{ "summary": { "total_techniques": 152, "total_rules": 836, "rules_per_platform": { "sigma": 227, "elastic": 58, "splunk": 66, "microsoft-sentinel": 150, "wazuh": 187, "carbonblack": 142, "falcon": 2, "sentinelone": 2, "falco": 2 }, "fully_covered": 0, "single_platform_only": 0 }, "techniques": { "T1003": { "name": "OS Credential Dumping", "tactic": "credential-access", "detections": { "sigma": [ "sigma/linux/lnx_access_to__etc_shadow_or__etc_passwd_for_credential_har.yml", "sigma/windows/win_credential_dump_indicators.yml", "sigma/windows/win_ntds_dit_access.yml", "sigma/windows/win_sam_registry_dump.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_084_obj_access_lsass.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1003.001": { "name": "LSASS Memory", "tactic": "credential-access", "detections": { "sigma": [ "sigma/windows/win_credential_dump_indicators.yml", "sigma/windows/win_lsass_dump_via_procdump.yml", "sigma/windows/win_mimikatz_command.yml", "sigma/windows/win_suspicious_comsvcs_lsass_dump.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_029_reg_mod_wdigest.kql", "microsoft-sentinel/kql_084_obj_access_lsass.kql" ], "wazuh": [ "wazuh/rules/mimikatz_usage.xml", "wazuh/rules/win_suspicious_process_lsass.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_mimikatz_exe.json", "carbonblack/rules/cb_childproc_creation_procdump_exe.json", "carbonblack/rules/cb_file_modification_mimikatz_exe.json", "carbonblack/rules/cb_file_modification_procdump_exe.json", "carbonblack/rules/cb_filemod_lsass_dump_dmp.json", "carbonblack/rules/cb_network_connection_mimikatz_exe.json", "carbonblack/rules/cb_network_connection_procdump_exe.json", "carbonblack/rules/cb_process_creation_mimikatz_exe.json", "carbonblack/rules/cb_process_creation_procdump_exe.json", "carbonblack/rules/cb_registry_modification_mimikatz_exe.json", "carbonblack/rules/cb_registry_modification_procdump_exe.json" ], "falcon": [], "sentinelone": [ "sentinelone/win_suspicious_lsass_access.s1ql" ], "falco": [] }, "gaps": [ "elastic", "splunk", "falcon", "falco" ], "coverage_count": 5 }, "T1003.002": { "name": "Security Account Manager", "tactic": "credential-access", "detections": { "sigma": [ "sigma/windows/win_sam_registry_dump.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_083_obj_access_sam.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1003.003": { "name": "NTDS", "tactic": "credential-access", "detections": { "sigma": [ "sigma/windows/win_ntds_dit_access.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_087_obj_access_ntds.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1003.008": { "name": "/etc/passwd and /etc/shadow", "tactic": "credential-access", "detections": { "sigma": [ "sigma/linux/lnx_access_to__etc_shadow_or__etc_passwd_for_credential_har.yml" ], "elastic": [], "splunk": [ "splunk/linux/lnx_suspicious_passwd_mod.spl" ], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/lnx_passwd_file_modified.xml", "wazuh/rules/lnx_shadow_file_modified.xml", "wazuh/rules/shadow_file_access.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1005": { "name": "Data from Local System", "tactic": "collection", "detections": { "sigma": [ "sigma/windows/win_sensitive_file_access.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_081_obj_access_file.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1012": { "name": "Query Registry", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_query_registry_for_system_information.yml" ], "elastic": [ "elastic/endpoint/general/Registry Manipulation via WMI Stdregprov.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_082_obj_access_registry.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1016": { "name": "System Network Configuration Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_system_network_configuration_discovery.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect Curly COMrades A New Threat Actor Targeting Geopolitical Hotbeds.ndjson" ], "splunk": [ "splunk/windows/win_system_network_configuration_discovery.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_104_system_network_configuration_discovery.kql" ], "wazuh": [ "wazuh/rules/system_network_configuration_discovery.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1021": { "name": "Remote Services", "tactic": "lateral-movement", "detections": { "sigma": [ "sigma/correlations/lateral_movement_spray.yml", "sigma/linux/lnx_ssh_lateral_movement.yml", "sigma/windows/win_smb_windows_admin_share_access.yml" ], "elastic": [ "elastic/endpoint/network/net_suspicious_rdp.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_015_net_conn_telnet.kql", "microsoft-sentinel/kql_055_logon_rdp.kql", "microsoft-sentinel/kql_056_logon_network.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1021.001": { "name": "Remote Desktop Protocol", "tactic": "lateral-movement", "detections": { "sigma": [ "sigma/windows/win_plink_rdp_tunnel.yml" ], "elastic": [ "elastic/endpoint/network/net_suspicious_rdp.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_012_net_conn_rdp.kql", "microsoft-sentinel/kql_028_reg_mod_rdp.kql", "microsoft-sentinel/kql_055_logon_rdp.kql" ], "wazuh": [ "wazuh/rules/net_suspicious_port_3389_outbound.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1021.002": { "name": "SMB/Windows Admin Shares", "tactic": "lateral-movement", "detections": { "sigma": [ "sigma/windows/win_smb_windows_admin_share_access.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_016_net_conn_smb.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_psexec_exe.json", "carbonblack/rules/cb_file_modification_psexec_exe.json", "carbonblack/rules/cb_network_connection_psexec_exe.json", "carbonblack/rules/cb_process_creation_psexec_exe.json", "carbonblack/rules/cb_registry_modification_psexec_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1021.004": { "name": "SSH", "tactic": "lateral-movement", "detections": { "sigma": [ "sigma/linux/lnx_ssh_lateral_movement.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_013_net_conn_ssh.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1027": { "name": "Obfuscated Files or Information", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/linux/lnx_base64_decoding.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_endpoint_win_powershell_suspicious_encoded_command.kql" ], "wazuh": [ "wazuh/rules/base64_decoding.xml", "wazuh/rules/win_suspicious_process_cmd_encoded.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1029": { "name": "Scheduled Transfer", "tactic": "exfiltration", "detections": { "sigma": [ "sigma/windows/win_scheduled_data_transfer_to_external.yml" ], "elastic": [ "elastic/endpoint/general/Scheduled Transfer.ndjson", "elastic/endpoint/general/Time Based Evasion.ndjson" ], "splunk": [ "splunk/windows/win_scheduled_transfer.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_105_scheduled_transfer.kql" ], "wazuh": [ "wazuh/rules/scheduled_transfer.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1033": { "name": "System Owner/User Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_system_owner_user_discovery.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_suspicious_whoami.spl" ], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1036": { "name": "Masquerading", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_masquerading___executable_in_suspicious_path.yml" ], "elastic": [ "elastic/endpoint/general/Defense-Evasion-Dll-Sideloading.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_031_file_create_exe_temp.kql", "microsoft-sentinel/kql_039_file_create_scr.kql", "microsoft-sentinel/kql_040_file_create_pif.kql", "microsoft-sentinel/kql_066_schtask_suspicious_name.kql", "microsoft-sentinel/kql_076_service_suspicious_path.kql", "microsoft-sentinel/kql_077_service_suspicious_name.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_suspicious_app_exe.json", "carbonblack/rules/cb_file_modification_suspicious_app_exe.json", "carbonblack/rules/cb_network_connection_suspicious_app_exe.json", "carbonblack/rules/cb_process_creation_suspicious_app_exe.json", "carbonblack/rules/cb_registry_modification_suspicious_app_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1041": { "name": "Exfiltration Over C2 Channel", "tactic": "exfiltration", "detections": { "sigma": [ "sigma/windows/win_data_exfiltration_over_c2_channel_indicators.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect Curly COMrades A New Threat Actor Targeting Geopolitical Hotbeds.ndjson" ], "splunk": [ "splunk/windows/win_exfiltration_over_c2_channel.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_106_exfiltration_over_c2_channel.kql" ], "wazuh": [ "wazuh/rules/exfiltration_over_c2_channel.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1046": { "name": "Network Service Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/network/net_nmap_scan_pattern.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/nmap_scan_detected.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1047": { "name": "Windows Management Instrumentation", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_wmi_process_creation.yml" ], "elastic": [ "elastic/endpoint/general/Registry Manipulation via WMI Stdregprov.ndjson", "elastic/endpoint/windows/win_suspicious_wmic_process.ndjson" ], "splunk": [ "splunk/windows/win_windows_management_instrumentation.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_107_windows_management_instrumentation.kql" ], "wazuh": [ "wazuh/rules/windows_management_instrumentation.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_wmic_exe.json", "carbonblack/rules/cb_file_modification_wmic_exe.json", "carbonblack/rules/cb_network_connection_wmic_exe.json", "carbonblack/rules/cb_process_creation_wmic_exe.json", "carbonblack/rules/cb_registry_modification_wmic_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "falcon", "sentinelone", "falco" ], "coverage_count": 6 }, "T1048": { "name": "Exfiltration Over Alternative Protocol", "tactic": "exfiltration", "detections": { "sigma": [ "sigma/network/win_exfiltration_over_alternative_protocol.