Rules (XIF)
[MODEL: dataset=sentinelone_xdr_raw]
filter eventType = "Activity"
| alter
data_ipAddress = json_extract_scalar(data, "$.ipAddress"),
data_osType = json_extract_scalar(data, "$.osType")
| alter
xdm.event.type = eventType,
xdm.source.user.identifier = accountId,
xdm.source.user.username = coalesce(
json_extract_scalar(data, "$.byUser"),
json_extract_scalar(data, "$.lastLoggedInUserName"),
json_extract_scalar(data, "$.realUser")),
xdm.source.interface = json_extract_scalar(data, "$.interface"),
xdm.source.ipv4 = if(is_ipv4(data_ipAddress), data_ipAddress),
xdm.source.ipv6 = if(is_ipv6(data_ipAddress), data_ipAddress),
xdm.event.id = activityUuid,
xdm.source.agent.identifier = agentId,
xdm.source.agent.version = agentUpdatedVersion,
xdm.source.user.groups = arraycreate(groupName),
xdm.session_context_id = id,
xdm.source.host.os_family = if(
data_osType ~="[Ll]inux", XDM_CONST.OS_FAMILY_LINUX,
data_osType ~= "[Mm]acos|osx", XDM_CONST.OS_FAMILY_MACOS,
data_osType~="[Ww]indows", XDM_CONST.OS_FAMILY_WINDOWS,
osFamily~="[Ll]inux", XDM_CONST.OS_FAMILY_LINUX,
osFamily~="[Mm]acos|osx", XDM_CONST.OS_FAMILY_MACOS,
osFamily~="[Ww]indows", XDM_CONST.OS_FAMILY_WINDOWS),
xdm.source.host.os = coalesce(data_osType, osFamily),
xdm.source.host.hostname = json_extract_scalar(data, "$.computerName"),
xdm.event.description = coalesce(description, primaryDescription),
xdm.alert.original_threat_id = threatId,
xdm.source.user.employee_id = userId,
xdm.target.user.identifier = json_extract_scalar(data, "$.accountId"),
xdm.target.user.username = json_extract_scalar(data, "$.username"),
xdm.target.user.groups = arraycreate(json_extract_scalar(data, "$.role"));
filter eventType = "Threat"
| alter
osFamily = json_extract_scalar(agentRealtimeInfo, "$.agentOsType"),
technique = json_extract_scalar(indicators, "$.0.tactics.0.techniques.0.name")
| alter
xdm.event.type = eventType,
xdm.source.user.identifier = coalesce(json_extract_scalar(agentDetectionInfo, "$.accountId"), json_extract_scalar(agentRealtimeInfo, "$.accountId")),
xdm.source.user.username = json_extract_scalar(agentDetectionInfo, "$.agentLastLoggedInUserName"),
xdm.source.user.domain = json_extract_scalar(agentDetectionInfo, "$.agentDomain"),
xdm.source.ipv4 = json_extract_scalar(agentDetectionInfo, "$.agentIpV4"),
xdm.source.ipv6 = json_extract_scalar(agentDetectionInfo, "$.agentIpV6"),
xdm.source.host.os = json_extract_scalar(agentDetectionInfo, "$.agentOsName"),
xdm.source.agent.identifier = json_extract_scalar(agentDetectionInfo, "$.agentUuid"),
xdm.source.agent.version = json_extract_scalar(agentDetectionInfo, "$.agentVersion"),
xdm.source.host.ipv4_addresses = arraycreate(json_extract_scalar(agentDetectionInfo, "$.externalIp")),
xdm.source.user.groups = arraycreate(coalesce(json_extract_scalar(agentDetectionInfo, "$.groupName"), json_extract_scalar(agentRealtimeInfo, "$.groupName"))),
xdm.source.host.hostname = json_extract_scalar(agentRealtimeInfo, "$.agentComputerName"),
xdm.source.host.device_id = json_extract_scalar(agentRealtimeInfo, "$.agentId"),
xdm.observer.type = json_extract_scalar(agentRealtimeInfo, "$.agentMachineType"),
xdm.source.host.os_family = if(
osFamily~="[Ll]inux", XDM_CONST.OS_FAMILY_LINUX,
osFamily~="[Mm]acos|osx", XDM_CONST.OS_FAMILY_MACOS,
osFamily~="[Ww]indows", XDM_CONST.OS_FAMILY_WINDOWS),
xdm.source.host.mac_addresses = arraycreate(json_extract_scalar(agentRealtimeInfo, "$.networkInterfaces.0.physical")),
xdm.source.location.region = json_extract_scalar(agentRealtimeInfo, "$.siteName"),
xdm.source.process.container_id = json_extract_scalar(containerInfo, "$.id"),
xdm.alert.original_threat_id = id,
xdm.alert.description = json_extract_scalar(indicators, "$.0.description"),
xdm.alert.mitre_techniques = arraycreate(if(technique="TA0009","COLLECTION", technique="TA0011","COMMAND_AND_CONTROL", technique="TA0006","CREDENTIAL_ACCESS", technique="TA0005","DEFENSE_EVASION", technique="TA0007","DISCOVERY", technique="TA0002","EXECUTION", technique="TA0010","EXFILTRATION", technique="TA0040","IMPACT", technique="TA0001","INITIAL_ACCESS", technique="TA0008","LATERAL_MOVEMENT", technique="TA0003","PERSISTENCE", technique="TA0004","PRIVILEGE_ESCALATION", technique="TA0043","RECONNAISSANCE", technique="TA0042","RESOURCE_DEVELOPMENT", technique="T1548","ABUSE_ELEVATION_CONTROL_MECHANISM", technique="T1548.002","ABUSE_ELEVATION_CONTROL_MECHANISM_BYPASS_USER_ACCOUNT_CONTROL", technique="T1548.004","ABUSE_ELEVATION_CONTROL_MECHANISM_ELEVATED_EXECUTION_WITH_PROMPT", technique="T1548.001","ABUSE_ELEVATION_CONTROL_MECHANISM_SETUID_AND_SETGID", technique="T1548.003","ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHING", technique="T1134","ACCESS_TOKEN_MANIPULATION", technique="T1134.002","ACCESS_TOKEN_MANIPULATION_CREATE_PROCESS_WITH_TOKEN", technique="T1134.003","ACCESS_TOKEN_MANIPULATION_MAKE_AND_IMPERSONATE_TOKEN", technique="T1134.004","ACCESS_TOKEN_MANIPULATION_PARENT_PID_SPOOFING", technique="T1134.005","ACCESS_TOKEN_MANIPULATION_SID_HISTORY_INJECTION", technique="T1134.001","ACCESS_TOKEN_MANIPULATION_TOKEN_IMPERSONATION_OR_THEFT", technique="T1531","ACCOUNT_ACCESS_REMOVAL", technique="T1087","ACCOUNT_DISCOVERY", technique="T1087.004","ACCOUNT_DISCOVERY_CLOUD_ACCOUNT", technique="T1087.002","ACCOUNT_DISCOVERY_DOMAIN_ACCOUNT", technique="T1087.003","ACCOUNT_DISCOVERY_EMAIL_ACCOUNT", technique="T1087.001","ACCOUNT_DISCOVERY_LOCAL_ACCOUNT", technique="T1098","ACCOUNT_MANIPULATION", technique="T1098.003","