attack_relationships.yml

- name: User attempted to authenticate from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Reid Gilman @reidgilman
  - Olaf Hartong @olafhartong
  attack:
    data_source: User Account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate from
    target: port
  security_events:
  - event_id: 4624
    name: An account was successfully logged on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4625
    name: An account failed to log on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Account Lockout
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4648
    name: A logon was attempted using explicit credentials.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: LogonSuccess
    name: LogonSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceLogonEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User created User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: User Account
    data_component: user account creation
  behavior:
    source: user
    relationship: created
    target: user
  security_events:
  - event_id: 4720
    name: A user account was created.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4741
    name: A computer account was created.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Computer Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: UserAccountCreated
    name: UserAccountCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741
  notes: null
- name: User modified User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: modified
    target: user
  security_events:
  - event_id: 4738
    name: A user account was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4781
    name: The name of an account was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4742
    name: A computer account was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Computer Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: UserAccountModified
    name: UserAccountModified
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4742
  notes: null
- name: User terminated Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process termination
  behavior:
    source: user
    relationship: terminated
    target: process
  security_events:
  - event_id: 4689
    name: A process has exited.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Termination
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 5
    name: Process terminated.
    platform: Windows
    audit_category: ProcessTerminate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 5
    name: Process terminated.
    platform: Linux
    audit_category: ProcessTerminate
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  references: null
  notes: null
- name: User accessed Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process access
  behavior:
    source: user
    relationship: accessed
    target: process
  security_events:
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Kernel Object
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Process
  - event_id: OpenProcessApiCall
    name: OpenProcessApiCall
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Potential contribution for ATT&CK - Process / process access
  - "Event 4663, this event generates only if object\u2019s SACL has required ACE\
    \ to handle specific access right use."
- name: Process connected from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected from
    target: port
  security_events:
  - event_id: 5156
    name: The Windows Filtering Platform has permitted a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: InboundConnectionAccepted
    name: InboundConnectionAccepted
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User retrieved information about Firewall
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall metadata
  behavior:
    source: user
    relationship: retrieved information about
    target: firewall
  security_events:
  - event_id: DescribeFirewall
    name: DescribeFirewall
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: DescribeFirewallPolicy
    name: DescribeFirewallPolicy
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: User locked User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: locked
    target: user
  security_events:
  - event_id: 4740
    name: A user account was locked out.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Host blocked port bind on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked port bind on
    target: port
  security_events:
  - event_id: 5159
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process attempted connection to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection to
    target: port
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ConnectionAttempt
    name: ConnectionAttempt
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User requested access to Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Windows Registry
    data_component: windows registry key access
  behavior:
    source: user
    relationship: requested access to
    target: windows registry key
  security_events:
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
      ObjectType: Key
  references: null
  note: null
- name: User loaded Module
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  attack:
    data_source: Module
    data_component: module load
  behavior:
    source: user
    relationship: loaded
    target: module
  security_events:
  - event_id: 7
    name: Image loaded.
    platform: Windows
    audit_category: ImageLoad
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: ImageLoaded
    name: ImageLoaded
    platform: Windows
    audit_category: null
    log_channel: DeviceImageLoadEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes:
  - Potential contribution for ATT&CK - Module / module load
- name: User requested access to AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Active Directory
    data_component: active directory object access
  behavior:
    source: user
    relationship: requested access to
    target: ad object
  security_events:
  - event_id: 4661
    name: A handle to an object was requested.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Access
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process connected to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected to
    target: ip
  security_events:
  - event_id: 5156
    name: The Windows Filtering Platform has permitted a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ConnectionSuccess
    name: ConnectionSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User executed Command
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Command
    data_component: command execution
  behavior:
    source: user
    relationship: executed
    target: command
  security_events:
  - event_id: 4688
    name: A new process has been created.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 1
    name: Process Creation.
    platform: Windows
    audit_category: ProcessCreate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4103
    name: Module logging.
    platform: Windows
    audit_category: Executing Pipeline
    log_channel: Microsoft-Windows-PowerShell/Operational
    log_provider: Microsoft-Windows-PowerShell
  - event_id: ProcessCreated
    name: ProcessCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceProcessEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User unlocked User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: unlocked
    target: user
  security_events:
  - event_id: 4767
    name: A user account was unlocked.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process deleted File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: File
    data_component: file deletion
  behavior:
    source: process
    relationship: deleted
    target: file
  security_events:
  - event_id: 23
    name: File Delete archived.
    platform: Windows
    audit_category: FileDelete
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 23
    name: File Delete archived.
    platform: Linux
    audit_category: FileDelete
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: 26
    name: File Delete logged.
    platform: Windows
    audit_category: FileDeleteDetected
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4660
    name: An object was deleted.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FileDeleted
    name: FileDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceFileEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=Delete".