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect Curly COMrades A New Threat Actor Targeting Geopolitical Hotbeds.ndjson", "elastic/endpoint/network/net_dns_tunneling_entropy.ndjson", "elastic/network/network_rules.ndjson" ], "splunk": [ "splunk/windows/win_exfiltration_over_alternative_protocol.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_108_exfiltration_over_alternative_protocol.kql" ], "wazuh": [ "wazuh/rules/exfiltration_over_alternative_protocol.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1053": { "name": "Scheduled Task/Job", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_at_job_creation.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_scheduled_task_job.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_109_scheduled_task_job.kql" ], "wazuh": [ "wazuh/rules/scheduled_task_job.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1053.002": { "name": "At", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_at_job_creation.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_010_proc_exec_at.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_at_exe.json", "carbonblack/rules/cb_file_modification_at_exe.json", "carbonblack/rules/cb_network_connection_at_exe.json", "carbonblack/rules/cb_process_creation_at_exe.json", "carbonblack/rules/cb_registry_modification_at_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1053.003": { "name": "Cron", "tactic": "persistence", "detections": { "sigma": [ "sigma/linux/lnx_suspicious_cron_modification.yml" ], "elastic": [], "splunk": [ "splunk/linux/lnx_suspicious_cron_modification.spl" ], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/cron_job_modification.xml", "wazuh/rules/lnx_crontab_creation.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1053.005": { "name": "Scheduled Task", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_schtasks_create.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_009_proc_exec_schtasks.kql", "microsoft-sentinel/kql_061_schtask_created.kql", "microsoft-sentinel/kql_062_schtask_deleted.kql", "microsoft-sentinel/kql_063_schtask_enabled.kql", "microsoft-sentinel/kql_064_schtask_disabled.kql", "microsoft-sentinel/kql_065_schtask_updated.kql", "microsoft-sentinel/kql_066_schtask_suspicious_name.kql", "microsoft-sentinel/kql_067_schtask_suspicious_action.kql", "microsoft-sentinel/kql_068_schtask_hidden.kql", "microsoft-sentinel/kql_069_schtask_system_context.kql", "microsoft-sentinel/kql_070_schtask_network_trigger.kql" ], "wazuh": [ "wazuh/rules/schtasks_creation.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_schtasks_exe.json", "carbonblack/rules/cb_file_modification_schtasks_exe.json", "carbonblack/rules/cb_network_connection_schtasks_exe.json", "carbonblack/rules/cb_process_creation_schtasks_exe.json", "carbonblack/rules/cb_registry_modification_schtasks_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1055": { "name": "Process Injection", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/windows/win_process_hollowing_indicators.yml", "sigma/windows/win_process_injection_createremotethread.yml" ], "elastic": [ "elastic/endpoint/general/HackTool - HollowReaper Execution.ndjson" ], "splunk": [ "splunk/windows/win_process_hollowing.spl", "splunk/windows/win_process_injection.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_110_process_injection.kql", "microsoft-sentinel/kql_111_process_hollowing.kql" ], "wazuh": [ "wazuh/rules/process_injection.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1055.012": { "name": "Process Hollowing", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_process_hollowing_indicators.yml" ], "elastic": [ "elastic/endpoint/general/HackTool - HollowReaper Execution.ndjson" ], "splunk": [ "splunk/windows/win_process_hollowing.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_111_process_hollowing.kql" ], "wazuh": [ "wazuh/rules/process_hollowing.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1056": { "name": "Input Capture", "tactic": "collection", "detections": { "sigma": [ "sigma/windows/win_keylogger_setwindowshookex.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_input_capture.spl", "splunk/windows/win_keylogging.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_112_input_capture.kql", "microsoft-sentinel/kql_113_keylogging.kql" ], "wazuh": [ "wazuh/rules/input_capture.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1056.001": { "name": "Keylogging", "tactic": "collection", "detections": { "sigma": [ "sigma/windows/win_keylogger_setwindowshookex.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_keylogging.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_113_keylogging.kql" ], "wazuh": [ "wazuh/rules/keylogging.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1059": { "name": "Command and Scripting Interpreter", "tactic": "execution", "detections": { "sigma": [ "sigma/linux/lnx_base64_decoding.yml", "sigma/windows/win_powershell_suspicious_encoded_command.yml", "sigma/windows/win_suspicious_cmd_execution_with_chained_commands.yml", "sigma/windows/win_suspicious_python_execution.yml", "sigma/windows/win_suspicious_vbscript_execution.yml", "sigma/windows/win_suspicious_wscript_js.yml" ], "elastic": [ "elastic/endpoint/general/Defense Evasion \u2013 Encoded PowerShell Command.ndjson", "elastic/endpoint/general/Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309).ndjson", "elastic/endpoint/general/Suspicious Child Process of SAP NetWeaver - Linux.ndjson", "elastic/endpoint/general/Suspicious Velociraptor Child Process.ndjson", "elastic/endpoint/general/endpoint_rules.ndjson", "elastic/endpoint/linux/lnx_suspicious_netcat.ndjson", "elastic/endpoint/linux/lnx_suspicious_shell_meta.ndjson", "elastic/endpoint/windows/win_suspicious_powershell_download.ndjson" ], "splunk": [ "splunk/windows/win_powershell_suspicious_encoded_command.spl", "splunk/windows/win_python.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_002_proc_exec_powershell.kql", "microsoft-sentinel/kql_114_python.kql" ], "wazuh": [ "wazuh/rules/php_code_injection.xml", "wazuh/rules/wazuh_auth_bruteforce_many_fail.xml", "wazuh/rules/wazuh_cloud_aws_stop_logging.xml", "wazuh/rules/wazuh_lnx_curl_wget_to_shell.xml", "wazuh/rules/wazuh_lnx_passwd_shadow_read.xml", "wazuh/rules/wazuh_lnx_suspicious_cron_write.xml", "wazuh/rules/wazuh_net_dns_tunnel_pattern.xml", "wazuh/rules/wazuh_win_defender_disable.xml", "wazuh/rules/wazuh_win_lsass_access.xml", "wazuh/rules/wazuh_win_shadowcopy_delete.xml", "wazuh/rules/wazuh_win_suspicious_powershell_encoded.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_suspicious_app_exe.json", "carbonblack/rules/cb_file_modification_suspicious_app_exe.json", "carbonblack/rules/cb_network_connection_suspicious_app_exe.json", "carbonblack/rules/cb_process_creation_suspicious_app_exe.json", "carbonblack/rules/cb_registry_modification_suspicious_app_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "falcon", "sentinelone", "falco" ], "coverage_count": 6 }, "T1059.001": { "name": "PowerShell", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_powershell_suspicious_download.yml", "sigma/windows/win_powershell_suspicious_encoded_command.yml" ], "elastic": [ "elastic/endpoint/general/Defense Evasion \u2013 Encoded PowerShell Command.ndjson", "elastic/endpoint/general/Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309).ndjson", "elastic/endpoint/general/endpoint_rules.ndjson", "elastic/endpoint/windows/win_suspicious_powershell_download.ndjson" ], "splunk": [ "splunk/windows/win_powershell_suspicious_encoded_command.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_002_proc_exec_powershell.kql", "microsoft-sentinel/kql_034_file_create_ps1.kql", "microsoft-sentinel/kql_endpoint_win_powershell_suspicious_encoded_command.kql" ], "wazuh": [ "wazuh/rules/powershell_encoded_command.xml", "wazuh/rules/win_suspicious_process_cmd_encoded.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_powershell_exe.json", "carbonblack/rules/cb_file_modification_powershell_exe.json", "carbonblack/rules/cb_network_connection_powershell_exe.json", "carbonblack/rules/cb_process_creation_powershell_exe.json", "carbonblack/rules/cb_registry_modification_powershell_exe.json" ], "falcon": [ "falcon/win_suspicious_encoded_powershell.fql" ], "sentinelone": [], "falco": [] }, "gaps": [ "sentinelone", "falco" ], "coverage_count": 7 }, "T1059.003": { "name": "Windows Command Shell", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_suspicious_cmd_execution_with_chained_commands.yml" ], "elastic": [ "elastic/endpoint/general/Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309).ndjson", "elastic/endpoint/general/Potential SAP NetWeaver Webshell Creation.ndjson", "elastic/endpoint/general/Suspicious Child Process of SAP NetWeaver - Linux.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_001_proc_exec_cmd.kql", "microsoft-sentinel/kql_036_file_create_bat.kql" ], "wazuh": [ "wazuh/rules/win_suspicious_process_cmd_encoded.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_cmd_exe.json", "carbonblack/rules/cb_file_modification_cmd_exe.json", "carbonblack/rules/cb_network_connection_cmd_exe.json", "carbonblack/rules/cb_process_creation_cmd_exe.json", "carbonblack/rules/cb_registry_modification_cmd_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1059.004": { "name": "Unix Shell", "tactic": "execution", "detections": { "sigma": [ "sigma/linux/lnx_suspicious_curl_pipe_bash.yml" ], "elastic": [ "elastic/endpoint/linux/lnx_suspicious_curl_wget.ndjson", "elastic/endpoint/linux/lnx_suspicious_netcat.ndjson", "elastic/endpoint/linux/lnx_suspicious_shell_meta.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/netcat_reverse_shell.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [ "falco/suspicious_shell_in_container.yaml" ] }, "gaps": [ "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone" ], "coverage_count": 4 }, "T1059.005": { "name": "Visual Basic", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_suspicious_vbscript_execution.