ACCOUNT_MANIPULATION_ADD_OFFICE_365_GLOBAL_ADMINISTRATOR_ROLE", technique="T1098.001","ACCOUNT_MANIPULATION_ADDITIONAL_CLOUD_CREDENTIALS", technique="T1098.002","ACCOUNT_MANIPULATION_EXCHANGE_EMAIL_DELEGATE_PERMISSIONS", technique="T1098.004","ACCOUNT_MANIPULATION_SSH_AUTHORIZED_KEYS", technique="T1583","ACQUIRE_INFRASTRUCTURE", technique="T1583.005","ACQUIRE_INFRASTRUCTURE_BOTNET", technique="T1583.002","ACQUIRE_INFRASTRUCTURE_DNS_SERVER", technique="T1583.001","ACQUIRE_INFRASTRUCTURE_DOMAINS", technique="T1583.004","ACQUIRE_INFRASTRUCTURE_SERVER", technique="T1583.003","ACQUIRE_INFRASTRUCTURE_VIRTUAL_PRIVATE_SERVER", technique="T1583.006","ACQUIRE_INFRASTRUCTURE_WEB_SERVICES", technique="T1595","ACTIVE_SCANNING", technique="T1595.001","ACTIVE_SCANNING_SCANNING_IP_BLOCKS", technique="T1595.002","ACTIVE_SCANNING_VULNERABILITY_SCANNING", technique="T1557","ADVERSARY_IN_THE_MIDDLE", technique="T1557.002","ADVERSARY_IN_THE_MIDDLE_ARP_CACHE_POISONING", technique="T1557.001","ADVERSARY_IN_THE_MIDDLE_LLMNR_NBT_NS_POISONING_AND_SMB_RELAY", technique="T1071","APPLICATION_LAYER_PROTOCOL", technique="T1071.004","APPLICATION_LAYER_PROTOCOL_DNS", technique="T1071.002","APPLICATION_LAYER_PROTOCOL_FILE_TRANSFER_PROTOCOLS", technique="T1071.003","APPLICATION_LAYER_PROTOCOL_MAIL_PROTOCOLS", technique="T1071.001","APPLICATION_LAYER_PROTOCOL_WEB_PROTOCOLS", technique="T1010","APPLICATION_WINDOW_DISCOVERY", technique="T1560","ARCHIVE_COLLECTED_DATA", technique="T1560.003","ARCHIVE_COLLECTED_DATA_ARCHIVE_VIA_CUSTOM_METHOD", technique="T1560.002","ARCHIVE_COLLECTED_DATA_ARCHIVE_VIA_LIBRARY", technique="T1560.001","ARCHIVE_COLLECTED_DATA_ARCHIVE_VIA_UTILITY", technique="T1123","AUDIO_CAPTURE", technique="T1119","AUTOMATED_COLLECTION", technique="T1020","AUTOMATED_EXFILTRATION", technique="T1020.001","AUTOMATED_EXFILTRATION_TRAFFIC_DUPLICATION", technique="T1197","BITS_JOBS", technique="T1547","BOOT_OR_LOGON_AUTOSTART_EXECUTION", technique="T1547.014","BOOT_OR_LOGON_AUTOSTART_EXECUTION_ACTIVE_SETUP", technique="T1547.002","BOOT_OR_LOGON_AUTOSTART_EXECUTION_AUTHENTICATION_PACKAGE", technique="T1547.006","BOOT_OR_LOGON_AUTOSTART_EXECUTION_KERNEL_MODULES_AND_EXTENSIONS", technique="T1547.008","BOOT_OR_LOGON_AUTOSTART_EXECUTION_LSASS_DRIVER", technique="T1547.015","BOOT_OR_LOGON_AUTOSTART_EXECUTION_LOGIN_ITEMS", technique="T1547.011","BOOT_OR_LOGON_AUTOSTART_EXECUTION_PLIST_MODIFICATION", technique="T1547.010","BOOT_OR_LOGON_AUTOSTART_EXECUTION_PORT_MONITORS", technique="T1547.012","BOOT_OR_LOGON_AUTOSTART_EXECUTION_PRINT_PROCESSORS", technique="T1547.007","BOOT_OR_LOGON_AUTOSTART_EXECUTION_RE_OPENED_APPLICATIONS", technique="T1547.001","BOOT_OR_LOGON_AUTOSTART_EXECUTION_REGISTRY_RUN_KEYS_OR_STARTUP_FOLDER", technique="T1547.005","BOOT_OR_LOGON_AUTOSTART_EXECUTION_SECURITY_SUPPORT_PROVIDER", technique="T1547.009","BOOT_OR_LOGON_AUTOSTART_EXECUTION_SHORTCUT_MODIFICATION", technique="T1547.003","BOOT_OR_LOGON_AUTOSTART_EXECUTION_TIME_PROVIDERS", technique="T1547.004","BOOT_OR_LOGON_AUTOSTART_EXECUTION_WINLOGON_HELPER_DLL", technique="T1547.013","BOOT_OR_LOGON_AUTOSTART_EXECUTION_XDG_AUTOSTART_ENTRIES", technique="T1037","BOOT_OR_LOGON_INITIALIZATION_SCRIPTS", technique="T1037.002","BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_LOGON_SCRIPT_MAC", technique="T1037.001","BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_LOGON_SCRIPT_WINDOWS", technique="T1037.003","BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_NETWORK_LOGON_SCRIPT", technique="T1037.004","BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_RC_SCRIPTS", technique="T1037.005","BOOT_OR_LOGON_INITIALIZATION_SCRIPTS_STARTUP_ITEMS", technique="T1217","BROWSER_BOOKMARK_DISCOVERY", technique="T1176","BROWSER_EXTENSIONS", technique="T1185","BROWSER_SESSION_HIJACKING", technique="T1110","BRUTE_FORCE", technique="T1110.004","BRUTE_FORCE_CREDENTIAL_STUFFING", technique="T1110.002","BRUTE_FORCE_PASSWORD_CRACKING", technique="T1110.001","BRUTE_FORCE_PASSWORD_GUESSING", technique="T1110.003","BRUTE_FORCE_PASSWORD_SPRAYING", technique="T1612","BUILD_IMAGE_ON_HOST", technique="T1115","CLIPBOARD_DATA", technique="T1580","CLOUD_INFRASTRUCTURE_DISCOVERY", technique="T1538","CLOUD_SERVICE_DASHBOARD", technique="T1526","CLOUD_SERVICE_DISCOVERY", technique="T1619","CLOUD_STORAGE_OBJECT_DISCOVERY", technique="T1059","COMMAND_AND_SCRIPTING_INTERPRETER", technique="T1059.002","COMMAND_AND_SCRIPTING_INTERPRETER_APPLESCRIPT", technique="T1059.007","COMMAND_AND_SCRIPTING_INTERPRETER_JAVASCRIPT", technique="T1059.008","COMMAND_AND_SCRIPTING_INTERPRETER_NETWORK_DEVICE_CLI", technique="T1059.001","COMMAND_AND_SCRIPTING_INTERPRETER_POWERSHELL", technique="T1059.006","COMMAND_AND_SCRIPTING_INTERPRETER_PYTHON", technique="T1059.004","COMMAND_AND_SCRIPTING_INTERPRETER_UNIX_SHELL", technique="T1059.005","COMMAND_AND_SCRIPTING_INTERPRETER_VISUAL_BASIC", technique="T1059.003","COMMAND_AND_SCRIPTING_INTERPRETER_WINDOWS_COMMAND_SHELL", technique="T1092","COMMUNICATION_THROUGH_REMOVABLE_MEDIA", technique="T1586","COMPROMISE_ACCOUNTS", technique="T1586.002","COMPROMISE_ACCOUNTS_EMAIL_ACCOUNTS", technique="T1586.001","COMPROMISE_ACCOUNTS_SOCIAL_MEDIA_ACCOUNTS", technique="T1554","COMPROMISE_CLIENT_SOFTWARE_BINARY", technique="T1584","COMPROMISE_INFRASTRUCTURE", technique="T1584.005","COMPROMISE_INFRASTRUCTURE_BOTNET", technique="T1584.002","COMPROMISE_INFRASTRUCTURE_DNS_SERVER", technique="T1584.001","COMPROMISE_INFRASTRUCTURE_DOMAINS", technique