- name: Host blocked listener on Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked listener on
    target: ip
  security_events:
  - event_id: 5155
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User enabled User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: enabled
    target: user
  security_events:
  - event_id: 4722
    name: A user account was enabled.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: UserAccountModified
    name: UserAccountModified
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Firewall Rule added
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall rule modification
  behavior:
    source: firewall rule
    relationship: modified
    target: null
  security_events:
  - event_id: 4947
    name: A change has been made to Windows Firewall exception list. A rule was modified.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: MPSSVC Rule-Level Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4947
  notes: null
- name: User modified Cloud service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Cloud Service
    data_component: cloud service modification
  behavior:
    source: user
    relationship: modified
    target: cloud service
  security_events:
  - event_id: UpdateTrail
    name: UpdateTrail
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: Host blocked connection from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked connection from
    target: port
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FirewallInboundConnectionBlocked
    name: FirewallInboundConnectionBlocked
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User created Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Scheduled Job
    data_component: scheduled job creation
  behavior:
    source: user
    relationship: created
    target: scheduled job
  security_events:
  - event_id: 4698
    name: A scheduled task was created.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ScheduledTaskCreated
    name: ScheduledTaskCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User listed Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall enumeration
  behavior:
    source: user
    relationship: listed
    target: firewall rule
  security_events:
  - event_id: ListRuleGroups
    name: ListRuleGroups
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: Host blocked connection to Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked connection to
    target: process
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 5031
    name: The Windows Firewall Service blocked an application from accepting incoming
      connections on the network.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FirewallInboundConnectionToAppBlocked
    name: FirewallInboundConnectionToAppBlocked
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User deleted Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Scheduled Job
    data_component: scheduled job deletion
  behavior:
    source: user
    relationship: deleted
    target: scheduled job
  security_events:
  - event_id: 4699
    name: A scheduled task was deleted.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ScheduledTaskDeleted
    name: ScheduledTaskDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Firewall disabled
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Firewall
    data_component: firewall disable
  behavior:
    source: firewall
    relationship: disabled
    target: null
  security_events:
  - event_id: 5025
    name: The Windows Firewall Service has been stopped.
    platform: Windows
    audit_category: System
    audit_sub_category: Other System Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 5034
    name: The Windows Firewall Driver was stopped.
    platform: Windows
    audit_category: System
    audit_sub_category: Other System Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5034
  notes: null
- name: Process requested access to File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: File
    data_component: file access
  behavior:
    source: process
    relationship: requested access to
    target: file
  security_events:
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: File
  references: null
  notes: null
- name: User created Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Group
    data_component: group creation
  behavior:
    source: user
    relationship: created
    target: group
  security_events:
  - event_id: 4727
    name: A security-enabled global group was created.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4731
    name: A security-enabled local group was created.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4754
    name: A security-enabled universal group was created.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731
  notes: null
- name: User modified File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: File
    data_component: file modification
  behavior:
    source: user
    relationship: modified
    target: file
  security_events:
  - event_id: 4670
    name: Permissions on an object were changed.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: Windows
    audit_category: null
    log_channel: null
    log_provider: Windows Defender Advanced Threat Protection
  references: null
  notes: null
- name: User granted acess to User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: granted access to
    target: user
  security_events:
  - event_id: 4717
    name: System security access was granted to an account.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: Authentication Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User created File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Ruben Bouman @rubinatorz
  attack:
    data_source: File
    data_component: file creation
  behavior:
    source: user
    relationship: created
    target: file
  security_events:
  - event_id: 11
    name: FileCreate.
    platform: Linux
    audit_category: FileCreate
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: Windows
    audit_category: null
    log_channel: null
    log_provider: Windows Defender Advanced Threat Protection
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=WriteData".
- name: User deleted Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Group
    data_component: group deletion
  behavior:
    source: user
    relationship: deleted
    target: group
  security_events:
  - event_id: 4730
    name: A security-enabled global group was deleted.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4734
    name: A security-enabled local group was deleted.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4758
    name: A security-enabled universal group was deleted.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734
  notes: null
- name: User created logon session from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Logon Session
    data_component: logon session creation
  behavior:
    source: user
    relationship: created logon session from
    target: ip
  security_events:
  - event_id: 4624
    name: An account was successfully logged on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4778
    name: A session was reconnected to a Window Station.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Other Logon/Logoff Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: LogonSuccess
    name: LogonSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceLogonEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process accessed Windows registry key
  contributors:
  - Reid Gilman @reidgilman
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Windows Registry
    data_component: windows registry key access
  behavior:
    source: process
    relationship: accessed
    target: windows registry key
  security_events:
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - "Event 4663 includes the following caveat \"This event generates only if object\u2019\
    s SACL has required ACE to handle specific access right use.\""
- name: Logon Session Metadata
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Logon Session
    data_component: logon session metadata
  behavior:
    source: logon session
    relationship: metadata
    target: null
  security_events:
  - event_id: 4703
    name: A token right was adjusted.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: Authorization Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4673
    name: A privileged service was called.
    platform: Windows
    audit_category: Privilege Use
    audit_sub_category: Sensitive Privilege Use
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4674
    name: An operation was attempted on a privileged object.
    platform: Windows
    audit_category: Privilege Use
    audit_sub_category: Sensitive Privilege Use
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4610
    name: An authentication package has been loaded by the Local Security Authority.
    platform: Windows
    audit_category: System
    audit_sub_category: Security System Extension
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4611
    name: A trusted logon process has been registered with the Local Security Authority.
    platform: Windows
    audit_category: System
    audit_sub_category: Security System Extension
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4614
    name: A notification package has been loaded by the Security Account Manager.
    platform: Windows
    audit_category: System
    audit_sub_category: Security System Extension
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4622
    name: A security package has been loaded by the Local Security Authority.
    platform: Windows
    audit_category: System
    audit_sub_category: Security System Extension
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4674
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4610
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4614
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622
  notes: null
- name: Process connected from Host
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected from
    target: host
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: InboundConnectionAccepted
    name: InboundConnectionAccepted
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process attempted connection to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection to
    target: ip
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ConnectionAttempt
    name: ConnectionAttempt
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User connected to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected to
    target: ip
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ConnectionSuccess
    name: ConnectionSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User created logon session from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Logon Session
    data_component: logon session creation
  behavior:
    source: user
    relationship: created logon session from
    target: port
  security_events:
  - event_id: 4624
    name: An account was successfully logged on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: LogonSuccess
    name: LogonSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceLogonEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Sensor Health changed
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Sensor Health
    data_component: host status
  behavior:
    source: sensor health
    relationship: changed
    target: null
  security_events:
  - event_id: 1100
    name: The event logging service has shut down.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Security
    log_provider: Eventlog
  - event_id: 1101
    name: Audit events have been dropped by the transport.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Security
    log_provider: Eventlog
  - event_id: 1102
    name: The audit log was cleared.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Security
    log_provider: Eventlog
  - event_id: 1104
    name: The security Log is now full.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Security
    log_provider: Eventlog
  - event_id: 6005
    name: The Event log service was started.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: System
    log_provider: Eventlog
  - event_id: 6006
    name: The Event log service was stopped.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: System
    log_provider: Eventlog
  - event_id: 4616
    name: The system time was changed.
