Linux Auditd Clipboard Data Copy
Clipboard Data
Collection
Detect Renamed 7-Zip
Archive via Utility, Archive Collected Data
Detect Renamed 7-Zip
Archive via Utility, Archive Collected Data
Detect Renamed WinRAR
Archive via Utility, Archive Collected Data
Detect Renamed WinRAR
Archive via Utility, Archive Collected Data
Detect Port Security Violation
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Detect Port Security Violation
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
O365 Suspicious User Email Forwarding
Email Forwarding Rule, Email Collection
O365 Suspicious User Email Forwarding
Email Forwarding Rule, Email Collection
Anomalous usage of 7zip
Archive via Utility, Archive Collected Data
Anomalous usage of 7zip
Archive via Utility, Archive Collected Data
Detect ARP Poisoning
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Detect ARP Poisoning
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Linux Clipboard Data Copy
Clipboard Data
Detect Rogue DHCP Server
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle
Azure AD Concurrent Sessions From Different Ips
Browser Session Hijacking
Windows Post Exploitation Risk Behavior
Query Registry, System Network Connections Discovery, Permission Groups Discovery, System Network Configuration Discovery, OS Credential Dumping, System Info...
O365 New Email Forwarding Rule Created
Email Collection, Email Forwarding Rule
O365 New Email Forwarding Rule Created
Email Collection, Email Forwarding Rule
Windows Screen Capture Via Powershell
Screen Capture
O365 New Forwarding Mailflow Rule Created
Email Collection
Suspicious SQLite3 LSQuarantine Behavior
Data Staged
AWS Exfiltration via DataSync Task
Automated Collection
Detect Certipy File Modifications
Steal or Forge Authentication Certificates, Archive Collected Data
Windows Archive Collected Data via Powershell
Archive Collected Data
O365 Concurrent Sessions From Different Ips
Browser Session Hijacking
ASL AWS Concurrent Sessions From Different Ips
Browser Session Hijacking
O365 Compliance Content Search Exported
Email Collection, Remote Email Collection
O365 Compliance Content Search Exported
Email Collection, Remote Email Collection
Remcos RAT File Creation in Remcos Folder
Screen Capture
O365 Mailbox Email Forwarding Enabled
Email Collection, Email Forwarding Rule
O365 Mailbox Email Forwarding Enabled
Email Collection, Email Forwarding Rule
O365 New Email Forwarding Rule Enabled
Email Collection, Email Forwarding Rule
O365 New Email Forwarding Rule Enabled
Email Collection, Email Forwarding Rule
AWS Exfiltration via Batch Service
Automated Collection
Windows Archive Collected Data via Rar
Archive via Utility, Archive Collected Data
Windows Archive Collected Data via Rar
Archive via Utility, Archive Collected Data
Suspicious WAV file in Appdata Folder
Screen Capture
Sqlite Module In Temp Folder
Data from Local System
Detect S3 access from a new IP
Data from Cloud Storage
Detect New Open S3 Buckets over AWS CLI
Data from Cloud Storage
Detect New Open S3 buckets
Data from Cloud Storage
O365 OAuth App Mailbox Access via Graph API
Remote Email Collection
Email servers sending high volume traffic to hosts
Email Collection, Remote Email Collection
Email servers sending high volume traffic to hosts
Email Collection, Remote Email Collection
O365 Mailbox Inbox Folder Shared with All Users
Email Collection, Remote Email Collection
O365 Mailbox Inbox Folder Shared with All Users
Email Collection, Remote Email Collection
IcedID Exfiltrated Archived File Creation
Archive via Utility, Archive Collected Data
IcedID Exfiltrated Archived File Creation
Archive via Utility, Archive Collected Data
Detect New Open GCP Storage Buckets
Data from Cloud Storage
7zip CommandLine To SMB Share Path
Archive via Utility, Archive Collected Data
7zip CommandLine To SMB Share Path
Archive via Utility, Archive Collected Data
O365 Multiple Mailboxes Accessed via API
Remote Email Collection
O365 PST export alert
Email Collection
O365 Compliance Content Search Started
Email Collection, Remote Email Collection
O365 Compliance Content Search Started
Email Collection, Remote Email Collection
AWS Exfiltration via Anomalous GetObject API Activity
Automated Collection
Email files written outside of the Outlook directory
Email Collection, Local Email Collection
Email files written outside of the Outlook directory
Email Collection, Local Email Collection
Hosts receiving high volume of network traffic from email server
Remote Email Collection, Email Collection
Hosts receiving high volume of network traffic from email server
Remote Email Collection, Email Collection
AWS Concurrent Sessions From Different Ips
Browser Session Hijacking
O365 OAuth App Mailbox Access via EWS
Remote Email Collection
Detect GCP Storage access from a new IP
Data from Cloud Storage
O365 Mailbox Read Access Granted to Application
Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles
O365 Mailbox Read Access Granted to Application
Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles
Suspicious Image Creation In Appdata Folder
Screen Capture
Detect IPv6 Network Infrastructure Threats
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Detect IPv6 Network Infrastructure Threats
Hardware Additions, Network Denial of Service, Adversary-in-the-Middle, ARP Cache Poisoning
Windows ClipBoard Data via Get-ClipBoard
Clipboard Data
Windows Input Capture Using Credential UI Dll
GUI Input Capture, Input Capture
Windows Input Capture Using Credential UI Dll
GUI Input Capture, Input Capture
Mailsniper Invoke functions
Email Collection, Local Email Collection
Mailsniper Invoke functions
Email Collection, Local Email Collection
Detect Spike in S3 Bucket deletion
Data from Cloud Storage
O365 Email Access By Security Administrator
Exfiltration Over Web Service, Email Collection, Remote Email Collection
O365 Email Access By Security Administrator
Exfiltration Over Web Service, Email Collection, Remote Email Collection
O365 Email Suspicious Behavior Alert
Email Collection, Email Forwarding Rule
O365 Email Suspicious Behavior Alert
Email Collection, Email Forwarding Rule
Windows Screen Capture Via Powershell
Screen Capture
Windows Network Share Interaction With Net
Network Share Discovery, Data from Network Shared Drive
Anomalous usage of Archive Tools
Archive via Utility, Archive Collected Data
Anomalous usage of Archive Tools
Archive via Utility, Archive Collected Data
O365 Suspicious Admin Email Forwarding
Email Forwarding Rule, Email Collection
O365 Suspicious Admin Email Forwarding
Email Forwarding Rule, Email Collection
O365 Suspicious Rights Delegation
Remote Email Collection, Email Collection, Additional Email Delegate Permissions, Account Manipulation
O365 Suspicious Rights Delegation
Remote Email Collection, Email Collection, Additional Email Delegate Permissions, Account Manipulation