="T1584.004","COMPROMISE_INFRASTRUCTURE_SERVER", technique="T1584.003","COMPROMISE_INFRASTRUCTURE_VIRTUAL_PRIVATE_SERVER", technique="T1584.006","COMPROMISE_INFRASTRUCTURE_WEB_SERVICES", technique="T1609","CONTAINER_ADMINISTRATION_COMMAND", technique="T1613","CONTAINER_AND_RESOURCE_DISCOVERY", technique="T1136","CREATE_ACCOUNT", technique="T1136.003","CREATE_ACCOUNT_CLOUD_ACCOUNT", technique="T1136.002","CREATE_ACCOUNT_DOMAIN_ACCOUNT", technique="T1136.001","CREATE_ACCOUNT_LOCAL_ACCOUNT", technique="T1543","CREATE_OR_MODIFY_SYSTEM_PROCESS", technique="T1543.001","CREATE_OR_MODIFY_SYSTEM_PROCESS_LAUNCH_AGENT", technique="T1543.004","CREATE_OR_MODIFY_SYSTEM_PROCESS_LAUNCH_DAEMON", technique="T1543.002","CREATE_OR_MODIFY_SYSTEM_PROCESS_SYSTEMD_SERVICE", technique="T1543.003","CREATE_OR_MODIFY_SYSTEM_PROCESS_WINDOWS_SERVICE", technique="T1555","CREDENTIALS_FROM_PASSWORD_STORES", technique="T1555.003","CREDENTIALS_FROM_PASSWORD_STORES_CREDENTIALS_FROM_WEB_BROWSERS", technique="T1555.001","CREDENTIALS_FROM_PASSWORD_STORES_KEYCHAIN", technique="T1555.005","CREDENTIALS_FROM_PASSWORD_STORES_PASSWORD_MANAGERS", technique="T1555.002","CREDENTIALS_FROM_PASSWORD_STORES_SECURITYD_MEMORY", technique="T1555.004","CREDENTIALS_FROM_PASSWORD_STORES_WINDOWS_CREDENTIAL_MANAGER", technique="T1485","DATA_DESTRUCTION", technique="T1132","DATA_ENCODING", technique="T1132.002","DATA_ENCODING_NON_STANDARD_ENCODING", technique="T1132.001","DATA_ENCODING_STANDARD_ENCODING", technique="T1486","DATA_ENCRYPTED_FOR_IMPACT", technique="T1565","DATA_MANIPULATION", technique="T1565.003","DATA_MANIPULATION_RUNTIME_DATA_MANIPULATION", technique="T1565.001","DATA_MANIPULATION_STORED_DATA_MANIPULATION", technique="T1565.002","DATA_MANIPULATION_TRANSMITTED_DATA_MANIPULATION", technique="T1001","DATA_OBFUSCATION", technique="T1001.001","DATA_OBFUSCATION_JUNK_DATA", technique="T1001.003","DATA_OBFUSCATION_PROTOCOL_IMPERSONATION", technique="T1001.002","DATA_OBFUSCATION_STEGANOGRAPHY", technique="T1074","DATA_STAGED", technique="T1074.001","DATA_STAGED_LOCAL_DATA_STAGING", technique="T1074.002","DATA_STAGED_REMOTE_DATA_STAGING", technique="T1030","DATA_TRANSFER_SIZE_LIMITS", technique="T1530","DATA_FROM_CLOUD_STORAGE_OBJECT", technique="T1602","DATA_FROM_CONFIGURATION_REPOSITORY", technique="T1602.002","DATA_FROM_CONFIGURATION_REPOSITORY_NETWORK_DEVICE_CONFIGURATION_DUMP", technique="T1602.001","DATA_FROM_CONFIGURATION_REPOSITORY_SNMP", technique="T1213","DATA_FROM_INFORMATION_REPOSITORIES", technique="T1213.003","DATA_FROM_INFORMATION_REPOSITORIES_CODE_REPOSITORIES", technique="T1213.001","DATA_FROM_INFORMATION_REPOSITORIES_CONFLUENCE", technique="T1213.002","DATA_FROM_INFORMATION_REPOSITORIES_SHAREPOINT", technique="T1005","DATA_FROM_LOCAL_SYSTEM", technique="T1039","DATA_FROM_NETWORK_SHARED_DRIVE", technique="T1025","DATA_FROM_REMOVABLE_MEDIA", technique="T1491","DEFACEMENT", technique="T1491.002","DEFACEMENT_EXTERNAL_DEFACEMENT", technique="T1491.001","DEFACEMENT_INTERNAL_DEFACEMENT", technique="T1140","DEOBFUSCATE_DECODE_FILES_OR_INFORMATION", technique="T1610","DEPLOY_CONTAINER", technique="T1587","DEVELOP_CAPABILITIES", technique="T1587.002","DEVELOP_CAPABILITIES_CODE_SIGNING_CERTIFICATES", technique="T1587.003","DEVELOP_CAPABILITIES_DIGITAL_CERTIFICATES", technique="T1587.004","DEVELOP_CAPABILITIES_EXPLOITS", technique="T1587.001","DEVELOP_CAPABILITIES_MALWARE", technique="T1006","DIRECT_VOLUME_ACCESS", technique="T1561","DISK_WIPE", technique="T1561.001","DISK_WIPE_DISK_CONTENT_WIPE", technique="T1561.002","DISK_WIPE_DISK_STRUCTURE_WIPE", technique="T1484","DOMAIN_POLICY_MODIFICATION", technique="T1484.002","DOMAIN_POLICY_MODIFICATION_DOMAIN_TRUST_MODIFICATION", technique="T1484.001","DOMAIN_POLICY_MODIFICATION_GROUP_POLICY_MODIFICATION", technique="T1482","DOMAIN_TRUST_DISCOVERY", technique="T1189","DRIVE_BY_COMPROMISE", technique="T1568","DYNAMIC_RESOLUTION", technique="T1568.003","DYNAMIC_RESOLUTION_DNS_CALCULATION", technique="T1568.002","DYNAMIC_RESOLUTION_DOMAIN_GENERATION_ALGORITHMS", technique="T1568.001","DYNAMIC_RESOLUTION_FAST_FLUX_DNS", technique="T1114","EMAIL_COLLECTION", technique="T1114.003","EMAIL_COLLECTION_EMAIL_FORWARDING_RULE", technique="T1114.001","EMAIL_COLLECTION_LOCAL_EMAIL_COLLECTION", technique="T1114.002","EMAIL_COLLECTION_REMOTE_EMAIL_COLLECTION", technique="T1573","ENCRYPTED_CHANNEL", technique="T1573.002","ENCRYPTED_CHANNEL_ASYMMETRIC_CRYPTOGRAPHY", technique="T1573.001","ENCRYPTED_CHANNEL_SYMMETRIC_CRYPTOGRAPHY", technique="T1499","ENDPOINT_DENIAL_OF_SERVICE", technique="T1499.003","ENDPOINT_DENIAL_OF_SERVICE_APPLICATION_EXHAUSTION_FLOOD", technique="T1499.004","ENDPOINT_DENIAL_OF_SERVICE_APPLICATION_OR_SYSTEM_EXPLOITATION", technique="T1499.001","ENDPOINT_DENIAL_OF_SERVICE_OS_EXHAUSTION_FLOOD", technique="T1499.002","ENDPOINT_DENIAL_OF_SERVICE_SERVICE_EXHAUSTION_FLOOD", technique="T1611","ESCAPE_TO_HOST", technique="T1585","ESTABLISH_ACCOUNTS", technique="T1585.002","ESTABLISH_ACCOUNTS_EMAIL_ACCOUNTS", technique="T1585.001","ESTABLISH_ACCOUNTS_SOCIAL_MEDIA_ACCOUNTS", technique="T1546","EVENT_TRIGGERED_EXECUTION", technique="T1546.008","EVENT_TRIGGERED_EXECUTION_ACCESSIBILITY_FEATURES", technique="T1546.009","EVENT_TRIGGERED_EXECUTION_APPCERT_DLLS", technique="T1546.010","EVENT_TRIGGERED_EXECUTION_APPINIT_DLLS", technique="T1546.011","EVENT_TRIGGERED_EXECUTION_APPLICATION_SHIMMING", technique="T1546.001","EVENT_TRIGGERED_EXECUTION_CHANGE_DEFAULT_FILE_ASSOCIATION", technique="T1546.015","EVENT_TRIGGERED_EXECUTION_COMPONENT_OBJECT_MODEL_HIJACKING", technique="T1546.014","EVENT_TRIGGERED_EXECUTION_EMOND", technique="T1546.012","EVENT_TRIGGERED_EXECUTION_IMAGE_FILE_EXECUTION_OPTIONS_INJECTION", technique="T1546.006","EVENT_TRIGGERED_EXECUTION_LC_LOAD_DYLIB_ADDITION", technique="T1546.007","EVENT_TRIGGERED_EXECUTION_NETSH_HELPER_DLL", technique="T1546.013","EVENT_TRIGGERED_EXECUTION_POWERSHELL_PROFILE", technique="T1546.002","EVENT_TRIGGERED_EXECUTION_SCREENSAVER", technique="T1546.005","EVENT_TRIGGERED_EXECUTION_TRAP", technique="T1546.004","EVENT_TRIGGERED_EXECUTION_UNIX_SHELL_CONFIGURATION_MODIFICATION", technique="T1546.003","MITRE_TECHNIQUE_EVENT_TRIGGERED_EXECUTION_WINDOWS_MANAGEMENT_INSTRUMENTATION_EVENT_SUBSCRIPTION", technique="T1480","EXECUTION_GUARDRAILS", technique="T1480.001","EXECUTION_GUARDRAILS_ENVIRONMENTAL_KEYING", technique="T1048","EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL", technique="T1048.002","MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL_EXFILTRATION_OVER_ASYMMETRIC_ENCRYPTED_NON_C2_PROTOCOL", technique="T1048.001","MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL_EXFILTRATION_OVER_SYMMETRIC_ENCRYPTED_NON_C2_PROTOCOL", technique="T1048.003","MITRE_TECHNIQUE_EXFILTRATION_OVER_ALTERNATIVE_PROTOCOL_EXFILTRATION_OVER_UNENCRYPTED_OBFUSCATED_NON_C2_PROTOCOL", technique="T1041","EXFILTRATION_OVER_C2_CHANNEL", technique="T1011","EXFILTRATION_OVER_OTHER_NETWORK_MEDIUM", technique="T1011.001","EXFILTRATION_OVER_OTHER_NETWORK_MEDIUM_EXFILTRATION_OVER_BLUETOOTH", technique="T1052","EXFILTRATION_OVER_PHYSICAL_MEDIUM", technique="T1052.001","EXFILTRATION_OVER_PHYSICAL_MEDIUM_EXFILTRATION_OVER_USB", technique="T1567","EXFILTRATION_OVER_WEB_SERVICE", technique="T1567.002","EXFILTRATION_OVER_WEB_SERVICE_EXFILTRATION_TO_CLOUD_STORAGE", technique="T1567.001","EXFILTRATION_OVER_WEB_SERVICE_EXFILTRATION_TO_CODE_REPOSITORY", technique="T1190","EXPLOIT_PUBLIC_FACING_APPLICATION", technique="T1203","EXPLOITATION_FOR_CLIENT_EXECUTION", technique="T1212","EXPLOITATION_FOR_CREDENTIAL_ACCESS", technique="T1211","EXPLOITATION_FOR_DEFENSE_EVASION", technique="T1068","EXPLOITATION_FOR_PRIVILEGE_ESCALATION", technique="T1210","EXPLOITATION_OF_REMOTE_SERVICES", technique="T1133","EXTERNAL_REMOTE_SERVICES", technique="T1008","FALLBACK_CHANNELS", technique="T1083","FILE_AND_DIRECTORY_DISCOVERY", technique="T1222","FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION", technique="T1222.002","MITRE_TECHNIQUE_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION_LINUX_AND_MAC_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION", technique="T1222.001","MITRE_TECHNIQUE_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION_WINDOWS_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION", technique="T1495","FIRMWARE_CORRUPTION", technique="T1187","FORCED_AUTHENTICATION", technique="T1606","FORGE_WEB_CREDENTIALS", technique="T1606.002","FORGE_WEB_CREDENTIALS_SAML_TOKENS", technique="T1606.001","FORGE_WEB_CREDENTIALS_WEB_COOKIES", technique="T1592","GATHER_VICTIM_HOST_INFORMATION", technique="T1592.004","GATHER_VICTIM_HOST_INFORMATION_CLIENT_CONFIGURATIONS", technique="T1592.003","GATHER_VICTIM_HOST_INFORMATION_FIRMWARE", technique="T1592.001","GATHER_VICTIM_HOST_INFORMATION_HARDWARE", technique="T1592.002","GATHER_VICTIM_HOST_INFORMATION_SOFTWARE", technique="T1589","GATHER_VICTIM_IDENTITY_INFORMATION", technique="T1589.001","GATHER_VICTIM_IDENTITY_INFORMATION_CREDENTIALS", technique="T1589.002","GATHER_VICTIM_IDENTITY_INFORMATION_EMAIL_ADDRESSES", technique="T1589.003","GATHER_VICTIM_IDENTITY_INFORMATION_EMPLOYEE_NAMES", technique="T1590","GATHER_VICTIM_NETWORK_INFORMATION", technique="T1590.002","GATHER_VICTIM_NETWORK_INFORMATION_DNS", technique="T1590.001","GATHER_VICTIM_NETWORK_INFORMATION_DOMAIN_PROPERTIES", technique="T1590.005","GATHER_VICTIM_NETWORK_INFORMATION_IP_ADDRESSES", technique="T1590.006","GATHER_VICTIM_NETWORK_INFORMATION_NETWORK_SECURITY_APPLIANCES", technique="T1590.004","GATHER_VICTIM_NETWORK_INFORMATION_NETWORK_TOPOLOGY", technique="T1590.003","GATHER_VICTIM_NETWORK_INFORMATION_NETWORK_TRUST_DEPENDENCIES", technique="T1591","GATHER_VICTIM_ORG_INFORMATION", technique="T1591.002","GATHER_VICTIM_ORG_INFORMATION_BUSINESS_RELATIONSHIPS", technique="T1591.001","GATHER_VICTIM_ORG_INFORMATION_DETERMINE_PHYSICAL_LOCATIONS", technique="T1591.003","GATHER_VICTIM_ORG_INFORMATION_IDENTIFY_BUSINESS_TEMPO", technique="T1591.004","GATHER_VICTIM_ORG_INFORMATION_IDENTIFY_ROLES", technique="T1615","GROUP_POLICY_DISCOVERY", technique="T1200","HARDWARE_ADDITIONS", technique="T1564","HIDE_ARTIFACTS", technique="T1564.008","HIDE_ARTIFACTS_EMAIL_HIDING_RULES", technique="T1564.005","HIDE_ARTIFACTS_HIDDEN_FILE_SYSTEM", technique="T1564.001","HIDE_ARTIFACTS_HIDDEN_FILES_AND_DIRECTORIES", technique="T1564.002","HIDE_ARTIFACTS_HIDDEN_USERS", technique="T1564.003","HIDE_ARTIFACTS_HIDDEN_WINDOW", technique="T1564.004","HIDE_ARTIFACTS_NTFS_FILE_ATTRIBUTES", technique="T1564.009","HIDE_ARTIFACTS_RESOURCE_FORKING", technique="T1564.006","HIDE_ARTIFACTS_RUN_VIRTUAL_INSTANCE", technique="T1564.007","HIDE_ARTIFACTS_VBA_STOMPING", technique="T1574","HIJACK_EXECUTION_FLOW", technique="T1574.012","HIJACK_EXECUTION_FLOW_COR_PROFILER", technique="T1574.001","HIJACK_EXECUTION_FLOW_DLL_SEARCH_ORDER_HIJACKING", technique="T1574.002","HIJACK_EXECUTION_FLOW_DLL_SIDE_LOADING", technique="T1574.004","HIJACK_EXECUTION_FLOW_DYLIB