    platform: Windows
    audit_category: System
    audit_sub_category: Security State Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1104
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1105
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616
  notes: null
- name: User deleted AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Active Directory
    data_component: active directory object deletion
  behavior:
    source: user
    relationship: deleted
    target: ad object
  security_events:
  - event_id: 5141
    name: A directory service object was deleted.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process executed Script
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Script
    data_component: script execution
  behavior:
    source: process
    relationship: executed
    target: Script
  security_events:
  - event_id: 4103
    name: Module logging.
    platform: Windows
    audit_category: Executing Pipeline
    log_channel: Microsoft-Windows-PowerShell/Operational
    log_provider: Microsoft-Windows-PowerShell
  - event_id: 4104
    name: Script Block Logging.
    platform: Windows
    audit_category: Execute a Remote Command
    log_channel: Microsoft-Windows-PowerShell/Operational
    log_provider: Microsoft-Windows-PowerShell
  - event_id: ScriptContent
    name: ScriptContent
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: PowerShellCommand
    name: PowerShellCommand
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: AmsiScriptDetection
    name: AmsiScriptDetection
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process listened on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: listened on
    target: port
  security_events:
  - event_id: 5154
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ListeningConnectionCreated
    name: ListeningConnectionCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process requested access to Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Windows Registry
    data_component: windows registry key access
  behavior:
    source: process
    relationship: requested access to
    target: windows registry key
  security_events:
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
  references: null
  notes: null
- name: Process modified Windows registry key value
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Windows Registry
    data_component: windows registry key modification
  behavior:
    source: process
    relationship: modified
    target: windows registry key value
  security_events:
  - event_id: 13
    name: RegistryEvent (Value Set).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 14
    name: RegistryEvent (Key and Value Rename).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4657
    name: A registry value was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: RegistryValueSet
    name: RegistryValueSet
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Existing registry value modified" to look for modifications.
- name: Firewall Rule added
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall rule modification
  behavior:
    source: firewall rule
    relationship: removed
    target: null
  security_events:
  - event_id: 4948
    name: A change has been made to Windows Firewall exception list. A rule was deleted.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: MPSSVC Rule-Level Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4948
  notes: null
- name: Host blocked connection from Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked connection from
    target: process
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User accessed File
  contributors:
  - Reid Gilman @reidgilman
  - Ruben Bouman @rubinatorz
  attack:
    data_source: File
    data_component: file access
  behavior:
    source: user
    relationship: accessed
    target: file
  security_events:
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: File
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - "Event 4663 includes the following caveat \"This event generates only if object\u2019\
    s SACL has required ACE to handle specific access right use.\""
  - Event ID 4663 logs attempts of accesses to objects. Look for file access by searching
    for "ObjectType=File".
- name: User modified Network share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Share
    data_component: network share modification
  behavior:
    source: user
    relationship: modified
    target: network share
  security_events:
  - event_id: 5143
    name: A network share object was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User accessed Windows registry key
  contributors:
  - Reid Gilman @reidgilman
  attack:
    data_source: Windows Registry
    data_component: windows registry key access
  behavior:
    source: user
    relationship: accessed
    target: windows registry key
  security_events:
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - "Event 4663 includes the following caveat \"This event generates only if object\u2019\
    s SACL has required ACE to handle specific access right use.\""
- name: User attempted to access Network Share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Share
    data_component: network share access
  behavior:
    source: user
    relationship: attempted to access
    target: network share
  security_events:
  - event_id: 5140
    name: A network share object was accessed.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 5145
    name: A network share object was checked to see whether client can be granted
      desired access.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Detailed File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: LogonSuccess
    name: LogonSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceLogonEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes:
  - Potential contribution for ATT&CK - Network Share / network share access
- name: Process attempted connection from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection from
    target: ip
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ConnectionRequest
    name: ConnectionRequest
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User created Wmi object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: WMI
    data_component: wmi creation
  behavior:
    source: user
    relationship: created
    target: wmi object
  security_events:
  - event_id: 19
    name: WmiEvent (WmiEventFilter activity detected).
    platform: Windows
    audit_category: WmiEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 20
    name: WmiEvent (WmiEventConsumer activity detected).
    platform: Windows
    audit_category: WmiEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 21
    name: WmiEvent (WmiEventConsumerToFilter activity detected).
    platform: Windows
    audit_category: WmiEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: WmiBindEventFilterToConsumer
    name: WmiBindEventFilterToConsumer
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 5860
    name: WMI temporary event created.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-WMI-Activity/Operational
    log_provider: Microsoft-Windows-WMI-Activity
  - event_id: 5861
    name: WMI permanent event created.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-WMI-Activity/Operational
    log_provider: Microsoft-Windows-WMI-Activity
  - event_id: 5857
    name: WMIProv provider started.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-WMI-Activity/Operational
    log_provider: Microsoft-Windows-WMI-Activity
  - event_id: 5858
    name: WMI Query Error.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-WMI-Activity/Operational
    log_provider: Microsoft-Windows-WMI-Activity
  - event_id: 5859
    name: WMI Event.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-WMI-Activity/Operational
    log_provider: Microsoft-Windows-WMI-Activity
  references: null
  notes: null
- name: Firewall Rule added
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall rule modification
  behavior:
    source: firewall rule
    relationship: added
    target: null
  security_events:
  - event_id: 4946
    name: A change has been made to Windows Firewall exception list. A rule was added.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: MPSSVC Rule-Level Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4946
  notes: null
- name: User deleted Wmi object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: WMI
    data_component: wmi deletion
  behavior:
    source: user
    relationship: deleted
    target: wmi object
  security_events:
  - event_id: 19
    name: WmiEvent (WmiEventFilter activity detected).