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_003_proc_exec_wscript.kql", "microsoft-sentinel/kql_004_proc_exec_cscript.kql", "microsoft-sentinel/kql_035_file_create_vbs.kql", "microsoft-sentinel/kql_038_file_create_wsf.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_cscript_exe.json", "carbonblack/rules/cb_childproc_creation_wscript_exe.json", "carbonblack/rules/cb_file_modification_cscript_exe.json", "carbonblack/rules/cb_file_modification_wscript_exe.json", "carbonblack/rules/cb_network_connection_cscript_exe.json", "carbonblack/rules/cb_network_connection_wscript_exe.json", "carbonblack/rules/cb_process_creation_cscript_exe.json", "carbonblack/rules/cb_process_creation_wscript_exe.json", "carbonblack/rules/cb_registry_modification_cscript_exe.json", "carbonblack/rules/cb_registry_modification_wscript_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1059.006": { "name": "Python", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_suspicious_python_execution.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_python.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_114_python.kql" ], "wazuh": [ "wazuh/rules/python.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_hacker_tool_py.json", "carbonblack/rules/cb_file_modification_hacker_tool_py.json", "carbonblack/rules/cb_network_connection_hacker_tool_py.json", "carbonblack/rules/cb_process_creation_hacker_tool_py.json", "carbonblack/rules/cb_registry_modification_hacker_tool_py.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1059.007": { "name": "JavaScript", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_suspicious_wscript_js.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_037_file_create_js.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1068": { "name": "Exploitation for Privilege Escalation", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/linux/lnx_suspicious_sudo_without_tty.yml" ], "elastic": [ "elastic/endpoint/general/Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309).ndjson" ], "splunk": [ "splunk/linux/lnx_suspicious_sudo_without_tty.spl" ], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1070": { "name": "Indicator Removal", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/linux/lnx_clear_command_history.yml", "sigma/windows/win_timestomp_file_time_modification.yml" ], "elastic": [ "elastic/endpoint/general/Defense Evasion \u2013 Event Log Cleared Wevtutil.ndjson", "elastic/endpoint/general/Defense-Evasion-Signed-Binary-Temp.ndjson", "elastic/endpoint/general/Defense-Evasion-Timestomp-Suspect.ndjson" ], "splunk": [ "splunk/windows/win_indicator_removal.spl", "splunk/windows/win_timestomp.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_115_indicator_removal.kql", "microsoft-sentinel/kql_116_timestomp.kql" ], "wazuh": [ "wazuh/rules/indicator_removal.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1070.001": { "name": "Clear Windows Event Logs", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_security_log_cleared.yml" ], "elastic": [ "elastic/endpoint/general/Defense Evasion \u2013 Event Log Cleared Wevtutil.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_089_obj_access_event_log.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1070.003": { "name": "Clear Command History", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/linux/lnx_clear_command_history.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/clear_linux_history.xml", "wazuh/rules/lnx_suspicious_history_deletion.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1070.006": { "name": "Timestomp", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_timestomp_file_time_modification.yml" ], "elastic": [ "elastic/endpoint/general/Defense-Evasion-Timestomp-Suspect.ndjson" ], "splunk": [ "splunk/windows/win_timestomp.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_116_timestomp.kql" ], "wazuh": [ "wazuh/rules/timestomp.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1071": { "name": "Application Layer Protocol", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/net_dns_suspicious_tunnel.yml", "sigma/network/win_ftp_connection_from_non_ftp_client.yml", "sigma/network/win_suspicious_web_protocol_communication.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect Curly COMrades A New Threat Actor Targeting Geopolitical Hotbeds.ndjson", "elastic/network/network_rules.ndjson" ], "splunk": [ "splunk/windows/win_application_layer_protocol.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_117_application_layer_protocol.kql" ], "wazuh": [ "wazuh/rules/application_layer_protocol.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1071.001": { "name": "Web Protocols", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/win_suspicious_web_protocol_communication.yml" ], "elastic": [], "splunk": [ "splunk/network/net_suspicious_user_agent.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_018_net_conn_http_malicious.kql", "microsoft-sentinel/kql_020_net_conn_darkweb.kql" ], "wazuh": [ "wazuh/rules/net_suspicious_user_agent_curl.xml", "wazuh/rules/net_suspicious_user_agent_wget.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_evil_com.json", "carbonblack/rules/cb_childproc_creation_malicious-site_org.json", "carbonblack/rules/cb_file_modification_evil_com.json", "carbonblack/rules/cb_file_modification_malicious-site_org.json", "carbonblack/rules/cb_network_connection_evil_com.json", "carbonblack/rules/cb_network_connection_malicious-site_org.json", "carbonblack/rules/cb_process_creation_evil_com.json", "carbonblack/rules/cb_process_creation_malicious-site_org.json", "carbonblack/rules/cb_registry_modification_evil_com.json", "carbonblack/rules/cb_registry_modification_malicious-site_org.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1071.002": { "name": "File Transfer Protocols", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/win_ftp_connection_from_non_ftp_client.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_014_net_conn_ftp.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1071.004": { "name": "DNS", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/net_dns_suspicious_tunnel.yml", "sigma/network/net_susp_dns_many_nxdomain.yml" ], "elastic": [ "elastic/endpoint/network/net_dns_tunneling_entropy.ndjson", "elastic/network/network_rules.ndjson" ], "splunk": [ "splunk/network/net_dns_suspicious_tunnel.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_017_net_conn_dns_tunnel.kql", "microsoft-sentinel/kql_net_dns_suspicious_tunnel.kql" ], "wazuh": [ "wazuh/rules/net_dns_tunneling_suspicion.xml" ], "carbonblack": [ "carbonblack/rules/cb_netconn_dns_tunnel_like.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "falcon", "sentinelone", "falco" ], "coverage_count": 6 }, "T1072": { "name": "Software Deployment Tools", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_software_deployment_tool_execution.yml" ], "elastic": [ "elastic/endpoint/general/Socket Filters.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/lnx_apt_get_install.xml", "wazuh/rules/lnx_yum_install.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1078": { "name": "Valid Accounts", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_local_account_authentication.yml", "sigma/windows/win_valid_account_login_at_unusual_time.yml" ], "elastic": [ "elastic/endpoint/general/Cloud Accounts.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_052_logon_success.kql", "microsoft-sentinel/kql_053_logon_explicit.kql", "microsoft-sentinel/kql_054_logon_special.kql", "microsoft-sentinel/kql_055_logon_rdp.kql", "microsoft-sentinel/kql_057_logon_batch.kql", "microsoft-sentinel/kql_058_logon_service.kql", "microsoft-sentinel/kql_069_schtask_system_context.kql" ], "wazuh": [ "wazuh/rules/app_apache_unauthorized_access.xml", "wazuh/rules/app_docker_unauthorized_access.xml", "wazuh/rules/app_gitlab_unauthorized_access.xml", "wazuh/rules/app_jenkins_unauthorized_access.xml", "wazuh/rules/app_kubernetes_unauthorized_access.xml", "wazuh/rules/app_mongodb_unauthorized_access.xml", "wazuh/rules/app_mysql_unauthorized_access.xml", "wazuh/rules/app_nginx_unauthorized_access.xml", "wazuh/rules/app_postgres_unauthorized_access.xml", "wazuh/rules/app_redis_unauthorized_access.xml", "wazuh/rules/aws_s3_bucket_public_access.xml", "wazuh/rules/lnx_failed_su_usage.xml", "wazuh/rules/net_ftp_anonymous_login.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1078.003": { "name": "Local Accounts", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_local_account_authentication.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/lnx_suspicious_su_usage.xml", "wazuh/rules/net_ssh_root_login.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1078.004": { "name": "Cloud Accounts", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/cloud/cloud_aws_console_login_without_mfa.yml", "sigma/cloud/cloud_azure_impossible_travel.yml" ], "elastic": [ "elastic/endpoint/general/Cloud Accounts.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_091_misc_cloud_login.kql", "microsoft-sentinel/kql_092_misc_cloud_failed_login.kql", "microsoft-sentinel/kql_100_misc_cloud_suspicious_api.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1082": { "name": "System Information Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_system_info_discovery.yml" ], "elastic": [ "elastic/endpoint/general/System Information Discovery via Registry Queries.ndjson" ], "splunk": [ "splunk/windows/win_system_information_discovery.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_118_system_information_discovery.kql" ], "wazuh": [ "wazuh/rules/system_information_discovery.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1087": { "name": "Account Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_account_discovery_net.yml", "sigma/windows/win_domain_account_discovery.yml", "sigma/windows/win_local_account_discovery.