, T1053.003, T1105, T1129T1053, T1053.003, T1059, T1059.004, T1071, T1543T1053.006 Scheduled Task/Job: Systemd Timers 2 rules
T1053.007 Scheduled Task/Job: Container Orchestration Job 1 rule
T1059 Command and Scripting Interpreter 23 rules
T1036, T1059T1059, T1133, T1548T1059, T1133, T1548T1059, T1222, T1222.002, T1548, T1548.001T1059T1059, T1190, T1505, T1505.003T1059, T1543, T1556, T1556.003T1059, T1071T1059, T1071T1059, T1095T1059, T1071T1033, T1046, T1059, T1105, T1218T1036, T1036.005, T1036.008, T1059T1059, T1190, T1505, T1505.003T1059, T1190, T1505, T1505.003T1059, T1486T1059, T1222, T1222.002, T1548, T1548.001T1059, T1543, T1543.002, T1574T1059T1059T1059T1059, T1222, T1222.002, T1548, T1548.001T1037, T1059, T1190, T1554T1059.001 Command and Scripting Interpreter: PowerShell 9 rules
T1059, T1059.001, T1059.004, T1651T1027, T1027.010, T1059, T1059.001, T1140T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1059, T1059.001T1059, T1059.001T1059, T1059.001T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1027, T1059, T1059.001, T1059.006, T1059.007, T1140T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1059.002 Command and Scripting Interpreter: AppleScript 1 rule
T1059.003 Command and Scripting Interpreter: Windows Command Shell 3 rules
T1059.004 Command and Scripting Interpreter: Unix Shell 213 rules
T1037, T1059, T1059.004, T1071T1059, T1059.001, T1059.004, T1651T1059, T1059.004, T1071, T1564, T1564.001T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1542, T1543, T1574T1059, T1059.004, T1685T1059, T1059.004, T1685T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1059, T1059.004, T1203T1059, T1059.004, T1105, T1202, T1218T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1027.010, T1059, T1059.004, T1059.006, T1059.011T1059, T1059.004, T1564T1059, T1059.004, T1564T1059, T1059.004, T1609, T1613T1059, T1059.004, T1550, T1550.001, T1609, T1613T1036, T1036.009, T1059, T1059.004, T1564T1059, T1059.004, T1071, T1071.004, T1102, T1496T1059, T1059.004, T1071, T1071.004, T1102T1059, T1059.004, T1071, T1071.004, T1102T1059, T1059.004, T1542, T1543, T1574T1059, T1059.004, T1218, T1574, T1574.006T1059, T1059.004, T1071, T1611T1037, T1059, T1059.004, T1071T1059, T1059.004, T1071, T1071.001T1027, T1059, T1059.004, T1059.006, T1140, T1204T1059, T1059.004T1059, T1059.004, T1609T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1059, T1059.004, T1071T1059, T1059.004, T1203T1059, T1059.004, T1070, T1564, T1564.001, T1685.006T1059, T1059.004, T1070, T1070.004, T1105T1059, T1059.004, T1071, T1071.001, T1105T1059, T1059.004T1048, T1048.003, T1059, T1059.004, T1095T1048, T1059, T1059.004T1059, T1059.004, T1609, T1613T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1071, T1543, T1546, T1574T1059, T1059.004, T1528, T1552, T1613T1059, T1059.004, T1070, T1070.004, T1105, T1204T1059, T1059.004, T1542, T1542.003, T1543, T1574T1059, T1059.004T1059, T1059.004T1059, T1059.004, T1564, T1564.001T1059, T1059.004T1059, T1059.004, T1059.006T1059, T1059.004, T1071T1059, T1059.004T1059, T1059.004, T1489, T1564, T1564.001, T1685T1059, T1059.004T1059, T1059.004, T1211T1059, T1059.004, T1059.006T1027, T1059, T1059.004, T1140, T1204, T1204.002T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1059, T1059.004, T1542T1059, T1059.004, T1496, T1496.001T1059, T1059.004, T1496T1027, T1027.010, T1059, T1059.004, T1140, T1204T1048, T1048.003, T1059, T1059.004, T1095T1059, T1059.004, T1095T1059, T1059.004, T1071, T1218T1059, T1059.004, T1203T1059, T1059.004, T1071, T1071.001T1059, T1059.004, T1071, T1106, T1620T1059, T1059.004, T1071, T1095T1059, T1059.004, T1547, T1547.013T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004T1059, T1059.004, T1071, T1573, T1573.002T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1059.006, T1071, T1105T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1059, T1059.004, T1190T1059, T1059.004, T1496T1059, T1059.004, T1496T1021, T1059, T1059.004, T1613T1021, T1059, T1059.004, T1613T1021, T1021.004, T1059, T1059.004, T1543, T1556T1059, T1059.004, T1071T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1059, T1059.004, T1059.006, T1059.007, T1190, T1203T1059, T1059.004, T1609, T1613T1059, T1059.004, T1609, T1613T1059, T1059.004, T1071, T1110, T1496T1016, T1059, T1059.004, T1071, T1082, T1087T1059, T1059.004, T1496T1059, T1059.004, T1570T1059, T1059.004, T1059.006, T1068T1059, T1059.004, T1564T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218, T1574T1059, T1059.004, T1218T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1203T1059, T1059.004, T1071, T1190, T1210, T1554T1037, T1059, T1059.004, T1071, T1505, T1505.003T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071T1059, T1059.004, T1071, T1095T1059, T1059.004, T1059.006, T1071, T1095T1059, T1059.004, T1059.006, T1059.011, T1071, T1095T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1059, T1059.004, T1068, T1203T1059, T1059.004T1059, T1059.004, T1203T1059, T1059.004, T1609, T1610, T1611T1036, T1036.009, T1059, T1059.004, T1564T1036, T1059, T1059.004, T1620T1059, T1059.004, T1564T1037, T1059, T1059.004, T1059.006, T1059.011T1059, T1059.004, T1620T1059, T1059.004, T1218T1059, T1059.004T1059, T1059.004, T1059.006, T1071, T1071.001T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1059, T1059.004, T1071T1059, T1059.004T1059, T1059.004, T1071T1059, T1059.004, T1071T1055, T1055.008, T1059, T1059.004, T1068, T1071T1059, T1059.004, T1071T1059, T1059.004, T1528, T1550, T1550.001, T1552T1059, T1059.004, T1218, T1574T1036, T1059, T1059.004T1036, T1059, T1059.004T1059, T1059.004, T1218, T1219T1059, T1059.004, T1071, T1203T1059, T1059.004, T1071T1059, T1059.003, T1059.004T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004T1059, T1059.004, T1071T1059, T1059.004T1059, T1059.004, T1059.006, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1546.016, T1574T1027, T1059, T1059.004, T1140, T1204, T1204.002T1059, T1059.004, T1071, T1218T1027, T1027.015, T1059, T1059.004, T1140T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1059, T1059.004, T1071, T1564, T1564.001T1059, T1059.004, T1071T1059, T1059.004, T1071, T1505, T1505.003T1059, T1059.004, T1071T1059, T1059.004T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1059, T1059.004, T1496, T1543, T1543.002T1059, T1059.004T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1564, T1574, T1574.007T1059, T1059.004, T1071, T1564, T1564.001, T1620T1059, T1059.004T1059, T1059.004, T1071T1059, T1059.004, T1071, T1203T1016, T1033, T1049, T1057, T1059, T1059.004T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1218T1036, T1036.005, T1059, T1059.004, T1071, T1105T1059, T1059.004, T1543, T1543.002T1059, T1059.004, T1572T1037, T1059, T1059.004, T1071T1059, T1059.004, T1106, T1620T1027, T1059, T1059.004, T1059.006, T1140, T1204T1059, T1059.004, T1071, T1190, T1505, T1505.003T1053, T1053.003, T1059, T1059.004, T1071, T1543T1053, T1059, T1059.004, T1071, T1543, T1543.002T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1543, T1559T1059, T1059.004T1014, T1036, T1036.009, T1059, T1059.004T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1078, T1078.003, T1564, T1564.002T1059, T1059.004, T1574, T1574.006T1059, T1059.004, T1543, T1548, T1548.001T1059, T1059.004, T1071, T1095, T1105, T1190T1059, T1059.004, T1564T1059, T1059.004, T1071T1059.006 Command and Scripting Interpreter: Python 33 rules