    platform: Windows
    audit_category: WmiEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 20
    name: WmiEvent (WmiEventConsumer activity detected).
    platform: Windows
    audit_category: WmiEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 21
    name: WmiEvent (WmiEventConsumerToFilter activity detected).
    platform: Windows
    audit_category: WmiEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  references: null
  notes: null
- name: User removed acess from User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: removed access from
    target: user
  security_events:
  - event_id: 4718
    name: System security access was removed from an account.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: Authentication Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Host blocked port bind on Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked port bind on
    target: process
  security_events:
  - event_id: 5159
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User accessed AD Object
  contributors:
  - Reid Gilman @reidgilman
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Active Directory
    data_component: active directory object access
  behavior:
    source: user
    relationship: accessed
    target: ad object
  security_events:
  - event_id: 4662
    name: An operation was performed on an object.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Access
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4932
    name: Synchronization of a replica of an Active Directory naming context has begun.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Replication
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4932
  notes:
  - Events 4661 and 4662 require a SACL (https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists)
    to be for an object or they will not generate
- name: Application attempted to authenticate User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: User Account
    data_component: user account authentication
  behavior:
    source: application
    relationship: attempted to authenticate
    target: user
  security_events:
  - event_id: ConsoleLogin
    name: ConsoleLogin
    platform: AWS
    audit_category: AwsConsoleSignin
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html
  notes:
  - Potential contribution for ATT&CK - User Account / user account authentication
- name: Host permitted listener on Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: permitted listener on
    target: ip
  security_events:
  - event_id: 5154
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process attempted to listen on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted to listen on
    target: port
  security_events:
  - event_id: 5155
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User requested access to File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: File
    data_component: file access
  behavior:
    source: user
    relationship: requested access to
    target: file
  security_events:
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
      ObjectType: File
  - event_id: 4661
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: SAM
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
      ObjectType: SAM
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661
  notes:
  - "Event 4656: This event generates only if object\u2019s SACL has required ACE\
    \ to handle specific access right use."
- name: Process created Pipe
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Named Pipe
    data_component: named pipe metadata
  behavior:
    source: process
    relationship: created
    target: pipe
  security_events:
  - event_id: 17
    name: PipeEvent (Pipe Created).
    platform: Windows
    audit_category: PipeEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 18
    name: PipeEvent (Pipe Connected).
    platform: Windows
    audit_category: PipeEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Detailed File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  notes:
  - Potential contribution for ATT&CK - Named Pipe / named pipe creation
  - Event ID 4656 logs handles to objects. Look for named pipe by searching for "Accesses=CreatePipeInstance".
- name: Service stopped
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Service
    data_component: service metadata
  behavior:
    source: service
    relationship: stopped
    target: null
  security_events:
  - event_id: 4
    name: Sysmon service state changed.
    platform: Windows
    audit_category: ServiceStateChange
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  references: null
  notes: null
- name: Drive modified
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Drive
    data_component: drive modification
  behavior:
    source: drive
    relationship: modified
    target: null
  security_events:
  - event_id: 6419
    name: A request was made to disable a device.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 6420
    name: A device was disabled.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 6421
    name: A request was made to enable a device.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 6422
    name: A device was enabled.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6419
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6420
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6421
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6422
  notes: null
- name: User created Service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Service
    data_component: service creation
  behavior:
    source: user
    relationship: created
    target: service
  security_events:
  - event_id: 4697
    name: A service was installed in the system.
    platform: Windows
    audit_category: System
    audit_sub_category: Security System Extension
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 7045
    name: A new service was installed in the system.
    platform: Windows
    log_channel: System
    log_provider: Service Control Manager
  - event_id: ServiceInstalled
    name: ServiceInstalled
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Drive created
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Drive
    data_component: drive creation
  behavior:
    source: drive
    relationship: created
    target: null
  security_events:
  - event_id: 6416
    name: A new external device was recognized by the system.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 6423
    name: The installation of this device is forbidden by system policy.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 6424
    name: The installation of this device was allowed, after having previously been
      forbidden by policy.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6424
  notes: null
- name: User requested AD Credential
  contributors:
  - Reid Gilman @reidgilman
  attack:
    data_source: Active Directory
    data_component: active directory credential request
  behavior:
    source: user
    relationship: requested
    target: ad credential
  security_events:
  - event_id: 4768
    name: A Kerberos authentication ticket (TGT) was requested.
    platform: Windows
    audit_category: Account Logon
    audit_sub_category: Kerberos Authentication Service
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4769
    name: A Kerberos service ticket was requested.
    platform: Windows
    audit_category: Account Logon
    audit_sub_category: Kerberos Service Ticket Operations
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
  - https://www.cyberark.com/resources/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer
  - https://stealthbits.com/blog/how-to-detect-pass-the-hash-attacks/
  notes: null
- name: Process deleted Windows registry key value
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Windows Registry
    data_component: windows registry key deletion
  behavior:
    source: process
    relationship: deleted
    target: windows registry key value
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: RegistryValueDeleted
    name: RegistryValueDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4657
    name: A registry value was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Registry value deleted" to look for deletions.
- name: Process bound to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: bound to
    target: port
  security_events:
  - event_id: 5158
    name: The Windows Filtering Platform has permitted a bind to a local port.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ListeningConnectionCreated
    name: ListeningConnectionCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User connected to Host
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected to
    target: host
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ConnectionSuccess
    name: ConnectionSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User created Windows registry key value
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Windows Registry
    data_component: windows registry key creation
  behavior:
    source: user
    relationship: created
    target: windows registry key value
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: RegistryValueSet
    name: RegistryValueSet
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4657
    name: A registry value was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes:
  - Potential contribution for ATT&CK - Windows Registry / windows registry key creation
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=New registry value created" to look for creations.
- name: User attempted to authenticate to Application
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: User Account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate to
    target: application
  security_events:
  - event_id: ConsoleLogin
    name: ConsoleLogin
    platform: AWS
    audit_category: AwsConsoleSignin
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html
  notes: null
- name: User created Instance
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Instance
    data_component: instance creation
  behavior:
    source: user
    relationship: created
    target: instance
  security_events:
  - event_id: RunInstances
    name: RunInstances
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: User connected from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected from
    target: port
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: InboundConnectionAccepted
    name: InboundConnectionAccepted
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User disabled User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: disabled
    target: user
  security_events:
  - event_id: 4725
    name: A user account was disabled.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: UserAccountModified
    name: UserAccountModified
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Firewall Policy loaded
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Firewall
    data_component: firewall metadata
  behavior:
    source: firewall policy
    relationship: loaded
    target: null
  security_events:
  - event_id: 2009
    name: The Windows Firewall service failed to load Group Policy.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_provider: Windows Firewall With Advanced Security
  references: null
  notes: null
- name: User requested access to Service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Service
    data_component: service access
  behavior:
    source: user
    relationship: requested access to
    target: service
  security_events:
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process requested access to Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process access
  behavior:
    source: process
    relationship: requested access to
    target: process
  security_events:
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Kernel Object
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Process
  - event_id: 10
    name: Process Access.
    platform: Windows
    audit_category: ProcessAccess
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: OpenProcessApiCall
    name: OpenProcessApiCall
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process attempted connection from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection from
    target: port
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ConnectionRequest
    name: ConnectionRequest
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process connected to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected to
    target: port
  security_events:
  - event_id: 5156
    name: The Windows Filtering Platform has permitted a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ConnectionSuccess
    name: ConnectionSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Host permitted listener on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: permitted listener on
    target: port
  security_events:
  - event_id: 5154
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User modified Instance
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Instance
    data_component: instance modification
  behavior:
    source: user
    relationship: modified
    target: instance
  security_events:
  - event_id: ModifyInstanceAttribute
    name: ModifyInstanceAttribute
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: User removed Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Firewall
    data_component: firewall rule modification
  behavior:
    source: user
    relationship: removed
    target: firewall rule
  security_events:
  - event_id: 2006
    name: A rule has been deleted in the Windows Defender Firewall exception list
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_provider: Microsoft-Windows-Windows Firewall With Advanced Security
  - event_id: DeleteRuleGroup
    name: DeleteRuleGroup
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: 2033
    name: All rules have been deleted from the Windows Firewall configuration on this
      computer.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_provider: Microsoft-Windows-Windows Firewall With Advanced Security
  references: null
  notes: null
- name: User modified Schedule job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Scheduled Job
    data_component: scheduled job modification
  behavior:
    source: user
    relationship: modified
    target: schedule job
  security_events:
  - event_id: 4702
    name: A scheduled task was updated.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ScheduledTaskUpdated
    name: ScheduledTaskUpdated
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User modified Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Windows Registry
    data_component: windows registry key modification
  behavior:
    source: user
    relationship: modified
    target: windows registry key
  security_events:
  - event_id: 4670
    name: Permissions on an object were changed.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: RegistryKeySet
    name: RegistryKeySet
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process accessed Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process access
  behavior:
    source: process
    relationship: accessed
    target: process
  security_events:
  - event_id: 10
    name: ProcessAccess.
    platform: Windows
    audit_category: ProcessAccess
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Kernel Object
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Process
  - event_id: OpenProcessApiCall
    name: OpenProcessApiCall
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - "Event 4663, this event generates only if object\u2019s SACL has required ACE\
    \ to handle specific access right use."
- name: User deleted Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Windows Registry
    data_component: windows registry key deletion
  behavior:
    source: user
    relationship: deleted
    target: windows registry key
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4660
    name: An object was deleted.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: RegistryKeyDeleted
    name: RegistryKeyDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Host blocked port bind on Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked port bind on
    target: ip
  security_events:
  - event_id: 5159
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process created Windows registry key value
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Windows Registry
    data_component: windows registry key creation
  behavior:
    source: process
    relationship: created
    target: windows registry key value
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: RegistryValueSet
    name: RegistryValueSet
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4657
    name: A registry value was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=New registry value created" to look for creations.
- name: Driver loaded
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Driver
    data_component: driver load
  behavior:
    source: driver
    relationship: loaded
    target: null
  security_events:
  - event_id: 6
    name: Driver loaded.
    platform: Windows
    audit_category: DriverLoad
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: DriverLoaded
    name: DriverLoaded
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Host blocked listener on Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked listener on
    target: process
  security_events:
  - event_id: 5155
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User created Pipe
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Named Pipe
    data_component: named pipe metadata
  behavior:
    source: user
    relationship: created
    target: pipe
  security_events:
  - event_id: 17
    name: PipeEvent (Pipe Created).
    platform: Windows
    audit_category: PipeEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 18
    name: PipeEvent (Pipe Connected).
    platform: Windows
    audit_category: PipeEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4656
    name: A handle to an object was requested.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Detailed File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 5145
    name: A network share object was checked to see whether client can be granted
      desired access.
    platform: Windows
    audit_category: multiple
    audit_sub_category: multiple
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
  notes:
  - Potential contribution for ATT&CK - Named Pipe / named pipe creation
  - Event ID 5145 logs accesses of network share objects. Look for named pipe by searching
    for "Accesses=CreatePipeInstance".