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_account_discovery.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_119_account_discovery.kql" ], "wazuh": [ "wazuh/rules/account_discovery.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_net_exe.json", "carbonblack/rules/cb_file_modification_net_exe.json", "carbonblack/rules/cb_network_connection_net_exe.json", "carbonblack/rules/cb_process_creation_net_exe.json", "carbonblack/rules/cb_registry_modification_net_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1087.001": { "name": "Local Account Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_account_discovery_net.yml", "sigma/windows/win_local_account_discovery.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_local_account_discovery.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_142_local_account_discovery.kql" ], "wazuh": [ "wazuh/rules/local_account_discovery.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1087.002": { "name": "Domain Account Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_account_discovery_net.yml", "sigma/windows/win_domain_account_discovery.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_domain_account_discovery.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_143_domain_account_discovery.kql" ], "wazuh": [ "wazuh/rules/domain_account_discovery.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1090": { "name": "Proxy", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/windows/win_multi_hop_proxy_via_ssh_tunnel.yml", "sigma/windows/win_proxy_tool_execution.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_027_reg_mod_proxy.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1090.003": { "name": "Multi-hop Proxy", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/windows/win_multi_hop_proxy_via_ssh_tunnel.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_019_net_conn_tor.kql", "microsoft-sentinel/kql_020_net_conn_darkweb.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1095": { "name": "Non-Application Layer Protocol", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/win_non_application_layer_protocol_communication.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_non_application_layer_protocol.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_120_non_application_layer_protocol.kql" ], "wazuh": [ "wazuh/rules/non_application_layer_protocol.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_nc_exe.json", "carbonblack/rules/cb_childproc_creation_ncat_exe.json", "carbonblack/rules/cb_file_modification_nc_exe.json", "carbonblack/rules/cb_file_modification_ncat_exe.json", "carbonblack/rules/cb_network_connection_nc_exe.json", "carbonblack/rules/cb_network_connection_ncat_exe.json", "carbonblack/rules/cb_process_creation_nc_exe.json", "carbonblack/rules/cb_process_creation_ncat_exe.json", "carbonblack/rules/cb_registry_modification_nc_exe.json", "carbonblack/rules/cb_registry_modification_ncat_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1098": { "name": "Account Manipulation", "tactic": "persistence", "detections": { "sigma": [ "sigma/cloud/cloud_aws_create_access_key.yml", "sigma/cloud/cloud_cloud_admin_role_assigned.yml", "sigma/cloud/cloud_gcp_iam_suspicious_role_grant.yml", "sigma/windows/win_local_admin_group_add.yml", "sigma/windows/win_user_added_to_privileged_group.yml" ], "elastic": [], "splunk": [ "splunk/cloud/cloud_gcp_iam_suspicious_role_grant.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_042_acct_mgr_user_enabled.kql", "microsoft-sentinel/kql_043_acct_mgr_user_pwd_reset.kql", "microsoft-sentinel/kql_059_logon_unlock.kql" ], "wazuh": [ "wazuh/rules/aws_iam_user_created.xml", "wazuh/rules/gcp_iam_role_grant.xml", "wazuh/rules/group_modification.xml", "wazuh/rules/lnx_passwd_file_modified.xml", "wazuh/rules/lnx_shadow_file_modified.xml", "wazuh/rules/win_ad_password_reset.xml", "wazuh/rules/win_ad_user_unlocked.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_net_exe.json", "carbonblack/rules/cb_file_modification_net_exe.json", "carbonblack/rules/cb_network_connection_net_exe.json", "carbonblack/rules/cb_process_creation_net_exe.json", "carbonblack/rules/cb_registry_modification_net_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1098.001": { "name": "Additional Cloud Credentials", "tactic": "persistence", "detections": { "sigma": [ "sigma/cloud/cloud_gcp_service_account_key_created.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_099_misc_cloud_api_key_created.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1098.003": { "name": "Additional Cloud Roles", "tactic": "persistence", "detections": { "sigma": [ "sigma/cloud/cloud_cloud_admin_role_assigned.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_094_misc_cloud_admin_assigned.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1098.004": { "name": "SSH Authorized Keys", "tactic": "persistence", "detections": { "sigma": [ "sigma/linux/lnx_ssh_authorized_keys_modification.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/lnx_sshd_config_modified.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1098.007": { "name": "Additional Local or Domain Groups", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_user_added_to_privileged_group.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_045_acct_mgr_user_added_to_group.kql" ], "wazuh": [ "wazuh/rules/win_ad_user_added_to_admin_group.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1105": { "name": "Ingress Tool Transfer", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/linux/lnx_suspicious_wget_curl_to_tmp.yml", "sigma/windows/win_suspicious_certutil_download.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect Curly COMrades A New Threat Actor Targeting Geopolitical Hotbeds.ndjson", "elastic/endpoint/general/Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server.ndjson", "elastic/endpoint/linux/lnx_suspicious_curl_wget.ndjson", "elastic/endpoint/windows/win_suspicious_certutil_download.ndjson", "elastic/endpoint/windows/win_suspicious_powershell_download.ndjson" ], "splunk": [ "splunk/linux/lnx_suspicious_wget_curl.spl", "splunk/windows/win_suspicious_certutil_download.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_007_proc_exec_certutil.kql", "microsoft-sentinel/kql_008_proc_exec_bitsadmin.kql", "microsoft-sentinel/kql_031_file_create_exe_temp.kql" ], "wazuh": [ "wazuh/rules/net_suspicious_user_agent_curl.xml", "wazuh/rules/net_suspicious_user_agent_wget.xml", "wazuh/rules/suspicious_curl_wget.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_certutil_exe.json", "carbonblack/rules/cb_file_modification_certutil_exe.json", "carbonblack/rules/cb_network_connection_certutil_exe.json", "carbonblack/rules/cb_process_creation_certutil_exe.json", "carbonblack/rules/cb_registry_modification_certutil_exe.json" ], "falcon": [ "falcon/win_certutil_download.fql" ], "sentinelone": [], "falco": [] }, "gaps": [ "sentinelone", "falco" ], "coverage_count": 7 }, "T1110": { "name": "Brute Force", "tactic": "credential-access", "detections": { "sigma": [ "sigma/windows/win_multiple_failed_login_attempts.yml" ], "elastic": [], "splunk": [ "splunk/network/net_suspicious_ssh_brute.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_050_acct_mgr_acct_locked_out.kql", "microsoft-sentinel/kql_051_logon_failed.kql", "microsoft-sentinel/kql_092_misc_cloud_failed_login.kql" ], "wazuh": [ "wazuh/rules/lnx_failed_su_usage.xml", "wazuh/rules/rdp_brute_force.xml", "wazuh/rules/ssh_brute_force.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1110.001": { "name": "Password Guessing", "tactic": "credential-access", "detections": { "sigma": [ "sigma/correlations/brute_force_then_success.yml", "sigma/windows/win_brute_force_failed_login.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_brute_force_correlation.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_051_logon_failed.kql", "microsoft-sentinel/kql_correlation_brute_force.kql" ], "wazuh": [ "wazuh/rules/net_ssh_failed_root_login.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1112": { "name": "Modify Registry", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_suspicious_registry_modification.yml" ], "elastic": [ "elastic/endpoint/general/Registry Manipulation via WMI Stdregprov.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_028_reg_mod_rdp.kql", "microsoft-sentinel/kql_029_reg_mod_wdigest.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_reg_exe.json", "carbonblack/rules/cb_file_modification_reg_exe.json", "carbonblack/rules/cb_network_connection_reg_exe.json", "carbonblack/rules/cb_process_creation_reg_exe.json", "carbonblack/rules/cb_registry_modification_reg_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1124": { "name": "System Time Discovery", "tactic": "discovery", "detections": { "sigma": [ "sigma/windows/win_system_time_discovery.yml" ], "elastic": [ "elastic/endpoint/general/System Information Discovery via Registry Queries.ndjson" ], "splunk": [ "splunk/windows/win_system_time_discovery.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_121_system_time_discovery.kql" ], "wazuh": [ "wazuh/rules/system_time_discovery.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1127": { "name": "Trusted Developer Utilities Proxy Execution", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_msbuild_suspicious_execution.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_msbuild.spl", "splunk/windows/win_trusted_developer_utilities_proxy_execution.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_122_trusted_developer_utilities_proxy_execut.kql", "microsoft-sentinel/kql_123_msbuild.kql" ], "wazuh": [ "wazuh/rules/trusted_developer_utilities_proxy_execution.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1127.001": { "name": "MSBuild", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_msbuild_suspicious_execution.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_msbuild.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_123_msbuild.kql" ], "wazuh": [ "wazuh/rules/msbuild.