T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1027, T1027.010, T1059, T1059.004, T1059.006, T1059.011T1027, T1059, T1059.004, T1059.006, T1140, T1204T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1059, T1059.004, T1059.006T1059, T1059.004, T1059.006T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1027, T1059, T1059.001, T1059.006, T1059.007, T1140T1059, T1059.004, T1059.006, T1071, T1105T1059, T1059.006, T1555T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1059, T1059.004, T1059.006, T1059.007, T1190, T1203T1059, T1059.006, T1068, T1548, T1548.001T1059, T1059.004, T1059.006, T1068T1059, T1059.004, T1059.006, T1071, T1095T1059, T1059.004, T1059.006, T1059.011, T1071, T1095T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1037, T1059, T1059.004, T1059.006, T1059.011T1059, T1059.004, T1059.006, T1071, T1071.001T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004, T1059.006, T1543, T1546, T1546.016T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1059, T1059.006T1027, T1059, T1059.006T1059, T1059.006, T1546, T1574T1059, T1059.006, T1068T1027, T1059, T1059.004, T1059.006, T1140, T1204T1059, T1059.006, T1570T1059.007 Command and Scripting Interpreter: JavaScript 9 rules
T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1059, T1059.007T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1027, T1059, T1059.001, T1059.006, T1059.007, T1140T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1059, T1059.004, T1059.006, T1059.007, T1190, T1203T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1059, T1059.007, T1203, T1505, T1505.003T1059, T1059.007, T1195, T1195.001, T1555T1059.011 Command and Scripting Interpreter: Lua 10 rules
T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1027, T1027.010, T1059, T1059.004, T1059.006, T1059.011T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1059, T1059.004, T1059.006, T1059.011, T1071, T1095T1037, T1059, T1059.004, T1059.006, T1059.011T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1059, T1059.011T1072 Software Deployment Tools 1 rule
T1106 Native API 20 rules
T1036, T1036.005, T1106T1106, T1620T1055, T1055.009, T1106, T1620T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1014, T1055, T1055.009, T1106, T1547, T1547.006T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1106, T1620T1055, T1055.009, T1106, T1620T1059, T1059.004, T1071, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1014, T1055, T1055.009, T1106, T1547, T1547.006T1055, T1055.009, T1106, T1620T1106, T1574, T1620T1059, T1059.004, T1106, T1620T1129 Shared Modules 2 rules
T1203 Exploitation for Client Execution 15 rules
T1203T1059, T1059.004, T1203T1059, T1059.004, T1203T1059, T1059.004, T1203T1059, T1059.004, T1059.006, T1059.007, T1190, T1203T1059, T1059.004, T1071, T1203T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1059, T1059.007, T1203, T1505, T1505.003T1059, T1059.004, T1068, T1203T1059, T1059.004, T1203T1203T1003, T1203, T1212T1059, T1059.004, T1071, T1203T1003, T1003.008, T1053, T1053.003, T1105, T1129T1059, T1059.004, T1071, T1203T1204 User Execution 2 rules
T1204.001 User Execution: Malicious Link 3 rules
T1204.002 User Execution: Malicious File 19 rules
T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1027.010, T1059, T1059.004, T1059.006, T1059.011T1071, T1071.004, T1102, T1204, T1204.002T1071, T1071.004, T1204, T1204.002T1027, T1059, T1059.004, T1059.006, T1140, T1204T1059, T1059.004, T1070, T1070.004, T1105, T1204T1027, T1059, T1059.004, T1140, T1204, T1204.002T1204, T1204.002T1036, T1036.006, T1204, T1204.002T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1204, T1204.001, T1204.002, T1204.004T1027, T1059, T1059.004, T1059.006, T1140, T1204T1204, T1204.001, T1204.002, T1204.004T1204.004 User Execution: Malicious Copy and Paste 2 rules
T1559 Inter-Process Communication 2 rules
T1569.002 System Services: Service Execution 2 rules
T1574 Hijack Execution Flow 25 rules
T1059, T1059.004, T1542, T1543, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1542, T1543, T1574T1071, T1195, T1195.002, T1543, T1546, T1546.016T1071, T1195, T1195.002, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1071, T1543, T1546, T1574T1542, T1543, T1574T1059, T1059.004, T1542, T1542.003, T1543, T1574T1059, T1059.004, T1543, T1546, T1574T1106, T1574, T1620T1059, T1059.004, T1218, T1574T1068, T1574T1056, T1548, T1548.003, T1574T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1218, T1574T1059, T1059.004, T1059.006, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1546.016, T1574T1059, T1543, T1543.002, T1574T1059, T1059.006, T1546, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking 7 rules
T1574, T1574.006T1059, T1059.004, T1218, T1574, T1574.006T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1068, T1574, T1574.006T1003, T1003.008, T1037, T1037.004, T1098, T1543T1037, T1053, T1053.003, T1059, T1059.004, T1098T1059, T1059.004, T1574, T1574.006T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable 2 rules
T1609 Container Administration Command 14 rules
T1609, T1613T1609, T1613T1609, T1611T1059, T1059.004, T1609, T1613T1059, T1059.004, T1550, T1550.001, T1609, T1613T1609, T1613T1059, T1059.004, T1609T1059, T1059.004, T1609, T1613T1609, T1610T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1059, T1059.004, T1609, T1613T1059, T1059.004, T1609, T1613T1059, T1059.004, T1609, T1610, T1611T1609, T1611T1610 Deploy Container 6 rules
T1609, T1610T1053, T1053.007, T1543, T1543.005, T1610T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1610, T1611T1610, T1611T1059, T1059.004, T1609, T1610, T1611T1651 Cloud Administration Command 1 rule
Persistence
(no specific technique) 3 rules
T1037 Boot or Logon Initialization Scripts 15 rules
T1037, T1059, T1059.004, T1071T1037, T1543T1037, T1059, T1059.004, T1071T1037T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1037, T1059, T1059.004, T1071, T1505, T1505.003T1037, T1059, T1059.004, T1059.006, T1059.011T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1037T1037T1037, T1546, T1546.017T1037, T1059, T1059.004, T1071T1037, T1059, T1190, T1554T1021, T1021.004, T1037, T1554, T1556, T1563T1037.004 Boot or Logon Initialization Scripts: RC Scripts 9 rules
T1037, T1037.004, T1053, T1053.003, T1222, T1222.002T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1037, T1037.004T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1037, T1037.004T1037, T1037.004, T1053, T1053.003, T1071T1037, T1037.004T1037, T1037.004T1053 Scheduled Task/Job 2 rules
T1053.002 Scheduled Task/Job: At 4 rules
T1053, T1053.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1053.003 Scheduled Task/Job: Cron 13 rules
T1053, T1053.003T1037, T1037.004, T1053, T1053.003, T1222, T1222.002T1053, T1053.003, T1543, T1543.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1053, T1053.003T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1053, T1053.003, T1543, T1543.002T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1003, T1003.008, T1053, T1053.003, T1105, T1129T1037, T1037.004, T1053, T1053.003, T1071T1053, T1053.003, T1059, T1059.004, T1071, T1543T1053.006 Scheduled Task/Job: Systemd Timers 2 rules