_HIJACKING", technique="T1574.006","HIJACK_EXECUTION_FLOW_DYNAMIC_LINKER_HIJACKING", technique="T1574.005","HIJACK_EXECUTION_FLOW_EXECUTABLE_INSTALLER_FILE_PERMISSIONS_WEAKNESS", technique="T1574.007","HIJACK_EXECUTION_FLOW_PATH_INTERCEPTION_BY_PATH_ENVIRONMENT_VARIABLE", technique="T1574.008","HIJACK_EXECUTION_FLOW_PATH_INTERCEPTION_BY_SEARCH_ORDER_HIJACKING", technique="T1574.009","HIJACK_EXECUTION_FLOW_PATH_INTERCEPTION_BY_UNQUOTED_PATH", technique="T1574.010","HIJACK_EXECUTION_FLOW_SERVICES_FILE_PERMISSIONS_WEAKNESS", technique="T1574.011","HIJACK_EXECUTION_FLOW_SERVICES_REGISTRY_PERMISSIONS_WEAKNESS", technique="T1562","IMPAIR_DEFENSES", technique="T1562.008","IMPAIR_DEFENSES_DISABLE_CLOUD_LOGS", technique="T1562.002","IMPAIR_DEFENSES_DISABLE_WINDOWS_EVENT_LOGGING", technique="T1562.007","IMPAIR_DEFENSES_DISABLE_OR_MODIFY_CLOUD_FIREWALL", technique="T1562.004","IMPAIR_DEFENSES_DISABLE_OR_MODIFY_SYSTEM_FIREWALL", technique="T1562.001","IMPAIR_DEFENSES_DISABLE_OR_MODIFY_TOOLS", technique="T1562.010","IMPAIR_DEFENSES_DOWNGRADE_ATTACK", technique="T1562.003","IMPAIR_DEFENSES_IMPAIR_COMMAND_HISTORY_LOGGING", technique="T1562.006","IMPAIR_DEFENSES_INDICATOR_BLOCKING", technique="T1562.009","IMPAIR_DEFENSES_SAFE_MODE_BOOT", technique="T1525","IMPLANT_INTERNAL_IMAGE", technique="T1070","INDICATOR_REMOVAL_ON_HOST", technique="T1070.003","INDICATOR_REMOVAL_ON_HOST_CLEAR_COMMAND_HISTORY", technique="T1070.002","INDICATOR_REMOVAL_ON_HOST_CLEAR_LINUX_OR_MAC_SYSTEM_LOGS", technique="T1070.001","INDICATOR_REMOVAL_ON_HOST_CLEAR_WINDOWS_EVENT_LOGS", technique="T1070.004","INDICATOR_REMOVAL_ON_HOST_FILE_DELETION", technique="T1070.005","INDICATOR_REMOVAL_ON_HOST_NETWORK_SHARE_CONNECTION_REMOVAL", technique="T1070.006","INDICATOR_REMOVAL_ON_HOST_TIMESTOMP", technique="T1202","INDIRECT_COMMAND_EXECUTION", technique="T1105","INGRESS_TOOL_TRANSFER", technique="T1490","INHIBIT_SYSTEM_RECOVERY", technique="T1056","INPUT_CAPTURE", technique="T1056.004","INPUT_CAPTURE_CREDENTIAL_API_HOOKING", technique="T1056.002","INPUT_CAPTURE_GUI_INPUT_CAPTURE", technique="T1056.001","INPUT_CAPTURE_KEYLOGGING", technique="T1056.003","INPUT_CAPTURE_WEB_PORTAL_CAPTURE", technique="T1559","INTER_PROCESS_COMMUNICATION", technique="T1559.001","INTER_PROCESS_COMMUNICATION_COMPONENT_OBJECT_MODEL", technique="T1559.002","INTER_PROCESS_COMMUNICATION_DYNAMIC_DATA_EXCHANGE", technique="T1534","INTERNAL_SPEARPHISHING", technique="T1570","LATERAL_TOOL_TRANSFER", technique="T1036","MASQUERADING", technique="T1036.007","MASQUERADING_DOUBLE_FILE_EXTENSION", technique="T1036.001","MASQUERADING_INVALID_CODE_SIGNATURE", technique="T1036.004","MASQUERADING_MASQUERADE_TASK_OR_SERVICE", technique="T1036.005","MASQUERADING_MATCH_LEGITIMATE_NAME_OR_LOCATION", technique="T1036.003","MASQUERADING_RENAME_SYSTEM_UTILITIES", technique="T1036.002","MASQUERADING_RIGHT_TO_LEFT_OVERRIDE", technique="T1036.006","MASQUERADING_SPACE_AFTER_FILENAME", technique="T1556","MODIFY_AUTHENTICATION_PROCESS", technique="T1556.001","MODIFY_AUTHENTICATION_PROCESS_DOMAIN_CONTROLLER_AUTHENTICATION", technique="T1556.004","MODIFY_AUTHENTICATION_PROCESS_NETWORK_DEVICE_AUTHENTICATION", technique="T1556.002","MODIFY_AUTHENTICATION_PROCESS_PASSWORD_FILTER_DLL", technique="T1556.003","MODIFY_AUTHENTICATION_PROCESS_PLUGGABLE_AUTHENTICATION_MODULES", technique="T1578","MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE", technique="T1578.002","MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_CREATE_CLOUD_INSTANCE", technique="T1578.001","MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_CREATE_SNAPSHOT", technique="T1578.003","MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_DELETE_CLOUD_INSTANCE", technique="T1578.004","MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE_REVERT_CLOUD_INSTANCE", technique="T1112","MODIFY_REGISTRY", technique="T1601","MODIFY_SYSTEM_IMAGE", technique="T1601.002","MODIFY_SYSTEM_IMAGE_DOWNGRADE_SYSTEM_IMAGE", technique="T1601.001","MODIFY_SYSTEM_IMAGE_PATCH_SYSTEM_IMAGE", technique="T1104","MULTI_STAGE_CHANNELS", technique="T1106","NATIVE_API", technique="T1599","NETWORK_BOUNDARY_BRIDGING", technique="T1599.001","NETWORK_BOUNDARY_BRIDGING_NETWORK_ADDRESS_TRANSLATION_TRAVERSAL", technique="T1498","NETWORK_DENIAL_OF_SERVICE", technique="T1498.001","NETWORK_DENIAL_OF_SERVICE_DIRECT_NETWORK_FLOOD", technique="T1498.002","NETWORK_DENIAL_OF_SERVICE_REFLECTION_AMPLIFICATION", technique="T1046","NETWORK_SERVICE_SCANNING", technique="T1135","NETWORK_SHARE_DISCOVERY", technique="T1040","NETWORK_SNIFFING", technique="T1095","NON_APPLICATION_LAYER_PROTOCOL", technique="T1571","NON_STANDARD_PORT", technique="T1003","OS_CREDENTIAL_DUMPING", technique="T1003.008","OS_CREDENTIAL_DUMPING_PASSWD_AND_SHADOW", technique="T1003.005","OS_CREDENTIAL_DUMPING_CACHED_DOMAIN_CREDENTIALS", technique="T1003.006","OS_CREDENTIAL_DUMPING_DCSYNC", technique="T1003.004","OS_CREDENTIAL_DUMPING_LSA_SECRETS", technique="T1003.001","OS_CREDENTIAL_DUMPING_LSASS_MEMORY", technique="T1003.003","OS_CREDENTIAL_DUMPING_NTDS", technique="T1003.007","OS_CREDENTIAL_DUMPING_PROC_FILESYSTEM", technique="T1003.002","OS_CREDENTIAL_DUMPING_SECURITY_ACCOUNT_MANAGER", technique="T1027","OBFUSCATED_FILES_OR_INFORMATION", technique="T1027.001","OBFUSCATED_FILES_OR_INFORMATION_BINARY_PADDING", technique="T1027.004","OBFUSCATED_FILES_OR_INFORMATION_COMPILE_AFTER_DELIVERY", technique="T1027.006","OBFUSCATED_FILES_OR_INFORMATION_HTML_SMUGGLING", technique="T1027