BIOC
Informational
✕
Simulation activity by Cymulate
Simulation activity performed by Cymulate agent.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
Indicator:
File action type = all Process initiator cmd =~ .*(\\ProgramData\\Cymulate\\Agent\\Temp\\cfd_|\\Cymulate\\EDR_Attacks\\).* AND initiated by =~ (cfd|CymulateEDRScenarioExecutor)\.exe
Preventable: yes