T1053.007 Scheduled Task/Job: Container Orchestration Job 2 rules
T1078 Valid Accounts 4 rules
T1078.003 Valid Accounts: Local Accounts 2 rules
T1098 Account Manipulation 9 rules
T1098T1098T1098T1098, T1136, T1136.001T1098, T1136, T1136.001T1003, T1003.008, T1037, T1037.004, T1098, T1543T1098, T1136, T1136.001T1098, T1136, T1136.001T1078, T1098, T1556T1098.004 Account Manipulation: SSH Authorized Keys 7 rules
T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1037, T1053, T1053.003, T1059, T1059.004, T1098T1078, T1078.003, T1098, T1098.004, T1564, T1564.002T1098.007 Account Manipulation: Additional Local or Domain Groups 3 rules
T1133 External Remote Services 3 rules
T1136 Create Account 1 rule
T1136.001 Create Account: Local Account 10 rules
T1098, T1098.007, T1136, T1136.001T1136, T1136.001T1098, T1098.007, T1136, T1136.001T1098, T1136, T1136.001T1098, T1136, T1136.001T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1098, T1136, T1136.001T1098, T1136, T1136.001T1068, T1136, T1136.001T1098, T1098.007, T1136, T1136.001T1205.001 Traffic Signaling: Port Knocking 1 rule
T1505.001 Server Software Component: SQL Stored Procedures 1 rule
T1505.003 Server Software Component: Web Shell 20 rules
T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1190, T1505, T1505.003T1037, T1059, T1059.004, T1071, T1505, T1505.003T1059, T1059.001, T1059.003, T1059.004, T1059.006, T1059.007T1059, T1059.007, T1203, T1505, T1505.003T1105, T1190, T1505, T1505.003T1505, T1505.003T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1190, T1505, T1505.003T1059, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1095, T1105, T1190T1542 Pre-OS Boot 6 rules
T1059, T1059.004, T1542, T1543, T1574T1059, T1059.004, T1542, T1543, T1574T1542, T1543, T1574T1542, T1543, T1574T1542, T1543, T1574T1059, T1059.004, T1542T1542.003 Pre-OS Boot: Bootkit 1 rule
T1543 Create or Modify System Process 38 rules
T1543, T1546, T1546.016, T1574T1543, T1556, T1556.003T1059, T1059.004, T1542, T1543, T1574T1037, T1543T1543, T1546T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1542, T1543, T1574T1543, T1546, T1546.016, T1574T1543, T1574T1071, T1195, T1195.002, T1543, T1546, T1546.016T1071, T1195, T1195.002, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1071, T1543, T1546, T1574T1542, T1543, T1574T1542, T1543, T1574T1542, T1543, T1574T1059, T1059.004, T1542, T1542.003, T1543, T1574T1055, T1070, T1189, T1195, T1543, T1685T1059, T1059.004, T1543, T1546, T1574T1543, T1556, T1556.003T1105, T1543, T1556, T1556.003T1082, T1518, T1543, T1556T1543, T1556, T1556.003T1543, T1556T1059, T1543, T1556, T1556.003T1021, T1021.004, T1059, T1059.004, T1543, T1556T1021, T1021.004, T1543, T1554, T1556, T1563T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1059.006, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1546.016, T1574T1053, T1053.003, T1059, T1059.004, T1071, T1543T1059, T1059.004, T1543, T1559T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1543, T1548, T1548.001T1543, T1546, T1546.016, T1574T1543.002 Create or Modify System Process: Systemd Service 15 rules
T1053, T1053.003, T1543, T1543.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1053, T1053.003, T1543, T1543.002T1053, T1071, T1543, T1543.002, T1569, T1569.002T1059, T1059.004, T1496, T1543, T1543.002T1059, T1543, T1543.002, T1574T1543, T1543.002, T1546T1543, T1543.002T1543, T1543.002T1543, T1543.002, T1569, T1569.002T1059, T1059.004, T1543, T1543.002T1053, T1059, T1059.004, T1071, T1543, T1543.002T1543, T1543.002T1543.003 Create or Modify System Process: Windows Service 1 rule
T1543.004 Create or Modify System Process: Launch Daemon 1 rule
T1543.005 Create or Modify System Process: Container Service 2 rules
T1546 Event Triggered Execution 11 rules
T1543, T1546T1546, T1611T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1071, T1543, T1546, T1574T1546T1059, T1059.004, T1543, T1546, T1574T1546, T1611T1059, T1059.006, T1546, T1574T1543, T1543.002, T1546T1546.004 Event Triggered Execution: Unix Shell Configuration Modification 11 rules
T1546, T1546.004T1546, T1546.004T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1021, T1021.004, T1095, T1546, T1546.004, T1563T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1546, T1546.004T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1021, T1021.004, T1133, T1546, T1546.004, T1563T1546.016 Event Triggered Execution: Installer Packages 11 rules
T1543, T1546, T1546.016, T1574T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1543, T1546, T1546.016, T1574T1071, T1195, T1195.002, T1543, T1546, T1546.016T1071, T1195, T1195.002, T1543, T1546, T1546.016T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1059.006, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1543, T1546, T1546.016, T1574T1546.017 Event Triggered Execution: Udev Rules 3 rules
T1546.018 Event Triggered Execution: Python Startup Hooks 2 rules
T1547 Boot or Logon Autostart Execution 1 rule
T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions 19 rules
T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006, T1601, T1601.001, T1611T1014, T1547, T1547.006T1014, T1547, T1547.006T1547, T1547.006, T1685T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1070, T1547, T1547.006, T1685, T1685.006T1014, T1055, T1055.009, T1106, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1055, T1055.009, T1106, T1547, T1547.006T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1082, T1083, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries 5 rules
T1037, T1037.004, T1053, T1053.003, T1222, T1222.002T1547, T1547.013T1059, T1059.004, T1547, T1547.013T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1554 Compromise Host Software Binary 8 rules
T1074, T1074.001, T1554, T1556T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1554T1037, T1059, T1059.004, T1071, T1505, T1505.003T1056, T1554, T1556T1021, T1021.004, T1543, T1554, T1556, T1563T1037, T1059, T1190, T1554T1021, T1021.004, T1037, T1554, T1556, T1563T1556 Modify Authentication Process 10 rules
T1556T1082, T1518, T1543, T1556T1543, T1556T1021, T1021.004, T1059, T1059.004, T1543, T1556T1074, T1074.001, T1554, T1556T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1056, T1554, T1556T1021, T1021.004, T1543, T1554, T1556, T1563T1021, T1021.004, T1037, T1554, T1556, T1563T1078, T1098, T1556T1556.003 Modify Authentication Process: Pluggable Authentication Modules 5 rules
T1543, T1556, T1556.003T1543, T1556, T1556.003T1105, T1543, T1556, T1556.003T1543, T1556, T1556.003T1059, T1543, T1556, T1556.003Privilege Escalation
(no specific technique) 2 rules
T1037 Boot or Logon Initialization Scripts 6 rules
T1037T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1037, T1059, T1059.004, T1059.006, T1059.011T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1037, T1546, T1546.017T1037.004 Boot or Logon Initialization Scripts: RC Scripts 7 rules
T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1037, T1037.004T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1037, T1037.004T1037, T1037.004T1037, T1037.004T1053 Scheduled Task/Job 2 rules
T1053.002 Scheduled Task/Job: At 4 rules