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_msbuild_exe.json", "carbonblack/rules/cb_file_modification_msbuild_exe.json", "carbonblack/rules/cb_network_connection_msbuild_exe.json", "carbonblack/rules/cb_process_creation_msbuild_exe.json", "carbonblack/rules/cb_registry_modification_msbuild_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1133": { "name": "External Remote Services", "tactic": "initial-access", "detections": { "sigma": [ "sigma/network/net_external_remote_services_anomalous.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_external_remote_services.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_124_external_remote_services.kql" ], "wazuh": [ "wazuh/rules/external_remote_services.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1136": { "name": "Create Account", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_domain_account_creation.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_cloud_account.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_047_acct_mgr_group_created.kql", "microsoft-sentinel/kql_125_cloud_account.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_net_exe.json", "carbonblack/rules/cb_file_modification_net_exe.json", "carbonblack/rules/cb_network_connection_net_exe.json", "carbonblack/rules/cb_process_creation_net_exe.json", "carbonblack/rules/cb_registry_modification_net_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1136.001": { "name": "Local Account", "tactic": "persistence", "detections": { "sigma": [ "sigma/linux/lnx_new_user_added.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_041_acct_mgr_user_created.kql" ], "wazuh": [ "wazuh/rules/account_creation.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1136.002": { "name": "Domain Account", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_domain_account_creation.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/win_ad_computer_account_created.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1136.003": { "name": "Cloud Account", "tactic": "persistence", "detections": { "sigma": [ "sigma/cloud/cloud_github_org_member_added_external.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_cloud_account.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_125_cloud_account.kql" ], "wazuh": [ "wazuh/rules/cloud_account.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1140": { "name": "Deobfuscate/Decode Files or Information", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_file_decode_deobfuscation_via_certutil_or_powershell.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_007_proc_exec_certutil.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_certutil_exe.json", "carbonblack/rules/cb_file_modification_certutil_exe.json", "carbonblack/rules/cb_network_connection_certutil_exe.json", "carbonblack/rules/cb_process_creation_certutil_exe.json", "carbonblack/rules/cb_registry_modification_certutil_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1190": { "name": "Exploit Public-Facing Application", "tactic": "initial-access", "detections": { "sigma": [ "sigma/linux/lnx_web_application_exploit_indicators_in_logs.yml" ], "elastic": [ "elastic/endpoint/general/Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309).ndjson", "elastic/endpoint/general/Potential SAP NetWeaver Webshell Creation.ndjson", "elastic/endpoint/general/Suspicious Child Process of SAP NetWeaver - Linux.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/apache_error_log_spike.xml", "wazuh/rules/directory_traversal.xml", "wazuh/rules/nginx_error_log_spike.xml", "wazuh/rules/sql_injection_attempt.xml", "wazuh/rules/xss_attempt.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1197": { "name": "BITS Jobs", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_bits_job_creation_for_download.yml" ], "elastic": [ "elastic/endpoint/windows/win_suspicious_bitsadmin.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_008_proc_exec_bitsadmin.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_bitsadmin_exe.json", "carbonblack/rules/cb_file_modification_bitsadmin_exe.json", "carbonblack/rules/cb_network_connection_bitsadmin_exe.json", "carbonblack/rules/cb_process_creation_bitsadmin_exe.json", "carbonblack/rules/cb_registry_modification_bitsadmin_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1205": { "name": "Traffic Signaling", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/linux/lnx_socket_filter___bpf_program_load.yml", "sigma/network/lnx_traffic_signaling___port_knocking.yml" ], "elastic": [ "elastic/endpoint/general/Port Knocking.ndjson" ], "splunk": [ "splunk/windows/win_socket_filters.spl", "splunk/windows/win_traffic_signaling.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_126_traffic_signaling.kql", "microsoft-sentinel/kql_127_socket_filters.kql" ], "wazuh": [ "wazuh/rules/traffic_signaling.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1205.002": { "name": "Socket Filters", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/linux/lnx_socket_filter___bpf_program_load.yml" ], "elastic": [ "elastic/endpoint/general/Port Knocking.ndjson" ], "splunk": [ "splunk/windows/win_socket_filters.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_127_socket_filters.kql" ], "wazuh": [ "wazuh/rules/socket_filters.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1218": { "name": "System Binary Proxy Execution", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_installutil_suspicious.yml", "sigma/windows/win_regsvr32_suspicious_network_or_script_load.yml", "sigma/windows/win_rundll32_suspicious_execution_pattern.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_installutil.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_005_proc_exec_rundll32.kql", "microsoft-sentinel/kql_006_proc_exec_regsvr32.kql", "microsoft-sentinel/kql_039_file_create_scr.kql", "microsoft-sentinel/kql_128_installutil.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1218.004": { "name": "InstallUtil", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_installutil_suspicious.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_installutil.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_128_installutil.kql" ], "wazuh": [ "wazuh/rules/installutil.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_installutil_exe.json", "carbonblack/rules/cb_file_modification_installutil_exe.json", "carbonblack/rules/cb_network_connection_installutil_exe.json", "carbonblack/rules/cb_process_creation_installutil_exe.json", "carbonblack/rules/cb_registry_modification_installutil_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1218.005": { "name": "Mshta", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_suspicious_mshta_execution.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_suspicious_mshta_execution.spl" ], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_mshta_exe.json", "carbonblack/rules/cb_file_modification_mshta_exe.json", "carbonblack/rules/cb_network_connection_mshta_exe.json", "carbonblack/rules/cb_process_creation_mshta_exe.json", "carbonblack/rules/cb_registry_modification_mshta_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "microsoft-sentinel", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1218.010": { "name": "Regsvr32", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_regsvr32_suspicious_network_or_script_load.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_suspicious_regsvr32.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_006_proc_exec_regsvr32.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_regsvr32_exe.json", "carbonblack/rules/cb_file_modification_regsvr32_exe.json", "carbonblack/rules/cb_network_connection_regsvr32_exe.json", "carbonblack/rules/cb_process_creation_regsvr32_exe.json", "carbonblack/rules/cb_registry_modification_regsvr32_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1218.011": { "name": "Rundll32", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_rundll32_suspicious_execution_pattern.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_suspicious_rundll32_net.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_005_proc_exec_rundll32.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_rundll32_exe.json", "carbonblack/rules/cb_file_modification_rundll32_exe.json", "carbonblack/rules/cb_network_connection_rundll32_exe.json", "carbonblack/rules/cb_process_creation_rundll32_exe.json", "carbonblack/rules/cb_registry_modification_rundll32_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1219": { "name": "Remote Access Software", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/windows/win_remote_access_tool_execution.yml" ], "elastic": [ "elastic/endpoint/general/Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server.ndjson", "elastic/endpoint/general/Suspicious Velociraptor Child Process.ndjson" ], "splunk": [ "splunk/windows/win_remote_access_software.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_129_remote_access_software.kql" ], "wazuh": [ "wazuh/rules/remote_access_software.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1484": { "name": "Domain Policy Modification", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/windows/win_group_policy_modification.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_049_acct_mgr_pwd_policy_changed.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1484.001": { "name": "Group Policy Modification", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/windows/win_group_policy_modification.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/win_ad_group_policy_modified.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1486": { "name": "Data Encrypted for Impact", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_ransomware_mass_file_rename.yml" ], "elastic": [ "elastic/endpoint/general/FunkLocker Ransomware File Creation.ndjson" ], "splunk": [ "splunk/windows/win_data_encrypted_for_impact.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_130_data_encrypted_for_impact.kql" ], "wazuh": [ "wazuh/rules/data_encrypted_for_impact.