  - Event ID 4656 logs handles to objects. Look for named pipe by searching for "Accesses=CreatePipeInstance".
- name: User deleted Windows registry key value
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Windows Registry
    data_component: windows registry key deletion
  behavior:
    source: user
    relationship: deleted
    target: windows registry key value
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: RegistryValueDeleted
    name: RegistryValueDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4657
    name: A registry value was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Registry value deleted" to look for deletions.
- name: Process executed Command
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Command
    data_component: command execution
  behavior:
    source: process
    relationship: executed
    target: command
  security_events:
  - event_id: 4688
    name: A new process has been created.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 1
    name: Process Creation.
    platform: Windows
    audit_category: ProcessCreate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 1
    name: Process Creation.
    platform: Linux
    audit_category: ProcessCreate
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: 4103
    name: Module logging.
    platform: Windows
    audit_category: Executing Pipeline
    log_channel: Microsoft-Windows-PowerShell/Operational
    log_provider: Microsoft-Windows-PowerShell
  - event_id: ProcessCreated
    name: ProcessCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceProcessEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User attempted to modify User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: User Account
    data_component: user account modification
  behavior:
    source: user
    relationship: attempted to modify
    target: user
  security_events:
  - event_id: 4723
    name: An attempt was made to change an account's password.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4724
    name: An attempt was made to reset an account's password.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User connected to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected to
    target: port
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ConnectionSuccess
    name: ConnectionSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User created AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Active Directory
    data_component: active directory object creation
  behavior:
    source: user
    relationship: created
    target: ad object
  security_events:
  - event_id: 5137
    name: A directory service object was created.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Host blocked connection to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked connection to
    target: port
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FirewallOutboundConnectionBlocked
    name: FirewallOutboundConnectionBlocked
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User connected from Host
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected from
    target: host
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: InboundConnectionAccepted
    name: InboundConnectionAccepted
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process accessed File
  contributors:
  - Reid Gilman @reidgilman
  - Ruben Bouman @rubinatorz
  attack:
    data_source: File
    data_component: file access
  behavior:
    source: process
    relationship: accessed
    target: file
  security_events:
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - "Event 4663 includes the following caveat \"This event generates only if object\u2019\
    s SACL has required ACE to handle specific access right use.\""
  - Event ID 4663 logs attempts of accesses to objects. Look for file access by searching
    for "ObjectType=File".
- name: Process connected to Host
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected to
    target: host
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ConnectionSuccess
    name: ConnectionSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process deleted Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Windows Registry
    data_component: windows registry key deletion
  behavior:
    source: process
    relationship: deleted
    target: windows registry key
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4660
    name: An object was deleted.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: RegistryKeyDeleted
    name: RegistryKeyDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process modified Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process modification
  behavior:
    source: process
    relationship: modified
    target: process
  security_events:
  - event_id: 8
    name: CreateRemoteThread.
    platform: Windows
    audit_category: CreateRemoteThread
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: CreateRemoteThreadApiCall
    name: CreateRemoteThreadApiCall
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User deleted File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: File
    data_component: file deletion
  behavior:
    source: user
    relationship: deleted
    target: file
  security_events:
  - event_id: 23
    name: File Delete archived.
    platform: Windows
    audit_category: FileDelete
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 23
    name: File Delete archived.
    platform: Linux
    audit_category: FileDelete
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: 26
    name: File Delete logged.
    platform: Windows
    audit_category: FileDeleteDetected
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4660
    name: An object was deleted.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FileDeleted
    name: FileDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceFileEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=Delete".
- name: User modified Windows registry key value
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Windows Registry
    data_component: windows registry key modification
  behavior:
    source: user
    relationship: modified
    target: windows registry key value
  security_events:
  - event_id: 13
    name: RegistryEvent (Value Set).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 14
    name: RegistryEvent (Key and Value Rename).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4657
    name: A registry value was modified.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: RegistryValueSet
    name: RegistryValueSet
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Existing registry value modified" to look for modifications.
- name: User created Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process creation
  behavior:
    source: user
    relationship: created
    target: process
  security_events:
  - event_id: 4688
    name: A new process has been created.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 1
    name: Process Creation.
    platform: Windows
    audit_category: ProcessCreate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 1
    name: Process Creation.
    platform: Windows
    audit_category: ProcessCreate
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ProcessCreated
    name: ProcessCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceProcessEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User enabled Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Scheduled Job
    data_component: scheduled job modification
  behavior:
    source: user
    relationship: enabled
    target: scheduled job
  security_events:
  - event_id: 4700
    name: A scheduled task was enabled.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ScheduledTaskModified
    name: ScheduledTaskModified
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Logon Session modified
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Logon Session
    data_component: logon session modification
  behavior:
    source: logon session
    relationship: modified
    target: null
  security_events:
  - event_id: 4672
    name: Special privileges assigned to new logon.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Special Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process executed Api call
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: OS api execution
  behavior:
    source: process
    relationship: executed
    target: api call
  security_events:
  - event_id: 8
    name: CreateRemoteThread.
    platform: Windows
    audit_category: CreateRemoteThread
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: CreateRemoteThreadApiCall
    name: CreateRemoteThreadApiCall
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process created Thread
  contributors:
  - Reid Gilman @reidgilman
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process creation
  behavior:
    source: process
    relationship: created
    target: thread
  security_events:
  - event_id: 8
    name: CreateRemoteThread.