T1053, T1053.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1053.003 Scheduled Task/Job: Cron 10 rules
T1053, T1053.003T1053, T1053.003, T1543, T1543.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1053, T1053.003T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1053, T1053.003, T1543, T1543.002T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1053, T1053.003, T1059, T1059.004, T1071, T1543T1053.006 Scheduled Task/Job: Systemd Timers 1 rule
T1053.007 Scheduled Task/Job: Container Orchestration Job 2 rules
T1055 Process Injection 1 rule
T1055.008 Process Injection: Ptrace System Calls 3 rules
T1068 Exploitation for Privilege Escalation 65 rules
T1068, T1127, T1588, T1588.001T1068T1068T1068T1068T1068T1068T1068T1068T1068T1068T1068T1068, T1070, T1189, T1195, T1685T1068, T1190T1068, T1611T1068, T1548, T1548.001T1068, T1574, T1574.006T1068T1068, T1548, T1548.003T1068T1068T1068T1068T1068, T1548, T1548.001T1068, T1548, T1548.001, T1548.003T1068T1068T1068, T1548, T1548.001, T1548.003T1068T1068, T1543T1068, T1548, T1548.001T1068, T1548, T1548.001T1068T1003, T1003.008, T1068, T1552, T1552.004T1068T1068, T1574, T1574.006, T1574.007T1059, T1059.006, T1068, T1548, T1548.001T1059, T1059.004, T1059.006, T1068T1068, T1548, T1548.001T1068, T1548, T1548.001T1068, T1218, T1548, T1548.001T1068, T1218, T1548, T1548.001T1068, T1548T1068T1003, T1003.008, T1068T1003, T1003.008, T1068T1059, T1059.004, T1068, T1203T1068, T1574T1068, T1548, T1548.003T1068T1068, T1190, T1210T1003, T1003.008, T1068, T1222, T1222.002T1068, T1222, T1222.002, T1548T1068, T1548, T1548.001T1055, T1055.008, T1068, T1548T1068, T1574, T1574.007T1068, T1548, T1548.001T1055, T1055.008, T1059, T1059.004, T1068, T1071T1068, T1548, T1548.001T1068, T1548, T1548.003T1068, T1136, T1136.001T1068, T1548, T1548.001, T1548.003T1059, T1059.006, T1068T1068, T1190, T1210T1068T1078 Valid Accounts 3 rules
T1078.003 Valid Accounts: Local Accounts 2 rules
T1098 Account Manipulation 7 rules
T1098T1098T1098T1098, T1136, T1136.001T1003, T1003.008, T1037, T1037.004, T1098, T1543T1098, T1136, T1136.001T1098, T1136, T1136.001T1098.004 Account Manipulation: SSH Authorized Keys 4 rules
T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1037, T1053, T1053.003, T1059, T1059.004, T1098T1098.007 Account Manipulation: Additional Local or Domain Groups 2 rules
T1543 Create or Modify System Process 12 rules
T1543, T1546, T1546.016, T1574T1543, T1546T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1055, T1070, T1189, T1195, T1543, T1685T1543, T1611T1543, T1611T1068, T1543T1053, T1053.003, T1059, T1059.004, T1071, T1543T1059, T1059.004, T1543, T1559T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1543, T1548, T1548.001T1543.002 Create or Modify System Process: Systemd Service 12 rules
T1053, T1053.003, T1543, T1543.002T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1053, T1053.003, T1543, T1543.002T1053, T1071, T1543, T1543.002, T1569, T1569.002T1543, T1543.002, T1546T1543, T1543.002T1543, T1543.002T1543, T1543.002, T1569, T1569.002T1059, T1059.004, T1543, T1543.002T1053, T1059, T1059.004, T1071, T1543, T1543.002T1543.004 Create or Modify System Process: Launch Daemon 1 rule
T1543.005 Create or Modify System Process: Container Service 2 rules
T1546 Event Triggered Execution 4 rules
T1546.004 Event Triggered Execution: Unix Shell Configuration Modification 7 rules
T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1546, T1546.004T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1546.016 Event Triggered Execution: Installer Packages 4 rules
T1543, T1546, T1546.016, T1574T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1546.017 Event Triggered Execution: Udev Rules 2 rules
T1546.018 Event Triggered Execution: Python Startup Hooks 2 rules
T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions 9 rules
T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006, T1601, T1601.001, T1611T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1014, T1547, T1547.006T1014, T1547, T1547.006T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries 2 rules
T1548 Abuse Elevation Control Mechanism 9 rules
T1059, T1133, T1548T1059, T1133, T1548T1548T1068, T1548T1068, T1222, T1222.002, T1548T1055, T1055.008, T1068, T1548T1548T1003, T1003.008, T1548, T1574T1548T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid 32 rules
T1059, T1222, T1222.002, T1548, T1548.001T1068, T1548, T1548.001T1068, T1548, T1548.001T1068, T1548, T1548.001, T1548.003T1548, T1548.001T1548, T1548.001T1068, T1548, T1548.001, T1548.003T1548, T1548.001T1068, T1548, T1548.001T1068, T1548, T1548.001T1059, T1059.006, T1068, T1548, T1548.001T1068, T1548, T1548.001T1068, T1548, T1548.001T1548, T1548.001, T1548.003T1068, T1218, T1548, T1548.001T1068, T1218, T1548, T1548.001T1548, T1548.001T1083, T1548, T1548.001T1068, T1548, T1548.001T1068, T1548, T1548.001T1548, T1548.001T1548, T1548.001T1548, T1548.001T1068, T1548, T1548.001T1083, T1548, T1548.001T1059, T1222, T1222.002, T1548, T1548.001T1548, T1548.001, T1548.003T1548, T1548.001, T1548.003T1068, T1548, T1548.001, T1548.003T1059, T1222, T1222.002, T1548, T1548.001T1014, T1548, T1548.001, T1574, T1574.013T1059, T1059.004, T1543, T1548, T1548.001T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control 1 rule
T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching 20 rules
T1037, T1053, T1053.002, T1053.003, T1053.006, T1543T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1068, T1548, T1548.003T1548, T1548.003T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1068, T1548, T1548.001, T1548.003T1068, T1548, T1548.001, T1548.003T1548, T1548.003T1548, T1548.001, T1548.003T1056, T1548, T1548.003, T1574T1068, T1548, T1548.003T1055, T1055.008, T1548, T1548.003T1003, T1003.008, T1037, T1037.004, T1098, T1543T1033, T1069, T1069.001, T1548, T1548.003T1068, T1548, T1548.003T1548, T1548.003T1037, T1053, T1053.003, T1059, T1059.004, T1098T1548, T1548.001, T1548.003T1548, T1548.001, T1548.003T1068, T1548, T1548.001, T1548.003T1611 Escape to Host 27 rules
T1611T1611T1609, T1611T1006, T1611T1546, T1611T1059, T1059.004, T1071, T1611T1006, T1611T1014, T1547, T1547.006, T1601, T1601.001, T1611T1611T1611T1543, T1611T1543, T1611T1611T1611T1037, T1037.004, T1053, T1053.002, T1053.003, T1059T1068, T1611T1611T1611T1611T1611T1611T1610, T1611T1610, T1611T1546, T1611T1059, T1059.004, T1609, T1610, T1611T1609, T1611T1550, T1611, T1613Stealth
(no specific technique) 4 rules
T1006 Direct Volume Access 3 rules
T1014 Rootkit 27 rules
T1014, T1547, T1547.006T1014, T1685T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1082, T1083T1014, T1547, T1547.006, T1601, T1601.001, T1611T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1005, T1014, T1082T1014, T1082, T1140T1014, T1547, T1547.006T1014, T1070, T1547, T1547.006, T1685, T1685.006T1014, T1055, T1055.009, T1106, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1036, T1036.004, T1041T1014, T1055, T1055.009, T1106, T1547, T1547.006T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1014, T1036, T1036.005, T1547T1014, T1036, T1036.004, T1574, T1574.013T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1547, T1547.006T1014, T1548, T1548.001, T1574, T1574.013T1014, T1036, T1036.009, T1059, T1059.004T1014T1027 Obfuscated Files or Information 15 rules