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1489": { "name": "Service Stop", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_service_stop___critical_services.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_073_service_stopped.kql" ], "wazuh": [ "wazuh/rules/app_apache_stopped.xml", "wazuh/rules/app_docker_stopped.xml", "wazuh/rules/app_gitlab_stopped.xml", "wazuh/rules/app_jenkins_stopped.xml", "wazuh/rules/app_kubernetes_stopped.xml", "wazuh/rules/app_mongodb_stopped.xml", "wazuh/rules/app_mysql_stopped.xml", "wazuh/rules/app_nginx_stopped.xml", "wazuh/rules/app_postgres_stopped.xml", "wazuh/rules/app_redis_stopped.xml", "wazuh/rules/lnx_systemctl_disable_service.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1490": { "name": "Inhibit System Recovery", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_shadow_copies_deletion.yml" ], "elastic": [ "elastic/endpoint/general/Windows Recovery Environment Disabled Via Reagentc.ndjson", "elastic/endpoint/windows/win_ransomware_shadow_copy.ndjson" ], "splunk": [ "splunk/windows/win_shadow_copies_deletion.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_085_obj_access_shadow_copy.kql", "microsoft-sentinel/kql_086_obj_access_backup.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [ "sentinelone/win_shadow_copy_deletion.s1ql" ], "falco": [] }, "gaps": [ "wazuh", "carbonblack", "falcon", "falco" ], "coverage_count": 5 }, "T1497": { "name": "Virtualization/Sandbox Evasion", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_sandbox_evasion_check.yml", "sigma/windows/win_sandbox_evasion_system_checks.yml", "sigma/windows/win_sandbox_evasion_time_based.yml", "sigma/windows/win_sandbox_evasion_user_activity.yml" ], "elastic": [ "elastic/endpoint/general/Software Deployment Tools.ndjson", "elastic/endpoint/general/System Checks.ndjson", "elastic/endpoint/general/User Activity Based Checks.ndjson", "elastic/endpoint/general/Virtualization Sandbox Evasion.ndjson" ], "splunk": [ "splunk/windows/win_system_checks.spl", "splunk/windows/win_time_based_evasion.spl", "splunk/windows/win_user_activity_based_checks.spl", "splunk/windows/win_virtualization_sandbox_evasion.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_131_virtualization_sandbox_evasion.kql", "microsoft-sentinel/kql_132_system_checks.kql", "microsoft-sentinel/kql_133_user_activity_based_checks.kql", "microsoft-sentinel/kql_134_time_based_evasion.kql" ], "wazuh": [ "wazuh/rules/virtualization_sandbox_evasion.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1497.001": { "name": "System Checks", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_sandbox_evasion_system_checks.yml" ], "elastic": [ "elastic/endpoint/general/Virtualization Sandbox Evasion.ndjson" ], "splunk": [ "splunk/windows/win_system_checks.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_132_system_checks.kql" ], "wazuh": [ "wazuh/rules/system_checks.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1497.002": { "name": "User Activity Based Checks", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_sandbox_evasion_user_activity.yml" ], "elastic": [ "elastic/endpoint/general/System Checks.ndjson" ], "splunk": [ "splunk/windows/win_user_activity_based_checks.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_133_user_activity_based_checks.kql" ], "wazuh": [ "wazuh/rules/user_activity_based_checks.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1497.003": { "name": "Time Based Evasion", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_sandbox_evasion_time_based.yml" ], "elastic": [ "elastic/endpoint/general/User Activity Based Checks.ndjson" ], "splunk": [ "splunk/windows/win_time_based_evasion.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_134_time_based_evasion.kql" ], "wazuh": [ "wazuh/rules/time_based_evasion.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1499": { "name": "Endpoint Denial of Service", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_denial_of_service_indicators.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_074_service_failed.kql", "microsoft-sentinel/kql_075_service_crashed.kql" ], "wazuh": [ "wazuh/rules/app_apache_crashed.xml", "wazuh/rules/app_apache_failed.xml", "wazuh/rules/app_docker_crashed.xml", "wazuh/rules/app_docker_failed.xml", "wazuh/rules/app_gitlab_crashed.xml", "wazuh/rules/app_gitlab_failed.xml", "wazuh/rules/app_jenkins_crashed.xml", "wazuh/rules/app_jenkins_failed.xml", "wazuh/rules/app_kubernetes_crashed.xml", "wazuh/rules/app_kubernetes_failed.xml", "wazuh/rules/app_mongodb_crashed.xml", "wazuh/rules/app_mongodb_failed.xml", "wazuh/rules/app_mysql_crashed.xml", "wazuh/rules/app_mysql_failed.xml", "wazuh/rules/app_nginx_crashed.xml", "wazuh/rules/app_nginx_failed.xml", "wazuh/rules/app_postgres_crashed.xml", "wazuh/rules/app_postgres_failed.xml", "wazuh/rules/app_redis_crashed.xml", "wazuh/rules/app_redis_failed.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1505": { "name": "Server Software Component", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_web_shell_file_creation.yml" ], "elastic": [ "elastic/endpoint/general/Potential SAP NetWeaver Webshell Creation.ndjson" ], "splunk": [ "splunk/windows/win_server_software_component.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_135_server_software_component.kql" ], "wazuh": [ "wazuh/rules/server_software_component.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1505.003": { "name": "Web Shell", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_web_shell_file_creation.yml" ], "elastic": [ "elastic/endpoint/general/Potential SAP NetWeaver Webshell Creation.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/web_shell_upload.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1530": { "name": "Data from Cloud Storage", "tactic": "collection", "detections": { "sigma": [ "sigma/cloud/win_access_to_cloud_storage_buckets_via_cli.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_098_misc_cloud_storage_public.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1531": { "name": "Account Access Removal", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_account_deletion_or_disable.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_044_acct_mgr_user_deleted.kql", "microsoft-sentinel/kql_046_acct_mgr_user_removed_from_group.kql", "microsoft-sentinel/kql_048_acct_mgr_group_deleted.kql" ], "wazuh": [ "wazuh/rules/win_ad_user_deleted.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1543": { "name": "Create or Modify System Process", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_new_system_service_created.yml", "sigma/windows/win_windows_service_with_suspicious_binary_path.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_071_service_installed.kql" ], "wazuh": [ "wazuh/rules/app_apache_restarted.xml", "wazuh/rules/app_apache_started.xml", "wazuh/rules/app_docker_restarted.xml", "wazuh/rules/app_docker_started.xml", "wazuh/rules/app_gitlab_restarted.xml", "wazuh/rules/app_gitlab_started.xml", "wazuh/rules/app_jenkins_restarted.xml", "wazuh/rules/app_jenkins_started.xml", "wazuh/rules/app_kubernetes_restarted.xml", "wazuh/rules/app_kubernetes_started.xml", "wazuh/rules/app_mongodb_restarted.xml", "wazuh/rules/app_mongodb_started.xml", "wazuh/rules/app_mysql_restarted.xml", "wazuh/rules/app_mysql_started.xml", "wazuh/rules/app_nginx_restarted.xml", "wazuh/rules/app_nginx_started.xml", "wazuh/rules/app_postgres_restarted.xml", "wazuh/rules/app_postgres_started.xml", "wazuh/rules/app_redis_restarted.xml", "wazuh/rules/app_redis_started.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1543.003": { "name": "Windows Service", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_windows_service_with_suspicious_binary_path.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_suspicious_sc_create.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_023_reg_mod_services.kql", "microsoft-sentinel/kql_033_file_create_sys.kql", "microsoft-sentinel/kql_071_service_installed.kql", "microsoft-sentinel/kql_072_service_started.kql", "microsoft-sentinel/kql_076_service_suspicious_path.kql", "microsoft-sentinel/kql_077_service_suspicious_name.kql", "microsoft-sentinel/kql_078_service_changed_config.kql", "microsoft-sentinel/kql_079_service_deleted.kql", "microsoft-sentinel/kql_080_service_disabled.kql" ], "wazuh": [ "wazuh/rules/service_creation.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1547": { "name": "Boot or Logon Autostart Execution", "tactic": "persistence", "detections": { "sigma": [ "sigma/linux/lnx_suspicious_kernel_module_load.yml", "sigma/windows/win_registry_run_key_modification_via_command_line.yml", "sigma/windows/win_security_support_provider_dll_registration.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_021_reg_mod_run_key.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1547.001": { "name": "Registry Run Keys / Startup Folder", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_registry_run_key_modification_via_command_line.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_021_reg_mod_run_key.kql", "microsoft-sentinel/kql_022_reg_mod_runonce_key.kql" ], "wazuh": [ "wazuh/rules/win_registry_persistence_run.xml", "wazuh/rules/win_registry_persistence_runonce.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1547.005": { "name": "Security Support Provider", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_security_support_provider_dll_registration.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_030_reg_mod_lsa.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1547.006": { "name": "Kernel Modules and Extensions", "tactic": "persistence", "detections": { "sigma": [ "sigma/linux/lnx_suspicious_kernel_module_load.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/kernel_module_loading.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1548": { "name": "Abuse Elevation Control Mechanism", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/windows/win_uac_bypass_via_fodhelper_or_eventviewer.yml" ], "elastic": [ "elastic/endpoint/windows/win_uac_bypass_fodhelper.ndjson" ], "splunk": [ "splunk/windows/win_abuse_elevation_control_mechanism.