    platform: Windows
    audit_category: CreateRemoteThread
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: CreateRemoteThreadApiCall
    name: CreateRemoteThreadApiCall
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process created Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Windows Registry
    data_component: windows registry key creation
  behavior:
    source: process
    relationship: created
    target: windows registry key
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: RegistryKeyCreated
    name: RegistryKeyCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process modified File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: File
    data_component: file modification
  behavior:
    source: process
    relationship: modified
    target: file
  security_events:
  - event_id: 2
    name: A process changed a file creation time.
    platform: Windows
    audit_category: FileCreateTime
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 11
    name: FileCreate.
    platform: Windows
    audit_category: FileCreate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4670
    name: Permissions on an object were changed.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FileModified
    name: FileModified
    platform: Windows
    audit_category: null
    log_channel: DeviceFileEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: FileRenamed
    name: FileRenamed
    platform: Windows
    audit_category: null
    log_channel: DeviceFileEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User retrieved information about cloud service from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Cloud Service
    data_component: cloud service metadata
  behavior:
    source: user
    relationship: retrieved information about cloud service from
    target: ip
  security_events:
  - event_id: GetTrail
    name: GetTrail
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: GetTrailStatus
    name: GetTrailStatus
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: DescribeTrails
    name: DescribeTrails
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: GetEventSelectors
    name: GetEventSelectors
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: GetInsightSelectors
    name: GetInsightSelectors
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes:
  - Potential contribution for ATT&CK - Cloud Service / cloud service metadata
- name: User created Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  attack:
    data_source: Windows Registry
    data_component: windows registry key creation
  behavior:
    source: user
    relationship: created
    target: windows registry key
  security_events:
  - event_id: 12
    name: RegistryEvent (Object create and delete).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: RegistryKeyCreated
    name: RegistryKeyCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes:
  - Potential contribution for ATT&CK - Windows Registry / windows registry key creation
- name: User created instance from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Instance
    data_component: instance creation
  behavior:
    source: user
    relationship: created instance from
    target: ip
  security_events:
  - event_id: RunInstances
    name: RunInstances
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: Host blocked listener on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked listener on
    target: port
  security_events:
  - event_id: 5155
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Host blocked connection from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked connection from
    target: ip
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FirewallInboundConnectionBlocked
    name: FirewallInboundConnectionBlocked
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User connected from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected from
    target: ip
  security_events:
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: InboundConnectionAccepted
    name: InboundConnectionAccepted
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User modified AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Active Directory
    data_component: active directory object modification
  behavior:
    source: user
    relationship: modified
    target: ad object
  security_events:
  - event_id: 5136
    name: A directory service object was modified.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 5139
    name: A directory service object was moved.
    platform: Windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4719
    name: System audit policy was changed.
    platform: Windows
    audit_category: Policy Change
    audit_sub_category: Policy Change
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5139
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719
  notes: null
- name: Host permitted listener on Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: permitted listener on
    target: process
  security_events:
  - event_id: 5154
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User enumerated Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Group
    data_component: group enumeration
  behavior:
    source: user
    relationship: enumerated
    target: group
  security_events:
  - event_id: 4798
    name: A user's local group membership was enumerated.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4799
    name: A security-enabled local group membership was enumerated.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799
  notes: null
- name: Process connected from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected from
    target: ip
  security_events:
  - event_id: 5156
    name: The Windows Filtering Platform has permitted a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 3
    name: Network connection.
    platform: Windows
    audit_category: NetworkConnect
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 3
    name: Network connection.
    platform: Linux
    audit_category: NetworkConnect
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: InboundConnectionAccepted
    name: InboundConnectionAccepted
    platform: Windows
    audit_category: null
    log_channel: DeviceNetworkEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User disabled Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Scheduled Job
    data_component: scheduled job modification
  behavior:
    source: user
    relationship: disabled
    target: scheduled job
  security_events:
  - event_id: 4701
    name: A scheduled task was disabled.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: ScheduledTaskModified
    name: ScheduledTaskModified
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User added Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall rule modification
  behavior:
    source: user
    relationship: added
    target: firewall rule
  security_events:
  - event_id: 2004
    name: A rule has been added to the Windows Defender Firewall exception list
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_provider: Microsoft-Windows-Windows Firewall With Advanced Security
  - event_id: CreateRuleGroup
    name: CreateRuleGroup
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: User created Network Share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Share
    data_component: network share creation
  behavior:
    source: user
    relationship: created
    target: network share
  security_events:
  - event_id: 5142
    name: A network share object was added.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: User attempted to authenticate from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Reid Gilman @reidgilman
  - Olaf Hartong @olafhartong
  attack:
    data_source: User Account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate from
    target: ip
  security_events:
  - event_id: 4624
    name: An account was successfully logged on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4625
    name: An account failed to log on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Account Lockout
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4648
    name: A logon was attempted using explicit credentials.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: LogonSuccess
    name: LogonSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceLogonEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: ConsoleLogin
    name: ConsoleLogin
    platform: AWS
    audit_category: AwsConsoleSignin
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html
  notes: null
- name: User terminated Logon session
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Logon Session
    data_component: logon session termination
  behavior:
    source: user
    relationship: terminated
    target: logon session
  security_events:
  - event_id: 4634
    name: An account was logged off.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logoff
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4647
    name: User initiated logoff.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logoff
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647
  notes: null
- name: Host blocked connection to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: host
    relationship: blocked connection to
    target: ip
  security_events:
  - event_id: 5157
    name: The Windows Filtering Platform has blocked a connection.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: FirewallOutboundConnectionBlocked
    name: FirewallOutboundConnectionBlocked
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User deleted Network share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Share
    data_component: network share deletion
  behavior:
    source: user
    relationship: deleted
    target: network share
  security_events:
  - event_id: 5144
    name: A network share object was deleted.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File Share
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Process created Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Process
    data_component: process creation
  behavior:
    source: process
    relationship: created
    target: process
  security_events:
  - event_id: 4688
    name: A new process has been created.