T1027, T1132, T1132.001, T1140T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1059.006, T1140, T1204T1027, T1030, T1560, T1560.001, T1560.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1027, T1059, T1059.001, T1059.006, T1059.007, T1140T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1037, T1053, T1053.003, T1059, T1059.004T1027, T1059, T1059.006T1027, T1059, T1059.004, T1059.006, T1140, T1204T1027.004 Obfuscated Files or Information: Compile After Delivery 2 rules
T1027.010 Obfuscated Files or Information: Command Obfuscation 4 rules
T1027, T1027.010, T1059, T1059.001, T1140T1027, T1027.010, T1059, T1059.004, T1059.006, T1059.011T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027.013 Obfuscated Files or Information: Encrypted/Encoded File 1 rule
T1027.015 Obfuscated Files or Information: Compression 1 rule
T1036 Masquerading 4 rules
T1036.003 Masquerading: Rename Legitimate Utilities 3 rules
T1036.004 Masquerading: Masquerade Task or Service 3 rules
T1036.005 Masquerading: Match Legitimate Resource Name or Location 9 rules
T1036, T1036.005, T1106T1036, T1036.005, T1564, T1564.001T1036, T1036.004, T1036.005, T1564T1036, T1036.005T1036, T1036.005T1036, T1036.005, T1036.008, T1059T1036, T1036.005T1014, T1036, T1036.005, T1547T1036, T1036.005, T1059, T1059.004, T1071, T1105T1036.006 Masquerading: Space after Filename 1 rule
T1036.008 Masquerading: Masquerade File Type 1 rule
T1036.009 Masquerading: Break Process Trees 3 rules
T1055 Process Injection 2 rules
T1055.008 Process Injection: Ptrace System Calls 3 rules
T1055.009 Process Injection: Proc Memory 13 rules
T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1014, T1055, T1055.009, T1106, T1547, T1547.006T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1014, T1055, T1055.009, T1106, T1547, T1547.006T1055, T1055.009, T1106, T1620T1070 Indicator Removal 18 rules
T1070, T1685, T1685.006T1070, T1685, T1685.006T1070, T1685, T1685.006T1070, T1685, T1685.006T1070T1059, T1059.004, T1070, T1564, T1564.001, T1685.006T1070, T1531T1014, T1070, T1547, T1547.006, T1685, T1685.006T1070, T1685T1070, T1685T1070, T1685T1070, T1685T1055, T1070, T1189, T1195, T1543, T1685T1070, T1685T1070, T1685T1068, T1070, T1189, T1195, T1685T1070, T1685T1070, T1685T1070.003 Indicator Removal: Clear Command History 5 rules
T1070, T1070.003T1070, T1070.003T1070, T1070.003T1070, T1070.003T1070, T1070.003T1070.004 Indicator Removal: File Deletion 13 rules
T1070, T1070.004T1059, T1059.004, T1070, T1070.004, T1105T1070, T1070.004, T1485T1059, T1059.004, T1070, T1070.004, T1105, T1204T1070, T1070.004, T1685.006T1070, T1070.004T1070, T1070.004T1070, T1070.004, T1531T1070, T1070.004, T1531T1070, T1070.004, T1485, T1553T1070, T1070.004, T1685.006T1070, T1070.004T1070, T1070.004T1070.006 Indicator Removal: Timestomp 2 rules
T1078 Valid Accounts 2 rules
T1078.003 Valid Accounts: Local Accounts 4 rules
T1078, T1078.003, T1552, T1552.001T1005, T1006, T1078, T1078.003T1059, T1059.004, T1078, T1078.003, T1564, T1564.002T1078, T1078.003, T1098, T1098.004, T1564, T1564.002T1127 Trusted Developer Utilities Proxy Execution 1 rule
T1140 Deobfuscate/Decode Files or Information 23 rules
T1027, T1132, T1132.001, T1140T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1027.010, T1059, T1059.001, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1027.010, T1059, T1059.004, T1059.006, T1059.011T1027, T1059, T1059.004, T1059.006, T1140, T1204T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1014, T1082, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1059, T1059.001, T1059.004, T1059.006, T1059.007T1027, T1059, T1059.001, T1059.006, T1059.007, T1140T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027, T1027.010, T1059, T1059.004, T1140, T1204T1027, T1059, T1059.004, T1059.006, T1059.011, T1140T1027, T1059, T1059.004, T1140, T1204, T1204.002T1027, T1027.015, T1059, T1059.004, T1140T1027, T1037, T1053, T1053.003, T1059, T1059.004T1037, T1053, T1053.003, T1059, T1059.004, T1098T1003, T1003.008, T1053, T1053.003, T1105, T1129T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1027, T1059, T1059.004, T1059.006, T1140, T1204T1202 Indirect Command Execution 2 rules
T1211 Exploitation for Stealth 3 rules
T1218 System Binary Proxy Execution 20 rules
T1059, T1059.004, T1105, T1202, T1218T1059, T1059.004, T1218, T1574, T1574.006T1059, T1059.004, T1071, T1218T1068, T1218, T1548, T1548.001T1068, T1218, T1548, T1548.001T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218, T1574T1059, T1059.004, T1218T1033, T1046, T1059, T1105, T1218T1059, T1059.004, T1218T1059, T1059.004, T1218, T1574T1059, T1059.004, T1218, T1219T1059, T1059.004, T1071, T1218T1059, T1059.004, T1218T1218.011 System Binary Proxy Execution: Rundll32 1 rule
T1497.001 Virtualization/Sandbox Evasion: System Checks 2 rules
T1542 Pre-OS Boot 5 rules
T1542.003 Pre-OS Boot: Bootkit 1 rule
T1564 Hide Artifacts 19 rules
T1059, T1059.004, T1564T1059, T1059.004, T1564T1036, T1036.009, T1059, T1059.004, T1564T1071, T1211, T1564T1036, T1036.004, T1036.005, T1564T1564T1564T1564T1059, T1059.004, T1564T1036, T1036.009, T1059, T1059.004, T1564T1059, T1059.004, T1564T1564T1222, T1222.002, T1564T1059, T1059.004, T1564, T1574, T1574.007T1564T1036, T1036.003, T1564T1036, T1036.003, T1564T1202, T1564, T1574T1059, T1059.004, T1564T1564.001 Hide Artifacts: Hidden Files and Directories 14 rules
T1059, T1059.004, T1071, T1564, T1564.001T1564, T1564.001T1564, T1564.001T1129, T1564, T1564.001T1036, T1036.005, T1564, T1564.001T1059, T1059.004, T1070, T1564, T1564.001, T1685.006T1564, T1564.001T1564, T1564.001T1071, T1564, T1564.001T1059, T1059.004, T1564, T1564.001T1059, T1059.004, T1489, T1564, T1564.001, T1685T1564, T1564.001T1059, T1059.004, T1071, T1564, T1564.001T1059, T1059.004, T1071, T1564, T1564.001, T1620T1564.002 Hide Artifacts: Hidden Users 3 rules
T1574 Hijack Execution Flow 34 rules
T1543, T1546, T1546.016, T1574T1059, T1059.004, T1542, T1543, T1574T1543, T1546, T1546.016, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1542, T1543, T1574T1543, T1546, T1546.016, T1574T1543, T1574T1071, T1195, T1195.002, T1543, T1546, T1546.016T1071, T1195, T1195.002, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1543, T1546, T1574T1059, T1059.004, T1071, T1543, T1546, T1574T1542, T1543, T1574T1542, T1543, T1574T1542, T1543, T1574T1059, T1059.004, T1542, T1542.003, T1543, T1574T1574T1059, T1059.004, T1543, T1546, T1574T1106, T1574, T1620T1059, T1059.004, T1218, T1574T1068, T1574T1056, T1548, T1548.003, T1574T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1059, T1059.004, T1059.006, T1546, T1546.018, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1059, T1059.004, T1218, T1574T1059, T1059.004, T1059.006, T1543, T1546, T1546.016T1059, T1059.004, T1543, T1546, T1546.016, T1574T1059, T1543, T1543.002, T1574T1003, T1003.008, T1548, T1574T1202, T1564, T1574T1195, T1195.002, T1543, T1546, T1546.016, T1574T1543, T1546, T1546.016, T1574T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking 17 rules