.005","OBFUSCATED_FILES_OR_INFORMATION_INDICATOR_REMOVAL_FROM_TOOLS", technique="T1027.002","OBFUSCATED_FILES_OR_INFORMATION_SOFTWARE_PACKING", technique="T1027.003","OBFUSCATED_FILES_OR_INFORMATION_STEGANOGRAPHY", technique="T1588","OBTAIN_CAPABILITIES", technique="T1588.003","OBTAIN_CAPABILITIES_CODE_SIGNING_CERTIFICATES", technique="T1588.004","OBTAIN_CAPABILITIES_DIGITAL_CERTIFICATES", technique="T1588.005","OBTAIN_CAPABILITIES_EXPLOITS", technique="T1588.001","OBTAIN_CAPABILITIES_MALWARE", technique="T1588.002","OBTAIN_CAPABILITIES_TOOL", technique="T1588.006","OBTAIN_CAPABILITIES_VULNERABILITIES", technique="T1137","OFFICE_APPLICATION_STARTUP", technique="T1137.006","OFFICE_APPLICATION_STARTUP_ADD_INS", technique="T1137.001","OFFICE_APPLICATION_STARTUP_OFFICE_TEMPLATE_MACROS", technique="T1137.002","OFFICE_APPLICATION_STARTUP_OFFICE_TEST", technique="T1137.003","OFFICE_APPLICATION_STARTUP_OUTLOOK_FORMS", technique="T1137.004","OFFICE_APPLICATION_STARTUP_OUTLOOK_HOME_PAGE", technique="T1137.005","OFFICE_APPLICATION_STARTUP_OUTLOOK_RULES", technique="T1201","PASSWORD_POLICY_DISCOVERY", technique="T1120","PERIPHERAL_DEVICE_DISCOVERY", technique="T1069","PERMISSION_GROUPS_DISCOVERY", technique="T1069.003","PERMISSION_GROUPS_DISCOVERY_CLOUD_GROUPS", technique="T1069.002","PERMISSION_GROUPS_DISCOVERY_DOMAIN_GROUPS", technique="T1069.001","PERMISSION_GROUPS_DISCOVERY_LOCAL_GROUPS", technique="T1566","PHISHING", technique="T1598","PHISHING_FOR_INFORMATION", technique="T1598.002","PHISHING_FOR_INFORMATION_SPEARPHISHING_ATTACHMENT", technique="T1598.003","PHISHING_FOR_INFORMATION_SPEARPHISHING_LINK", technique="T1598.001","PHISHING_FOR_INFORMATION_SPEARPHISHING_SERVICE", technique="T1566.001","PHISHING_SPEARPHISHING_ATTACHMENT", technique="T1566.002","PHISHING_SPEARPHISHING_LINK", technique="T1566.003","PHISHING_SPEARPHISHING_VIA_SERVICE", technique="T1542","PRE_OS_BOOT", technique="T1542.003","PRE_OS_BOOT_BOOTKIT", technique="T1542.002","PRE_OS_BOOT_COMPONENT_FIRMWARE", technique="T1542.004","PRE_OS_BOOT_ROMMONKIT", technique="T1542.001","PRE_OS_BOOT_SYSTEM_FIRMWARE", technique="T1542.005","PRE_OS_BOOT_TFTP_BOOT", technique="T1057","PROCESS_DISCOVERY", technique="T1055","PROCESS_INJECTION", technique="T1055.004","PROCESS_INJECTION_ASYNCHRONOUS_PROCEDURE_CALL", technique="T1055.001","PROCESS_INJECTION_DYNAMIC_LINK_LIBRARY_INJECTION", technique="T1055.011","PROCESS_INJECTION_EXTRA_WINDOW_MEMORY_INJECTION", technique="T1055.002","PROCESS_INJECTION_PORTABLE_EXECUTABLE_INJECTION", technique="T1055.009","PROCESS_INJECTION_PROC_MEMORY", technique="T1055.013","PROCESS_INJECTION_PROCESS_DOPPELGANGING", technique="T1055.012","PROCESS_INJECTION_PROCESS_HOLLOWING", technique="T1055.008","PROCESS_INJECTION_PTRACE_SYSTEM_CALLS", technique="T1055.003","PROCESS_INJECTION_THREAD_EXECUTION_HIJACKING", technique="T1055.005","PROCESS_INJECTION_THREAD_LOCAL_STORAGE", technique="T1055.014","PROCESS_INJECTION_VDSO_HIJACKING", technique="T1572","PROTOCOL_TUNNELING", technique="T1090","PROXY", technique="T1090.004","PROXY_DOMAIN_FRONTING", technique="T1090.002","PROXY_EXTERNAL_PROXY", technique="T1090.001","PROXY_INTERNAL_PROXY", technique="T1090.003","PROXY_MULTI_HOP_PROXY", technique="T1012","QUERY_REGISTRY", technique="T1620","REFLECTIVE_CODE_LOADING", technique="T1219","REMOTE_ACCESS_SOFTWARE", technique="T1563","REMOTE_SERVICE_SESSION_HIJACKING", technique="T1563.002","REMOTE_SERVICE_SESSION_HIJACKING_RDP_HIJACKING", technique="T1563.001","REMOTE_SERVICE_SESSION_HIJACKING_SSH_HIJACKING", technique="T1021","REMOTE_SERVICES", technique="T1021.003","REMOTE_SERVICES_DISTRIBUTED_COMPONENT_OBJECT_MODEL", technique="T1021.001","REMOTE_SERVICES_REMOTE_DESKTOP_PROTOCOL", technique="T1021.002","REMOTE_SERVICES_SMB_OR_ADMIN_SHARES", technique="T1021.004","REMOTE_SERVICES_SSH", technique="T1021.005","REMOTE_SERVICES_VNC", technique="T1021.006","REMOTE_SERVICES_WINDOWS_REMOTE_MANAGEMENT", technique="T1018","REMOTE_SYSTEM_DISCOVERY", technique="T1091","REPLICATION_THROUGH_REMOVABLE_MEDIA", technique="T1496","RESOURCE_HIJACKING", technique="T1207","ROGUE_DOMAIN_CONTROLLER", technique="T1014","ROOTKIT", technique="T1053","SCHEDULED_TASK", technique="T1053.001","SCHEDULED_TASK_LINUX_AT_JOB", technique="T1053.002","SCHEDULED_TASK_WINDOWS_AT_JOB", technique="T1053.007","SCHEDULED_TASK_OR_CONTAINER_ORCHESTRATION_JOB", technique="T1053.003","SCHEDULED_TASK_OR_CRON_JOB", technique="T1053.006","SCHEDULED_TASK_OR_SYSTEMD_TIMERS", technique="T1029","SCHEDULED_TRANSFER", technique="T1113","SCREEN_CAPTURE", technique="T1597","SEARCH_CLOSED_SOURCES", technique="T1597.002","SEARCH_CLOSED_SOURCES_PURCHASE_TECHNICAL_DATA", technique="T1597.001","SEARCH_CLOSED_SOURCES_THREAT_INTEL_VENDORS", technique="T1596","SEARCH_OPEN_TECHNICAL_DATABASES", technique="T1596.004","SEARCH_OPEN_TECHNICAL_DATABASES_CDNS", technique="T1596.001","SEARCH_OPEN_TECHNICAL_DATABASES_DNS_OR_PASSIVE_DNS", technique="T1596.003","SEARCH_OPEN_TECHNICAL_DATABASES_DIGITAL_CERTIFICATES", technique="T1596.005","SEARCH_OPEN_TECHNICAL_DATABASES_SCAN_DATABASES", technique="T1596.002","SEARCH_OPEN_TECHNICAL_DATABASES_WHOIS", technique="T1593","SEARCH_OPEN_WEBSITES_DOMAINS", technique="T1593.002","SEARCH_OPEN_WEBSITES_DOMAINS_SEARCH_ENGINES", technique="T1593.001","SEARCH_OPEN_WEBSITES_OR_DOMAINS_SOCIAL_MEDIA", technique="T1594","SEARCH_VICTIM_OWNED_WEBSITES", technique="T1505","SERVER_SOFTWARE_COMPONENT", technique="T1505.004","SERVER_SOFTWARE_COMPONENT_IIS_COMPONENTS", technique="T1505.001","SERVER_SOFTWARE_COMPONENT_SQL_STORED_PROCEDURES", technique="T1505.002","SERVER_SOFTWARE_COMPONENT_TRANSPORT_AGENT", technique="T1505.003","SERVER_SOFTWARE_COMPONENT_WEB_SHELL", technique="T1489","SERVICE_STOP", technique="T1129","SHARED_MODULES", technique="T1218","SIGNED_BINARY_PROXY_EXECUTION", technique="T1218.003","SIGNED_BINARY_PROXY_EXECUTION_CMSTP", technique="T1218.001","SIGNED_BINARY_PROXY_EXECUTION_COMPILED_HTML_FILE", technique="T1218.002","SIGNED_BINARY_PROXY_EXECUTION_CONTROL_PANEL", technique="T1218.004","SIGNED_BINARY_PROXY_EXECUTION_INSTALLUTIL", technique="T1218.014","SIGNED_BINARY_PROXY_EXECUTION_MMC", technique="T1218.013","SIGNED_BINARY_PROXY_EXECUTION_MAVINJECT", technique="T1218.005","SIGNED_BINARY_PROXY_EXECUTION_MSHTA", technique="T1218.007","SIGNED_BINARY_PROXY_EXECUTION_MSIEXEC", technique="T1218.008","SIGNED_BINARY_PROXY_EXECUTION_ODBCCONF", technique="T1218.009","SIGNED_BINARY_PROXY_EXECUTION_REGSVCS_OR_REGASM", technique="T1218.010","SIGNED_BINARY_PROXY_EXECUTION_REGSVR32", technique="T1218.011","SIGNED_BINARY_PROXY_EXECUTION_RUNDLL32", technique="T1218.012","SIGNED_BINARY_PROXY_EXECUTION_VERCLSID", technique="T1216","SIGNED_SCRIPT_PROXY_EXECUTION", technique="T1216.001","SIGNED_SCRIPT_PROXY_EXECUTION_PUBPRN", technique="T1072","SOFTWARE_DEPLOYMENT_TOOLS", technique="T1518","SOFTWARE_DISCOVERY", technique="T1518.001","SOFTWARE_DISCOVERY_SECURITY_SOFTWARE_DISCOVERY", technique="T1608","STAGE_CAPABILITIES", technique="T1608.004","STAGE_CAPABILITIES_DRIVE_BY_TARGET", technique="T1608.003","STAGE_CAPABILITIES_INSTALL_DIGITAL_CERTIFICATE", technique="T1608.005","STAGE_CAPABILITIES_LINK_TARGET", technique="T1608.001","STAGE_CAPABILITIES_UPLOAD_MALWARE", technique="T1608.002","STAGE_CAPABILITIES_UPLOAD_TOOL", technique="T1528","STEAL_APPLICATION_ACCESS_TOKEN", technique="T1539","STEAL_WEB_SESSION_COOKIE", technique="T1558","STEAL_OR_FORGE_KERBEROS_TICKETS", technique="T1558.004","STEAL_OR_FORGE_KERBEROS_TICKETS_AS_REP_ROASTING", technique="T1558.001","STEAL_OR_FORGE_KERBEROS_TICKETS_GOLDEN_TICKET", technique="T1558.003","STEAL_OR_FORGE_KERBEROS_TICKETS_KERBEROASTING", technique="T1558.002","STEAL_OR_FORGE_KERBEROS_TICKETS_SILVER_TICKET", technique="T1553","SUBVERT_TRUST_CONTROLS", technique="T1553.002","SUBVERT_TRUST_CONTROLS_CODE_SIGNING", technique="T1553.006","SUBVERT_TRUST_CONTROLS_CODE_SIGNING_POLICY_MODIFICATION", technique="T1553.001","SUBVERT_TRUST_CONTROLS_GATEKEEPER_BYPASS", technique="T1553.004","SUBVERT_TRUST_CONTROLS_INSTALL_ROOT_CERTIFICATE", technique="T1553.005","SUBVERT_TRUST_CONTROLS_MARK_OF_THE_WEB_BYPASS", technique="T1553.003","SUBVERT_TRUST_CONTROLS_SIP_AND_TRUST_PROVIDER_HIJACKING", technique="T1195","SUPPLY_CHAIN_COMPROMISE", technique="T1195.003","SUPPLY_CHAIN_COMPROMISE_COMPROMISE_HARDWARE_SUPPLY_CHAIN", technique="T1195.001","MITRE_TECHNIQUE_SUPPLY_CHAIN_COMPROMISE_COMPROMISE_SOFTWARE_DEPENDENCIES_AND_DEVELOPMENT_TOOLS", technique="T1195.002","SUPPLY_CHAIN_COMPROMISE_COMPROMISE_SOFTWARE_SUPPLY_CHAIN", technique="T1082","SYSTEM_INFORMATION_DISCOVERY", technique="T1614","SYSTEM_LOCATION_DISCOVERY", technique="T1614.001","SYSTEM_LOCATION_DISCOVERY_SYSTEM_LANGUAGE_DISCOVERY", technique="T1016","SYSTEM_NETWORK_CONFIGURATION_DISCOVERY", technique="T1016.001","SYSTEM_NETWORK_CONFIGURATION_DISCOVERY_INTERNET_CONNECTION_DISCOVERY", technique="T1049","SYSTEM_NETWORK_CONNECTIONS_DISCOVERY", technique="T1033","SYSTEM_OWNER_USER_DISCOVERY", technique="T1007","SYSTEM_SERVICE_DISCOVERY", technique="T1569","SYSTEM_SERVICES", technique="T1569.001","SYSTEM_SERVICES_LAUNCHCTL", technique="T1569.002","SYSTEM_SERVICES_SERVICE_EXECUTION", technique="T1529","SYSTEM_SHUTDOWN_OR_REBOOT", technique="T1124","SYSTEM_TIME_DISCOVERY", technique="T1080","TAINT_SHARED_CONTENT", technique="T1221","TEMPLATE_INJECTION", technique="T1205","TRAFFIC_SIGNALING", technique="T1205.001","TRAFFIC_SIGNALING_PORT_KNOCKING", technique="T1537","TRANSFER_DATA_TO_CLOUD_ACCOUNT", technique="T1127","TRUSTED_DEVELOPER_UTILITIES_PROXY_EXECUTION", technique="T1127.001","TRUSTED_DEVELOPER_UTILITIES_PROXY_EXECUTION_MSBUILD", technique="T1199","TRUSTED_RELATIONSHIP", technique="T1111","TWO_FACTOR_AUTHENTICATION_INTERCEPTION", technique="T1552","UNSECURED_CREDENTIALS", technique="T1552.003","UNSECURED_CREDENTIALS_BASH_HISTORY", technique="T1552.005","UNSECURED_CREDENTIALS_CLOUD_INSTANCE_METADATA_API", technique="T1552.007","UNSECURED_CREDENTIALS_CONTAINER_API", technique="T1552.001","UNSECURED_CREDENTIALS_CREDENTIALS_IN_FILES", technique="T1552.002","UNSECURED_CREDENTIALS_CREDENTIALS_IN_REGISTRY", technique="T1552.006","UNSECURED_CREDENTIALS_GROUP_POLICY_PREFERENCES", technique="T1552.004","UNSECURED_CREDENTIALS_PRIVATE_KEYS", technique="T1535","UNSUPPORTED_CLOUD_REGIONS", technique="T1550","USE_ALTERNATE_AUTHENTICATION_MATERIAL", technique="T1550.001","USE_ALTERNATE_AUTHENTICATION_MATERIAL_APPLICATION_ACCESS_TOKEN", technique="T1550.002","USE_ALTERNATE_AUTHENTICATION_MATERIAL_PASS_THE_HASH", technique="T1550.003","USE_ALTERNATE_AUTHENTICATION_MATERIAL_PASS_THE_TICKET", technique="T1550.004","USE_ALTERNATE_AUTHENTICATION_MATERIAL_WEB_SESSION_COOKIE", technique="T1204","USER_EXECUTION", technique="T1204.002","USER_EXECUTION_MALICIOUS_FILE", technique="T1204.003","USER_EXECUTION_MALICIOUS_IMAGE", technique="T1204.001","USER_EXECUTION_MALICIOUS_LINK", technique="T1078","VALID_ACCOUNTS", technique="T1078.004","VALID_ACCOUNTS_CLOUD_ACCOUNTS", technique="T1078.001","VALID_ACCOUNTS_DEFAULT_ACCOUNTS", technique="T1078.002","VALID_ACCOUNTS_DOMAIN_ACCOUNTS", technique="T1078.003","VALID_ACCOUNTS_LOCAL_ACCOUNTS", technique="T1125","VIDEO_CAPTURE", technique="T1497","SANDBOX_EVASION", technique="T1497.001","SANDBOX_EVASION_SYSTEM_CHECKS", technique="T1497.003","SANDBOX_EVASION_TIME_BASED_EVASION", technique="T1497.002","SANDBOX_EVASION_USER_ACTIVITY_BASED_CHECKS", technique="T1600","WEAKEN_ENCRYPTION", technique="T1600.002","WEAKEN_ENCRYPTION_DISABLE_CRYPTO_HARDWARE", technique="T1600.001","WEAKEN_ENCRYPTION_REDUCE_KEY_SPACE", technique="T1102","WEB_SERVICE", technique="T1102.002","WEB_SERVICE_BIDIRECTIONAL_COMMUNICATION", technique="T1102.001","WEB_SERVICE_DEAD_DROP_RESOLVER", technique="T1102.003","WEB_SERVICE_ONE_WAY_COMMUNICATION", technique="T1047","WINDOWS_MANAGEMENT_INSTRUMENTATION", technique="T1220","XSL_SCRIPT_PROCESSING", null)),
xdm.observer.action = json_extract_scalar(mitigationStatus, "$.0.action"),
xdm.source.process.executable.path = json_extract_scalar(threatInfo, "$.filePath"),
xdm.source.process.executable.md5 = json_extract_scalar(threatInfo, "$.md5"),
xdm.source.process.executable.sha256 = json_extract_scalar(threatInfo, "$.sha256"),
xdm.alert.original_threat_name = json_extract_scalar(threatInfo, "$.threatName");
filter eventType = "Alert"
| alter
osFamily = json_extract_scalar(agentDetectionInfo, "$.osFamily"),
loginType = json_extract_scalar(alertInfo, "$.loginType"),
lower_tgtProcIntegrityLevel = lowercase(json_extract_scalar(targetProcessInfo, "$.tgtProcIntegrityLevel"))
| alter
xdm.event.type = eventType,
xdm.source.host.hostname = json_extract_scalar(agentDetectionInfo, "$.name"),
xdm.source.host.os_family = if(
osFamily~="[Ll]inux",XDM_CONST.OS_FAMILY_LINUX,
osFamily~="[Mm]acos|osx", XDM_CONST.OS_FAMILY_MACOS,
osFamily~="[Ww]indows", XDM_CONST.OS_FAMILY_WINDOWS),
xdm.source.host.os = json_extract_scalar(agentDetectionInfo, "$.osName"),
xdm.source.agent.identifier = json_extract_scalar(agentDetectionInfo, "$.uuid"),
xdm.source.agent.version = json_extract_scalar(agentDetectionInfo, "$.version"),
xdm.alert.original_alert_id = json_extract_scalar(alertInfo, "$.alertId"),
xdm.network.dns.dns_resource_record.value = json_extract_scalar(alertInfo, "$.dnsResponse"),
xdm.network.http.url = json_extract_scalar(alertInfo, "$.dnsRequest"),
xdm.target.ipv4 = json_extract_scalar(alertInfo, "$.dstIp"),
xdm.target.port = to_integer(json_extract_scalar(alertInfo, "$.dstPort")),
xdm.event.operation_sub_type = json_extract_scalar(alertInfo, "$.eventType"),
xdm.source.user.domain = json_extract_scalar(alertInfo, "$.loginAccountDomain"),
xdm.source.user.identifier = json_extract_scalar(alertInfo, "$.loginAccountSid"),
xdm.logon.type = if(
loginType IN("SYSTEM", "SERVICE"), XDM_CONST.LOGON_TYPE_SERVICE,
loginType="INTERACTIVE", XDM_CONST.LOGON_TYPE_INTERACTIVE,
loginType="NETWORK", XDM_CONST.LOGON_TYPE_NETWORK,
loginType="BATCH", XDM_CONST.LOGON_TYPE_BATCH,
loginType="UNLOCK", XDM_CONST.LOGON_TYPE_UNLOCK,
loginType="NETWORK_CREDENTIALS", XDM_CONST.LOGON_TYPE_NEW_CREDENTIALS,
loginType="NETWORK_CLEAR_TEXT", XDM_CONST.LOGON_TYPE_NETWORK_CLEARTEXT,
loginType="REMOTE_INTERACTIVE", XDM_CONST.LOGON_TYPE_REMOTE_INTERACTIVE,
loginType="CACHED_INTERACTIVE", XDM_CONST.LOGON_TYPE_CACHED_INTERACTIVE,
loginType="CACHED_REMOTE_INTERACTIVE", XDM_CONST.LOGON_TYPE_CACHED_REMOTE_INTERACTIVE,
loginType="CACHED_UNLOCK", XDM_CONST.LOGON_TYPE_CACHED_UNLOCK,
loginType),
xdm.source.user.username = json_extract_scalar(sourceParentProcessInfo, "$.user"),
xdm.source.ipv4 = json_extract_scalar(alertInfo, "$.srcIp"),
xdm.source.port = to_integer(json_extract_scalar(alertInfo, "$.srcPort")),
xdm.source.process.container_id = json_extract_scalar(containerInfo, "$.id"),
xdm.event.description = json_extract_scalar(ruleInfo, "$.description"),
xdm.alert.severity = json_extract_scalar(ruleInfo, "$.severity"),
xdm.source.process.command_line = json_extract_scalar(sourceProcessInfo, "$.commandline"),
xdm.source.process.executable.md5 = json_extract_scalar(sourceProcessInfo, "$.fileHashMd5"),
xdm.source.process.executable.sha256 = json_extract_scalar(sourceProcessInfo, "$.fileHashSha256"),
xdm.source.process.executable.path = json_extract_scalar(sourceProcessInfo, "$.filePath"),
xdm.source.process.name = json_extract_scalar(sourceProcessInfo, "$.name"),
xdm.source.process.pid = to_integer(json_extract_scalar(sourceProcessInfo, "$.pid")),
xdm.source.process.parent_id = json_extract_scalar(sourceParentProcessInfo, "$.pid"),
xdm.target.process.executable.sha256 = json_extract_scalar(targetProcessInfo, "$.tgtFileHashSha256"),
xdm.target.file.path = json_extract_scalar(targetProcessInfo, "$.tgtFilePath"),
xdm.target.file_before.path = json_extract_scalar(targetProcessInfo, "$.tgtFileOldPath"),
xdm.target.process.command_line = json_extract_scalar(targetProcessInfo, "$.tgtProcCmdLine"),
xdm.target.process.executable.filename = json_extract_scalar(targetProcessInfo, "$.tgtProcName"),
xdm.target.process.integrity_level = if(lower_tgtProcIntegrityLevel = "protected", 20480,
lower_tgtProcIntegrityLevel = "system", 16384,
lower_tgtProcIntegrityLevel = "high", 12288,
lower_tgtProcIntegrityLevel = "medium_plus", 8448,
lower_tgtProcIntegrityLevel = "medium", 8192,
lower_tgtProcIntegrityLevel = "low", 4096,
lower_tgtProcIntegrityLevel = "untrusted", 0,
null),
xdm.target.process.pid = to_integer(json_extract_scalar(targetProcessInfo, "$.tgtProcPid"));