    platform: Windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 1
    name: Process Creation.
    platform: Windows
    audit_category: ProcessCreate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 1
    name: Process Creation.
    platform: Linux
    audit_category: ProcessCreate
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: ProcessCreated
    name: ProcessCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceProcessEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User deleted User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: User Account
    data_component: user account deletion
  behavior:
    source: user
    relationship: deleted
    target: user
  security_events:
  - event_id: 4726
    name: A user account was deleted.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4743
    name: A computer account was deleted.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Computer Account Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: UserAccountDeleted
    name: UserAccountDeleted
    platform: Windows
    audit_category: null
    log_channel: DeviceEvents
    log_provider: Microsoft Defender for Endpoint
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743
  notes: null
- name: Process modified Windows registry key
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Windows Registry
    data_component: windows registry key modification
  behavior:
    source: process
    relationship: modified
    target: windows registry key
  security_events:
  - event_id: 13
    name: RegistryEvent (Value Set).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 14
    name: RegistryEvent (Key and Value Rename).
    platform: Windows
    audit_category: RegistryEvent
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 4670
    name: Permissions on an object were changed.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Registry
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: RegistryKeyCreated
    name: RegistryKeyCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceRegistryEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: Process loaded Module
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: Module
    data_component: module load
  behavior:
    source: process
    relationship: loaded
    target: module
  security_events:
  - event_id: 7
    name: Image loaded.
    platform: Windows
    audit_category: ImageLoad
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: ImageLoaded
    name: ImageLoaded
    platform: Windows
    audit_category: null
    log_channel: DeviceImageLoadEvents
    log_provider: Microsoft Defender for Endpoint
  references: null
  notes: null
- name: User modified Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Firewall
    data_component: firewall rule modification
  behavior:
    source: user
    relationship: modified
    target: firewall rule
  security_events:
  - event_id: 2005
    name: A rule has been modified in the Windows Defender Firewall exception list.
    platform: Windows
    audit_category: null
    audit_sub_category: null
    log_channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_provider: Microsoft-Windows-Windows Firewall With Advanced Security
  - event_id: UpdateRuleGroup
    name: UpdateRuleGroup
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: Process created File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: File
    data_component: file creation
  behavior:
    source: process
    relationship: created
    target: file
  security_events:
  - event_id: 11
    name: FileCreate.
    platform: Windows
    audit_category: FileCreate
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  - event_id: 11
    name: FileCreate.
    platform: Linux
    audit_category: FileCreate
    log_channel: Linux-Sysmon/Operational
    log_provider: Linux-Sysmon
  - event_id: FileCreated
    name: FileCreated
    platform: Windows
    audit_category: null
    log_channel: DeviceFileEvents
    log_provider: Microsoft Defender for Endpoint
  - event_id: 4663
    name: An attempt was made to access an object.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: File System
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=WriteData".
- name: User retrieved information about Cloud service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: Cloud Service
    data_component: cloud service metadata
  behavior:
    source: user
    relationship: retrieved information about
    target: cloud service
  security_events:
  - event_id: GetTrail
    name: GetTrail
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: GetTrailStatus
    name: GetTrailStatus
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: DescribeTrails
    name: DescribeTrails
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: GetEventSelectors
    name: GetEventSelectors
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  - event_id: GetInsightSelectors
    name: GetInsightSelectors
    platform: AWS
    audit_category: AwsApiCall
    audit_sub_category: null
    log_channel: null
    log_provider: CloudTrail
  references: null
  notes: null
- name: Process attempted to bind on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Network Traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted to bind on
    target: port
  security_events:
  - event_id: 5159
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: Windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references: null
  notes: null
- name: Service started
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: Service
    data_component: service metadata
  behavior:
    source: service
    relationship: started
    target: null
  security_events:
  - event_id: 4
    name: Sysmon service state changed.
    platform: Windows
    audit_category: ServiceStateChange
    log_channel: Microsoft-Windows-Sysmon/Operational
    log_provider: Microsoft-Windows-Sysmon
  references: null
  notes: null
- name: User modified Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Group
    data_component: group modification
  behavior:
    source: user
    relationship: modified
    target: group
  security_events:
  - event_id: 4737
    name: A security-enabled global group was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4728
    name: A member was added to a security-enabled global group.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4729
    name: A member was removed from a security-enabled global group.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4732
    name: A member was added to a security-enabled local group.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4733
    name: A member was removed from a security-enabled local group.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4735
    name: A security-enabled local group was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4764
    name: A groups type was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4755
    name: A security-enabled universal group was changed.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4756
    name: A member was added to a security-enabled universal group.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4757
    name: A member was removed from a security-enabled universal group.
    platform: Windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4764
  notes: null
- name: User created Logon session
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: Logon Session
    data_component: logon session creation
  behavior:
    source: user
    relationship: created
    target: logon session
  security_events:
  - event_id: 4624
    name: An account was successfully logged on.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4778
    name: A session was reconnected to a Window Station.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Other Logon/Logoff Events
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4964
    name: Special groups have been assigned to a new logon.
    platform: Windows
    audit_category: Logon/Logoff
    audit_sub_category: Special Logon
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: 4776
    name: The domain controller attempted to validate the credentials for an account.
    platform: Windows
    audit_category: Account Logon
    audit_sub_category: Credential Validation
    log_channel: Security
    log_provider: Microsoft-Windows-Security-Auditing
  - event_id: LogonSuccess
    name: LogonSuccess
    platform: Windows
    audit_category: null
    log_channel: DeviceLogonEvents
    log_provider: Microsoft Defender for Endpoint
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
  notes: null