T1574, T1574.006T1059, T1059.004, T1218, T1574, T1574.006T1574, T1574.006T1574, T1574.006T1574, T1574.006T1574, T1574.006T1068, T1574, T1574.006T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1068, T1574, T1574.006, T1574.007T1003, T1003.008, T1037, T1037.004, T1098, T1543T1574, T1574.006T1574, T1574.006T1574, T1574.006T1057, T1083, T1574, T1574.006T1037, T1053, T1053.003, T1059, T1059.004, T1098T1059, T1059.004, T1574, T1574.006T1574, T1574.006T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable 3 rules
T1574.013 Hijack Execution Flow: KernelCallbackTable 2 rules
T1620 Reflective Code Loading 23 rules
T1620T1106, T1620T1055, T1055.009, T1106, T1620T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1014, T1055, T1055.009, T1106, T1547, T1547.006T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1106, T1620T1055, T1055.009, T1106, T1620T1059, T1059.004, T1071, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1106, T1620T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1014, T1055, T1055.009, T1106, T1547, T1547.006T1055, T1055.009, T1106, T1620T1106, T1574, T1620T1036, T1059, T1059.004, T1620T1059, T1059.004, T1620T1059, T1059.004, T1071, T1564, T1564.001, T1620T1059, T1059.004, T1106, T1620Defense Impairment
T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions 13 rules
T1222, T1222.002T1222, T1222.002T1222, T1222.002T1037, T1037.004, T1053, T1053.003, T1222, T1222.002T1222, T1222.002T1059, T1222, T1222.002, T1548, T1548.001T1222, T1222.002T1222, T1222.002T1003, T1003.008, T1068, T1222, T1222.002T1068, T1222, T1222.002, T1548T1222, T1222.002, T1564T1059, T1222, T1222.002, T1548, T1548.001T1059, T1222, T1222.002, T1548, T1548.001T1553 Subvert Trust Controls 2 rules
T1553.004 Subvert Trust Controls: Install Root Certificate 1 rule
T1599 Network Boundary Bridging 1 rule
T1601.001 Modify System Image: Patch System Image 1 rule
T1685 Disable or Modify Tools 47 rules
T1685T1685T1685T1489, T1685T1685T1489, T1685, T1686T1685T1489, T1685T1685T1059, T1059.004, T1685T1059, T1059.004, T1685T1014, T1685T1685T1489, T1685T1090, T1685T1685T1489, T1685T1685T1685T1685T1685T1685T1685T1547, T1547.006, T1685T1059, T1059.004, T1489, T1564, T1564.001, T1685T1685T1070, T1685T1685T1070, T1685T1070, T1685T1071, T1685T1070, T1685T1055, T1070, T1189, T1195, T1543, T1685T1070, T1685T1070, T1685T1068, T1070, T1189, T1195, T1685T1070, T1685T1070, T1685T1685T1685T1685T1685T1685T1082, T1553, T1685T1685T1082, T1565, T1565.001, T1685T1685T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log 1 rule
T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs 8 rules
T1070, T1685, T1685.006T1070, T1685, T1685.006T1070, T1685, T1685.006T1070, T1685, T1685.006T1059, T1059.004, T1070, T1564, T1564.001, T1685.006T1014, T1070, T1547, T1547.006, T1685, T1685.006T1070, T1070.004, T1685.006T1070, T1070.004, T1685.006T1686 Disable or Modify System Firewall 2 rules
Credential Access
T1003 OS Credential Dumping 3 rules
T1003.007 OS Credential Dumping: Proc Filesystem 9 rules
T1003, T1003.007, T1005T1003, T1003.007T1003, T1003.007, T1055, T1055.008T1003, T1003.007, T1005, T1212T1003, T1003.007T1003, T1003.007T1003, T1003.007, T1057, T1212T1003, T1003.007, T1212T1003, T1003.007, T1057T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow 11 rules
T1003, T1003.008T1003, T1003.008T1003, T1003.008, T1005T1003, T1003.008T1003, T1003.008, T1068, T1552, T1552.004T1003, T1003.008, T1068T1003, T1003.008, T1068T1003, T1003.008, T1037, T1037.004, T1098, T1543T1003, T1003.008, T1068, T1222, T1222.002T1003, T1003.008, T1053, T1053.003, T1105, T1129T1003, T1003.008, T1548, T1574T1040 Network Sniffing 2 rules
T1056 Input Capture 2 rules
T1056.002 Input Capture: GUI Input Capture 2 rules
T1110 Brute Force 10 rules
T1110T1110T1110T1110T1110T1059, T1059.004, T1071, T1110, T1496T1110T1110T1110T1110T1110.001 Brute Force: Password Guessing 6 rules
T1110, T1110.001, T1110.003T1021, T1021.004, T1110, T1110.001, T1110.003T1046, T1057, T1082, T1110, T1110.001, T1110.002T1110, T1110.001T1110, T1110.001, T1110.003T1078, T1110, T1110.001, T1110.003T1110.002 Brute Force: Password Cracking 1 rule
T1110.003 Brute Force: Password Spraying 4 rules
T1110, T1110.001, T1110.003T1021, T1021.004, T1110, T1110.001, T1110.003T1110, T1110.001, T1110.003T1078, T1110, T1110.001, T1110.003T1212 Exploitation for Credential Access 6 rules
T1212T1003, T1003.007, T1005, T1212T1003, T1003.007, T1057, T1212T1003, T1003.007, T1212T1212T1003, T1203, T1212T1528 Steal Application Access Token 5 rules
T1059, T1059.004, T1528, T1552, T1613T1528, T1552, T1552.001T1005, T1528, T1552, T1552.001, T1613T1528, T1552, T1552.001T1059, T1059.004, T1528, T1550, T1550.001, T1552T1539 Steal Web Session Cookie 1 rule
T1552 Unsecured Credentials 2 rules
T1552.001 Unsecured Credentials: Credentials In Files 22 rules
T1005, T1083, T1552, T1552.001T1083, T1552, T1552.001T1003, T1005, T1552, T1552.001, T1555T1078, T1550, T1552, T1552.001T1083, T1552, T1552.001, T1613T1528, T1552, T1552.001T1005, T1528, T1552, T1552.001, T1613T1528, T1552, T1552.001T1083, T1552, T1552.001T1078, T1078.003, T1552, T1552.001T1003, T1213, T1213.003, T1552, T1552.001, T1555T1083, T1552, T1552.001, T1552.004T1083, T1552, T1552.001T1005, T1552, T1552.001, T1560, T1560.001T1005, T1552, T1552.001, T1560, T1560.001T1005, T1552, T1552.001, T1560, T1560.001T1552, T1552.001, T1552.007T1005, T1083, T1552, T1552.001, T1552.004T1083, T1552, T1552.001T1059, T1059.004, T1528, T1550, T1550.001, T1552T1005, T1552, T1552.001T1059, T1059.004, T1071, T1095, T1105, T1190T1552.004 Unsecured Credentials: Private Keys 4 rules
T1552, T1552.004, T1613T1003, T1003.008, T1068, T1552, T1552.004T1083, T1552, T1552.001, T1552.004T1005, T1083, T1552, T1552.001, T1552.004T1552.005 Unsecured Credentials: Cloud Instance Metadata API 4 rules
T1552, T1552.005T1016, T1082, T1552, T1552.005, T1580T1552, T1552.005T1552, T1552.005T1552.007 Unsecured Credentials: Container API 1 rule
T1555 Credentials from Password Stores 4 rules
T1003, T1005, T1552, T1552.001, T1555T1059, T1059.006, T1555T1003, T1213, T1213.003, T1552, T1552.001, T1555T1059, T1059.007, T1195, T1195.001, T1555T1556 Modify Authentication Process 9 rules
T1556T1082, T1518, T1543, T1556T1543, T1556T1021, T1021.004, T1059, T1059.004, T1543, T1556T1074, T1074.001, T1554, T1556T1014, T1037, T1037.004, T1053, T1053.002, T1053.003T1056, T1554, T1556T1021, T1021.004, T1543, T1554, T1556, T1563T1021, T1021.004, T1037, T1554, T1556, T1563T1556.003 Modify Authentication Process: Pluggable Authentication Modules 5 rules
T1543, T1556, T1556.003T1543, T1556, T1556.003T1105, T1543, T1556, T1556.003T1543, T1556, T1556.003T1059, T1543, T1556, T1556.003Discovery
T1016 System Network Configuration Discovery 6 rules
T1016, T1018, T1046, T1049, T1613T1016T1016, T1059, T1059.004, T1071, T1082, T1087T1016, T1082, T1552, T1552.005, T1580T1016, T1033, T1049, T1057, T1059, T1059.004T1016T1018 Remote System Discovery 3 rules
T1033 System Owner/User Discovery 8 rules
T1033, T1082T1033, T1046, T1059, T1105, T1218T1033, T1082, T1613T1033, T1069, T1069.001, T1548, T1548.003T1016, T1033, T1049, T1057, T1059, T1059.004T1033, T1069T1033T1033, T1069, T1069.001, T1087, T1087.001T1040 Network Sniffing 3 rules
T1046 Network Service Discovery 12 rules