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_136_abuse_elevation_control_mechanism.kql" ], "wazuh": [ "wazuh/rules/abuse_elevation_control_mechanism.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1548.002": { "name": "Bypass User Account Control", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/windows/win_uac_bypass_via_fodhelper_or_eventviewer.yml" ], "elastic": [ "elastic/endpoint/windows/win_uac_bypass_fodhelper.ndjson" ], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_026_reg_mod_uac.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1548.003": { "name": "Sudo and Sudo Caching", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/linux/lnx_sudoers_modification.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/sudo_abuse.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1552": { "name": "Unsecured Credentials", "tactic": "credential-access", "detections": { "sigma": [ "sigma/windows/win_credentials_in_files___config_file_access.yml", "sigma/windows/win_search_for_credentials_in_files.yml" ], "elastic": [ "elastic/endpoint/general/Potential PowerShell Console History Access Attempt via History File.ndjson" ], "splunk": [ "splunk/windows/win_credentials_in_files.spl", "splunk/windows/win_unsecured_credentials.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_137_unsecured_credentials.kql", "microsoft-sentinel/kql_138_credentials_in_files.kql" ], "wazuh": [ "wazuh/rules/unsecured_credentials.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1552.001": { "name": "Credentials In Files", "tactic": "credential-access", "detections": { "sigma": [ "sigma/windows/win_credentials_in_files___config_file_access.yml" ], "elastic": [ "elastic/endpoint/general/Potential PowerShell Console History Access Attempt via History File.ndjson" ], "splunk": [ "splunk/windows/win_credentials_in_files.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_138_credentials_in_files.kql" ], "wazuh": [ "wazuh/rules/credentials_in_files.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1556": { "name": "Modify Authentication Process", "tactic": "credential-access", "detections": { "sigma": [ "sigma/cloud/win_mfa_configuration_disabled_or_modified.yml", "sigma/linux/lnx_authentication_process_modification.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_060_logon_cleartext.kql" ], "wazuh": [ "wazuh/rules/lnx_sshd_config_modified.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1556.006": { "name": "Multi-Factor Authentication", "tactic": "credential-access", "detections": { "sigma": [ "sigma/cloud/win_mfa_configuration_disabled_or_modified.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_093_misc_cloud_mfa_disabled.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1560": { "name": "Archive Collected Data", "tactic": "collection", "detections": { "sigma": [ "sigma/windows/win_archive_sensitive_data.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_archive_collected_data.spl", "splunk/windows/win_archive_via_utility.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_139_archive_collected_data.kql", "microsoft-sentinel/kql_140_archive_via_utility.kql" ], "wazuh": [ "wazuh/rules/archive_collected_data.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1560.001": { "name": "Archive via Utility", "tactic": "collection", "detections": { "sigma": [ "sigma/windows/win_archive_sensitive_data.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_archive_via_utility.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_140_archive_via_utility.kql" ], "wazuh": [ "wazuh/rules/archive_via_utility.xml" ], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_7z_exe.json", "carbonblack/rules/cb_file_modification_7z_exe.json", "carbonblack/rules/cb_network_connection_7z_exe.json", "carbonblack/rules/cb_process_creation_7z_exe.json", "carbonblack/rules/cb_registry_modification_7z_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1562": { "name": "Impair Defenses", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/cloud/cloud_disable_or_modify_cloud_logs.yml", "sigma/windows/win_disable_event_logging.yml", "sigma/windows/win_firewall_rule_disabled_or_modified.yml", "sigma/windows/win_security_tool_disabled_or_killed.yml" ], "elastic": [ "elastic/endpoint/windows/win_reg_disable_defender.ndjson" ], "splunk": [ "splunk/windows/win_impair_defenses.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_141_impair_defenses.kql" ], "wazuh": [ "wazuh/rules/impair_defenses.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1562.001": { "name": "Disable or Modify Tools", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_security_tool_disabled_or_killed.yml" ], "elastic": [ "elastic/endpoint/windows/win_reg_disable_defender.ndjson" ], "splunk": [ "splunk/windows/win_suspicious_taskkill.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_025_reg_mod_defender.kql", "microsoft-sentinel/kql_080_service_disabled.kql" ], "wazuh": [ "wazuh/rules/app_apache_config_changed.xml", "wazuh/rules/app_docker_config_changed.xml", "wazuh/rules/app_gitlab_config_changed.xml", "wazuh/rules/app_jenkins_config_changed.xml", "wazuh/rules/app_kubernetes_config_changed.xml", "wazuh/rules/app_mongodb_config_changed.xml", "wazuh/rules/app_mysql_config_changed.xml", "wazuh/rules/app_nginx_config_changed.xml", "wazuh/rules/app_postgres_config_changed.xml", "wazuh/rules/app_redis_config_changed.xml", "wazuh/rules/lnx_systemctl_disable_service.xml", "wazuh/rules/windows_defender_disabled.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 5 }, "T1562.002": { "name": "Disable Windows Event Logging", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_disable_event_logging.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_088_obj_access_audit_policy.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1562.004": { "name": "Disable or Modify System Firewall", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_firewall_rule_disabled_or_modified.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_024_reg_mod_firewall.kql", "microsoft-sentinel/kql_095_misc_cloud_fw_changed.kql" ], "wazuh": [ "wazuh/rules/net_firewall_rule_added.xml", "wazuh/rules/net_firewall_rule_deleted.xml", "wazuh/rules/windows_firewall_modified.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1562.008": { "name": "Disable or Modify Cloud Logs", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/cloud/cloud_aws_suspicious_disable_cloudtrail.yml", "sigma/cloud/cloud_disable_or_modify_cloud_logs.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_disable_or_modify_cloud_logs.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_144_disable_or_modify_cloud_logs.kql" ], "wazuh": [ "wazuh/rules/disable_or_modify_cloud_logs.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1564": { "name": "Hide Artifacts", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_hidden_file_or_directory_creation.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_068_schtask_hidden.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1564.001": { "name": "Hidden Files and Directories", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/windows/win_hidden_file_or_directory_creation.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_suspicious_attrib_hidden.spl" ], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1565": { "name": "Data Manipulation", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_data_manipulation.yml", "sigma/windows/win_hosts_file_modification.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_data_manipulation.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_145_data_manipulation.kql" ], "wazuh": [ "wazuh/rules/data_manipulation.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1565.001": { "name": "Stored Data Manipulation", "tactic": "impact", "detections": { "sigma": [ "sigma/windows/win_hosts_file_modification.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_090_obj_access_host_file.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1566": { "name": "Phishing", "tactic": "initial-access", "detections": { "sigma": [ "sigma/network/net_proxy_newly_registered_domain.yml", "sigma/windows/win_office_macro_spawn_process.yml", "sigma/windows/win_spearphishing_attachment.yml", "sigma/windows/win_spearphishing_link.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect UNC3944 Targets SaaS Applications.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1566.001": { "name": "Spearphishing Attachment", "tactic": "initial-access", "detections": { "sigma": [ "sigma/windows/win_office_macro_spawn_process.yml", "sigma/windows/win_spearphishing_attachment.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_spearphishing_attachment.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_146_spearphishing_attachment.kql" ], "wazuh": [ "wazuh/rules/spearphishing_attachment.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1566.002": { "name": "Spearphishing Link", "tactic": "initial-access", "detections": { "sigma": [ "sigma/network/net_proxy_newly_registered_domain.yml", "sigma/windows/win_spearphishing_link.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_spearphishing_link.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_147_spearphishing_link.kql" ], "wazuh": [ "wazuh/rules/spearphishing_link.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1567": { "name": "Exfiltration Over Web Service", "tactic": "exfiltration", "detections": { "sigma": [ "sigma/windows/win_exfil_cloud_storage_tool.yml" ], "elastic": [ "elastic/endpoint/general/IOCs (ip) to detect Curly COMrades A New Threat Actor Targeting Geopolitical Hotbeds.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1567.002": { "name": "Exfiltration to Cloud Storage", "tactic": "exfiltration", "detections": { "sigma": [ "sigma/windows/win_exfil_cloud_storage_tool.