T1016, T1018, T1046, T1049, T1613T1046, T1082T1046, T1498T1046T1046, T1057, T1082, T1110, T1110.001, T1110.002T1018, T1046T1046T1018, T1046T1033, T1046, T1059, T1105, T1218T1046, T1071, T1571T1040, T1046, T1105, T1595T1040, T1046, T1105, T1595T1049 System Network Connections Discovery 3 rules
T1057 Process Discovery 11 rules
T1003, T1003.007, T1057, T1212T1046, T1057, T1082, T1110, T1110.001, T1110.002T1005, T1057T1057, T1083T1003, T1003.007, T1057T1057, T1083, T1574, T1574.006T1057, T1083T1057, T1082T1057T1016, T1033, T1049, T1057, T1059, T1059.004T1057T1069 Permission Groups Discovery 2 rules
T1069.001 Permission Groups Discovery: Local Groups 2 rules
T1069.002 Permission Groups Discovery: Domain Groups 1 rule
T1082 System Information Discovery 32 rules
T1082, T1518T1082, T1613T1046, T1082T1014, T1082, T1083T1005, T1014, T1082T1014, T1082, T1140T1082T1082T1082, T1135T1074, T1074.001, T1082, T1083, T1119T1074, T1074.001, T1082, T1083, T1119T1033, T1082T1082T1082, T1518, T1543, T1556T1082, T1518T1046, T1057, T1082, T1110, T1110.001, T1110.002T1016, T1059, T1059.004, T1071, T1082, T1087T1033, T1082, T1613T1005, T1082, T1613T1016, T1082, T1552, T1552.005, T1580T1082, T1553, T1685T1082, T1083, T1547, T1547.006T1057, T1082T1082, T1565, T1565.001, T1685T1016, T1033, T1049, T1057, T1059, T1059.004T1082, T1083, T1518T1082T1082, T1518T1082T1082, T1497, T1497.001T1082, T1497, T1497.001T1082, T1083, T1518T1083 File and Directory Discovery 23 rules
T1005, T1083, T1552, T1552.001T1083, T1552, T1552.001T1083, T1518T1083, T1518T1014, T1082, T1083T1083, T1552, T1552.001, T1613T1083, T1613T1074, T1074.001, T1082, T1083, T1119T1074, T1074.001, T1082, T1083, T1119T1083, T1552, T1552.001T1083, T1548, T1548.001T1083, T1552, T1552.001, T1552.004T1057, T1083T1083, T1552, T1552.001T1005, T1083, T1552, T1552.001, T1552.004T1083, T1552, T1552.001T1083, T1548, T1548.001T1057, T1083, T1574, T1574.006T1057, T1083T1082, T1083, T1547, T1547.006T1016, T1033, T1049, T1057, T1059, T1059.004T1082, T1083, T1518T1082, T1083, T1518T1087.001 Account Discovery: Local Account 2 rules
T1135 Network Share Discovery 1 rule
T1497.001 Virtualization/Sandbox Evasion: System Checks 2 rules
T1518 Software Discovery 9 rules
T1082, T1518T1083, T1518T1083, T1518T1082, T1518, T1543, T1556T1082, T1518T1082, T1083, T1518T1518, T1613T1082, T1518T1082, T1083, T1518T1518.001 Software Discovery: Security Software Discovery 2 rules
T1580 Cloud Infrastructure Discovery 1 rule
T1613 Container and Resource Discovery 27 rules
T1609, T1613T1609, T1613T1059, T1059.004, T1609, T1613T1059, T1059.004, T1550, T1550.001, T1609, T1613T1016, T1018, T1046, T1049, T1613T1609, T1613T1082, T1613T1059, T1059.004, T1609, T1613T1059, T1059.004, T1528, T1552, T1613T1083, T1552, T1552.001, T1613T1613T1069, T1613T1021, T1613T1552, T1552.004, T1613T1083, T1613T1005, T1528, T1552, T1552.001, T1613T1613T1021, T1059, T1059.004, T1613T1021, T1059, T1059.004, T1613T1059, T1059.004, T1609, T1613T1059, T1059.004, T1609, T1613T1033, T1082, T1613T1071, T1071.004, T1613T1005, T1082, T1613T1059, T1059.004, T1528, T1550, T1550.001, T1552T1518, T1613T1550, T1611, T1613Lateral Movement
(no specific technique) 2 rules
T1021 Remote Services 7 rules
T1021, T1071T1021T1001, T1021, T1041, T1132T1021, T1613T1021, T1059, T1059.004, T1613T1021, T1059, T1059.004, T1613T1021T1021.004 Remote Services: SSH 17 rules
T1021, T1021.004, T1572T1021, T1021.004, T1095, T1546, T1546.004, T1563T1021, T1021.004, T1059, T1059.004, T1543, T1556T1021, T1021.004, T1563, T1563.001T1021, T1021.004, T1110, T1110.001, T1110.003T1021, T1021.004, T1105, T1563, T1563.001T1021, T1021.004, T1105, T1570T1021, T1021.004, T1543, T1554, T1556, T1563T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1078T1021, T1021.004, T1078, T1133T1021, T1021.004, T1078, T1133T1021, T1021.004, T1105, T1570T1021, T1021.004, T1037, T1554, T1556, T1563T1021, T1021.004, T1133, T1546, T1546.004, T1563T1210 Exploitation of Remote Services 10 rules
T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1554T1068, T1190, T1210T1190, T1210T1059, T1059.004, T1071, T1190, T1210, T1505T1068, T1190, T1210T1210T1550 Use Alternate Authentication Material 2 rules
T1550.001 Use Alternate Authentication Material: Application Access Token 2 rules
T1563.001 Remote Service Session Hijacking: SSH Hijacking 10 rules
T1021, T1021.004, T1095, T1546, T1546.004, T1563T1021, T1021.004, T1059, T1059.004, T1543, T1556T1021, T1021.004, T1563, T1563.001T1021, T1021.004, T1105, T1563, T1563.001T1021, T1021.004, T1543, T1554, T1556, T1563T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1098, T1098.004, T1563, T1563.001T1021, T1021.004, T1037, T1554, T1556, T1563T1021, T1021.004, T1133, T1546, T1546.004, T1563T1570 Lateral Tool Transfer 4 rules
Collection
T1005 Data from Local System 21 rules
T1005, T1083, T1552, T1552.001T1003, T1005, T1552, T1552.001, T1555T1005, T1014, T1082T1005, T1528, T1552, T1552.001, T1613T1003, T1003.007, T1005T1005, T1048, T1105T1005, T1048, T1105T1005, T1048, T1105T1005, T1048, T1105T1003, T1003.007, T1005, T1212T1005T1005, T1048T1003, T1003.008, T1005T1005, T1057T1005, T1006, T1078, T1078.003T1005, T1552, T1552.001, T1560, T1560.001T1005, T1552, T1552.001, T1560, T1560.001T1005, T1552, T1552.001, T1560, T1560.001T1005, T1083, T1552, T1552.001, T1552.004T1005, T1082, T1613T1005, T1552, T1552.001T1074.001 Data Staged: Local Data Staging 4 rules
T1113 Screen Capture 1 rule
T1115 Clipboard Data 1 rule
T1119 Automated Collection 5 rules
T1074, T1074.001, T1082, T1083, T1119T1074, T1074.001, T1082, T1083, T1119T1029, T1078, T1119, T1133, T1190T1119T1048, T1119, T1213T1123 Audio Capture 1 rule
T1125 Video Capture 1 rule
T1213 Data from Information Repositories 2 rules
T1213.003 Data from Information Repositories: Code Repositories 1 rule
T1560.001 Archive Collected Data: Archive via Utility 4 rules
T1027, T1030, T1560, T1560.001, T1560.002T1005, T1552, T1552.001, T1560, T1560.001T1005, T1552, T1552.001, T1560, T1560.001T1005, T1552, T1552.001, T1560, T1560.001Command & Control
(no specific technique) 3 rules
T1001 Data Obfuscation 1 rule
T1008 Fallback Channels 2 rules
T1071 Application Layer Protocol 96 rules
T1037, T1059, T1059.004, T1071T1059, T1059.004, T1071, T1564, T1564.001T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1021, T1071T1059, T1059.004, T1071, T1611T1037, T1059, T1059.004, T1071T1071, T1195, T1195.002, T1543, T1546, T1546.016T1071, T1211, T1564T1071, T1195, T1195.002, T1543, T1546, T1546.016T1059, T1059.004, T1071T1059, T1059.004, T1071, T1543, T1546, T1574T1071, T1564, T1564.001T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1071, T1685T1059, T1059.004, T1071, T1218T1059, T1059.004, T1071, T1106, T1620T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071, T1573, T1573.002T1059, T1059.004, T1071T1059, T1059.004, T1071T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1059.006, T1071, T1105T1059, T1059.004, T1071T1059, T1071T1059, T1071T1071, T1090, T1572T1059, T1059.004, T1071, T1110, T1496T1016, T1059, T1059.004, T1071, T1082, T1087T1059, T1059.004, T1071, T1190, T1210, T1505T1059, T1059.004, T1071, T1203T1059, T1059.004, T1071, T1190, T1210, T1554T1037, T1059, T1059.004, T1071, T1505, T1505.003T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071T1059, T1071T1059, T1059.004, T1071, T1095T1059, T1059.004, T1059.006, T1071, T1095T1059, T1059.004, T1059.006, T1059.011, T1071, T1095T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1055, T1055.008, T1059, T1059.004, T1068, T1071T1059, T1059.004, T1071T1053, T1071, T1543, T1543.002, T1569, T1569.002T1059, T1059.004, T1071, T1203T1059, T1059.004, T1071T1059, T1059.004, T1071T1046, T1071, T1571T1059, T1059.004, T1071, T1218T1027, T1037, T1053, T1053.003, T1059, T1059.004T1059, T1059.004, T1071, T1564, T1564.001T1059, T1059.004, T1071T1059, T1059.004, T1071, T1505, T1505.003T1059, T1059.004, T1071T1059, T1059.004, T1071T1059, T1059.004, T1071T1037, T1037.004, T1053, T1053.003, T1071T1059, T1059.004, T1071, T1564, T1564.001, T1620T1059, T1059.004, T1071T1059, T1059.004, T1071, T1203T1059, T1059.004, T1071, T1190, T1210, T1505T1036, T1036.005, T1059, T1059.004, T1071, T1105T1071T1071T1071T1071T1037, T1059, T1059.004, T1071T1059, T1059.004, T1071, T1190, T1505, T1505.003T1053, T1053.003, T1059, T1059.004, T1071, T1543T1053, T1059, T1059.004, T1071, T1543, T1543.002T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1059, T1059.004, T1071, T1190, T1505, T1505.003T1041, T1055, T1071T1041, T1071, T1205, T1205.001, T1571T1071, T1566T1059, T1059.004, T1071, T1095, T1105, T1190T1041, T1071, T1189, T1566T1059, T1059.004, T1071T1071.001 Application Layer Protocol: Web Protocols 13 rules
T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1071, T1071.001, T1090, T1090.002, T1102, T1102.001T1059, T1059.004, T1071, T1071.001T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1059, T1059.004, T1071, T1071.001, T1105T1071, T1071.001, T1105T1071, T1071.001, T1105T1071, T1071.001, T1102, T1102.002T1059, T1059.004, T1071, T1071.001T1059, T1059.004, T1059.006, T1071, T1071.001T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004, T1059.006, T1071, T1071.001, T1505T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1071.004 Application Layer Protocol: DNS 10 rules
T1071, T1071.004, T1102, T1204, T1204.002T1071, T1071.004, T1204, T1204.002T1059, T1059.004, T1071, T1071.004, T1102, T1496T1059, T1059.004, T1071, T1071.004, T1102T1071, T1071.004, T1102T1071, T1071.004, T1102T1059, T1059.004, T1071, T1071.004, T1102T1071, T1071.004, T1090, T1090.002, T1102, T1102.001T1071, T1071.004, T1613T1071, T1071.004, T1102T1090 Proxy 12 rules
T1090, T1572T1090, T1685T1090T1071, T1090, T1572T1090, T1572T1090, T1572T1090, T1572T1090, T1572T1090, T1219, T1572T1090, T1219, T1572T1008, T1090T1090, T1572T1090.001 Proxy: Internal Proxy 1 rule
T1090.002 Proxy: External Proxy 3 rules
T1090.003 Proxy: Multi-hop Proxy 2 rules
T1095 Non-Application Layer Protocol 15 rules
T1048, T1048.003, T1059, T1059.004, T1095T1048, T1048.003, T1059, T1059.004, T1095T1059, T1059.004, T1095T1048, T1095T1021, T1021.004, T1095, T1546, T1546.004, T1563T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071, T1095T1059, T1095T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071, T1095T1059, T1059.004, T1071, T1095T1059, T1059.004, T1059.006, T1071, T1095T1059, T1059.004, T1059.006, T1059.011, T1071, T1095T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1059, T1059.004, T1071, T1095, T1105, T1190T1102 Web Service 13 rules
T1102, T1189T1102T1102T1071, T1071.004, T1102, T1204, T1204.002T1059, T1059.004, T1071, T1071.004, T1102, T1496T1059, T1059.004, T1071, T1071.004, T1102T1071, T1071.004, T1102T1071, T1071.004, T1102T1059, T1059.004, T1071, T1071.004, T1102T1102T1102, T1566T1102T1071, T1071.004, T1102T1102.001 Web Service: Dead Drop Resolver 2 rules
T1102.002 Web Service: Bidirectional Communication 4 rules
T1102, T1102.002T1071, T1071.004, T1090, T1090.002, T1102, T1102.001T1071, T1071.001, T1090, T1090.002, T1102, T1102.001T1071, T1071.001, T1102, T1102.002T1105 Ingress Tool Transfer 30 rules
T1059, T1059.004, T1059.006, T1059.011, T1071, T1071.001T1059, T1059.004, T1105, T1202, T1218T1105T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006T1059, T1059.004, T1070, T1070.004, T1105T1059, T1059.004, T1071, T1071.001, T1105T1071, T1071.001, T1105T1071, T1071.001, T1105T1059, T1059.004, T1070, T1070.004, T1105, T1204T1005, T1048, T1105T1005, T1048, T1105T1005, T1048, T1105T1005, T1048, T1105T1105, T1195, T1195.001, T1195.002T1059, T1059.004, T1059.006, T1071, T1105T1105, T1543, T1556, T1556.003T1055, T1055.009, T1059, T1059.006, T1059.007, T1059.011T1105T1021, T1021.004, T1105, T1563, T1563.001T1105, T1190, T1505, T1505.003T1033, T1046, T1059, T1105, T1218T1105T1021, T1021.004, T1105, T1570T1003, T1003.008, T1053, T1053.003, T1105, T1129T1040, T1046, T1105, T1595T1040, T1046, T1105, T1595T1036, T1036.005, T1059, T1059.004, T1071, T1105T1072, T1105T1021, T1021.004, T1105, T1570T1059, T1059.004, T1071, T1095, T1105, T1190T1132 Data Encoding 1 rule
T1132.001 Data Encoding: Standard Encoding 1 rule
T1205.001 Traffic Signaling: Port Knocking 1 rule
T1219 Remote Access Tools 3 rules
T1568 Dynamic Resolution 2 rules
T1568.002 Dynamic Resolution: Domain Generation Algorithms 2 rules
T1571 Non-Standard Port 2 rules
T1572 Protocol Tunneling 19 rules
T1090, T1090.002, T1572T1090, T1572T1090, T1090.001, T1572T1021, T1021.004, T1572T1071, T1090, T1572T1572T1090, T1572T1090, T1572T1572T1572T1572T1090, T1572T1090, T1572T1090, T1219, T1572T1090, T1219, T1572T1090, T1090.003, T1572T1090, T1090.003, T1572T1059, T1059.004, T1572T1090, T1572Exfiltration
(no specific technique) 1 rule
T1020 Automated Exfiltration 2 rules
T1029 Scheduled Transfer 1 rule
T1030 Data Transfer Size Limits 2 rules
T1041 Exfiltration Over C2 Channel 5 rules
T1001, T1021, T1041, T1132T1014, T1036, T1036.004, T1041T1041, T1055, T1071T1041, T1071, T1205, T1205.001, T1571T1041, T1071, T1189, T1566T1048 Exfiltration Over Alternative Protocol 20 rules
T1048T1048T1048T1048T1048T1048T1048T1048T1048T1048T1048T1048, T1059, T1059.004T1005, T1048, T1105T1005, T1048, T1105T1005, T1048, T1105T1005, T1048, T1105T1048, T1095T1005, T1048T1048T1048, T1119, T1213T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol 2 rules
T1567 Exfiltration Over Web Service 1 rule
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository 2 rules
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage 2 rules
Impact
(no specific technique) 1 rule
T1485 Data Destruction 5 rules
T1486 Data Encrypted for Impact 7 rules
T1486T1486T1486T1486T1486T1059, T1486T1036, T1036.003, T1486T1489 Service Stop 8 rules
T1489, T1685T1489, T1685, T1686T1489, T1685T1489, T1685T1489, T1685T1059, T1059.004, T1489, T1564, T1564.001, T1685T1489T1489T1490 Inhibit System Recovery 1 rule
T1496 Resource Hijacking 8 rules
T1059, T1059.004, T1071, T1071.004, T1102, T1496T1059, T1059.004, T1496T1059, T1059.004, T1496T1059, T1059.004, T1496T1059, T1059.004, T1071, T1110, T1496T1059, T1059.004, T1496T1059, T1059.004, T1496, T1543, T1543.002T1496T1496.001 Resource Hijacking: Compute Hijacking 1 rule
T1498 Network Denial of Service 4 rules
T1499 Endpoint Denial of Service 1 rule
T1529 System Shutdown/Reboot 5 rules
T1531 Account Access Removal 3 rules
T1565 Data Manipulation 1 rule
T1565.001 Data Manipulation: Stored Data Manipulation 3 rules
Execution
T0871 Execution through API 2 rules
(no MITRE mapping)
(no MITRE mapping) 112 rules