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_rclone_exe.json", "carbonblack/rules/cb_file_modification_rclone_exe.json", "carbonblack/rules/cb_network_connection_rclone_exe.json", "carbonblack/rules/cb_process_creation_rclone_exe.json", "carbonblack/rules/cb_registry_modification_rclone_exe.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1569": { "name": "System Services", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_service_execution_suspicious.yml", "sigma/windows/win_system_services_execution.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_system_services_execution.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_148_system_services_execution.kql" ], "wazuh": [ "wazuh/rules/system_services_execution.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1569.002": { "name": "Service Execution", "tactic": "execution", "detections": { "sigma": [ "sigma/windows/win_service_execution_suspicious.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [ "wazuh/rules/psexec_execution.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1571": { "name": "Non-Standard Port", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/win_connection_to_non_standard_port.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_011_net_conn_suspicious_port.kql" ], "wazuh": [ "wazuh/rules/net_suspicious_port_4444.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1572": { "name": "Protocol Tunneling", "tactic": "command-and-control", "detections": { "sigma": [ "sigma/network/win_protocol_tunneling_via_ssh_or_chisel.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_017_net_conn_dns_tunnel.kql", "microsoft-sentinel/kql_net_dns_suspicious_tunnel.kql" ], "wazuh": [ "wazuh/rules/net_dns_tunneling_suspicion.xml" ], "carbonblack": [ "carbonblack/rules/cb_netconn_dns_tunnel_like.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1574": { "name": "Hijack Execution Flow", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_dll_search_order_hijack.yml", "sigma/windows/win_dll_side_loading_from_suspicious_directory.yml" ], "elastic": [ "elastic/endpoint/general/Possible DLL Hijacking of cnmpaui.dll.ndjson", "elastic/endpoint/general/Possible DLL Hijacking of sentinelagentcore.dll.ndjson", "elastic/endpoint/general/Possible DLL Hijacking of tsmsisrv.dll.ndjson", "elastic/endpoint/general/Possible DLL Hijacking of tsvipsrv.dll.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1574.001": { "name": "DLL Search Order Hijacking", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_dll_search_order_hijack.yml" ], "elastic": [ "elastic/endpoint/general/Possible DLL Hijacking of cnmpaui.dll.ndjson", "elastic/endpoint/general/Possible DLL Hijacking of sentinelagentcore.dll.ndjson", "elastic/endpoint/general/Possible DLL Hijacking of tsmsisrv.dll.ndjson", "elastic/endpoint/general/Possible DLL Hijacking of tsvipsrv.dll.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1574.002": { "name": "DLL Side-Loading", "tactic": "persistence", "detections": { "sigma": [ "sigma/windows/win_dll_side_loading_from_suspicious_directory.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_032_file_create_dll_temp.kql" ], "wazuh": [], "carbonblack": [ "carbonblack/rules/cb_childproc_creation_malware_dll.json", "carbonblack/rules/cb_file_modification_malware_dll.json", "carbonblack/rules/cb_network_connection_malware_dll.json", "carbonblack/rules/cb_process_creation_malware_dll.json", "carbonblack/rules/cb_registry_modification_malware_dll.json" ], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "falcon", "sentinelone", "falco" ], "coverage_count": 3 }, "T1578": { "name": "Modify Cloud Compute Infrastructure", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/cloud/cloud_cloud_instance_created.yml", "sigma/cloud/cloud_cloud_instance_deleted.yml", "sigma/cloud/cloud_modify_cloud_compute_infrastructure.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_modify_cloud_compute_infrastructure.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_149_modify_cloud_compute_infrastructure.kql" ], "wazuh": [ "wazuh/rules/modify_cloud_compute_infrastructure.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1578.002": { "name": "Create Cloud Instance", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/cloud/cloud_cloud_instance_created.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_096_misc_cloud_vm_created.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1578.003": { "name": "Delete Cloud Instance", "tactic": "defense-evasion", "detections": { "sigma": [ "sigma/cloud/cloud_cloud_instance_deleted.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [ "microsoft-sentinel/kql_097_misc_cloud_vm_deleted.kql" ], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "splunk", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1586": { "name": "Compromise Accounts", "tactic": "resource-development", "detections": { "sigma": [ "sigma/cloud/cloud_cloud_account_compromise.yml", "sigma/cloud/cloud_compromise_accounts.yml", "sigma/cloud/cloud_email_account_compromise.yml", "sigma/cloud/cloud_social_media_account_compromise.yml" ], "elastic": [ "elastic/endpoint/general/Compromise Accounts (General).ndjson", "elastic/endpoint/general/Email Accounts.ndjson", "elastic/endpoint/general/Social Media Accounts.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1586.001": { "name": "Social Media Accounts", "tactic": "resource-development", "detections": { "sigma": [ "sigma/cloud/cloud_social_media_account_compromise.yml" ], "elastic": [ "elastic/endpoint/general/Compromise Accounts (General).ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1586.002": { "name": "Email Accounts", "tactic": "resource-development", "detections": { "sigma": [ "sigma/cloud/cloud_email_account_compromise.yml" ], "elastic": [ "elastic/endpoint/general/Social Media Accounts.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1586.003": { "name": "Cloud Accounts", "tactic": "resource-development", "detections": { "sigma": [ "sigma/cloud/cloud_cloud_account_compromise.yml" ], "elastic": [ "elastic/endpoint/general/Email Accounts.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1589": { "name": "Gather Victim Identity Information", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_gather_victim_identity_information.yml" ], "elastic": [ "elastic/endpoint/general/Gather Victim Host Information.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1590": { "name": "Gather Victim Network Information", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_gather_victim_network_information.yml" ], "elastic": [ "elastic/endpoint/general/Gather Victim Identity Information.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1591": { "name": "Gather Victim Org Information", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_gather_victim_org_information.yml" ], "elastic": [ "elastic/endpoint/general/Gather Victim Network Information.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1592": { "name": "Gather Victim Host Information", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_gather_victim_host_information.yml" ], "elastic": [ "elastic/endpoint/general/Defense Evasion \u2013 Disable Antivirus or Security Services.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1593": { "name": "Search Open Websites/Domains", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_search_open_websites_domains.yml" ], "elastic": [ "elastic/endpoint/general/Search Open Technical Databases.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1594": { "name": "Search Victim-Owned Websites", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_search_victim_owned_websites.yml" ], "elastic": [ "elastic/endpoint/general/Search Open Websites Domains.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1596": { "name": "Search Open Technical Databases", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_search_open_technical_databases.yml" ], "elastic": [ "elastic/endpoint/general/Search Closed Sources.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1597": { "name": "Search Closed Sources", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_search_closed_sources.yml" ], "elastic": [ "elastic/endpoint/general/Phishing for Information.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1598": { "name": "Phishing for Information", "tactic": "reconnaissance", "detections": { "sigma": [ "sigma/cloud/cloud_phishing_for_information.yml" ], "elastic": [ "elastic/endpoint/general/Gather Victim Org Information.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 }, "T1611": { "name": "Escape to Host", "tactic": "privilege-escalation", "detections": { "sigma": [ "sigma/linux/lnx_container_escape_host_access.yml" ], "elastic": [], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [ "falco/container_escape_mount_host.yaml" ] }, "gaps": [ "elastic", "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone" ], "coverage_count": 2 }, "T1621": { "name": "Multi-Factor Authentication Request Generation", "tactic": "credential-access", "detections": { "sigma": [ "sigma/cloud/cloud_okta_mfa_fatigue.yml", "sigma/correlations/mfa_fatigue_correlation.yml", "sigma/windows/win_mfa_fatigue___prompt_bombing.yml" ], "elastic": [], "splunk": [ "splunk/windows/win_mfa_fatigue___prompt_bombing.spl" ], "microsoft-sentinel": [ "microsoft-sentinel/kql_150_mfa_fatigue___prompt_bombing.kql" ], "wazuh": [ "wazuh/rules/mfa_fatigue___prompt_bombing.xml" ], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "elastic", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 4 }, "T1650": { "name": "Acquire Access", "tactic": "resource-development", "detections": { "sigma": [ "sigma/cloud/cloud_acquire_access.yml" ], "elastic": [ "elastic/endpoint/general/Search Victim-Owned Websites.ndjson" ], "splunk": [], "microsoft-sentinel": [], "wazuh": [], "carbonblack": [], "falcon": [], "sentinelone": [], "falco": [] }, "gaps": [ "splunk", "microsoft-sentinel", "wazuh", "carbonblack", "falcon", "sentinelone", "falco" ], "coverage_count": 2 } } }