[ { "t": "T0831", "nguon": [ "historian", "ics_protocol" ], "ve_khai": "substitutable", "ve_XAC_MINH": "still unknown", "sigma": [ "t0831" ] }, { "t": "T0836", "nguon": [ "historian" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T0843", "nguon": [ "ot" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T1003.001", "nguon": [ "edr", "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_access_lsass_dump", "proc_access_win_lsass_mimikatz", "sysmon_lsass_memory_dump", "t1003.001" ] }, { "t": "T1003.003", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1003.003" ] }, { "t": "T1003.006", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "win_dcsync_replication", "win_security_dcsync" ] }, { "t": "T1018", "nguon": [ "process", "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "remote_system_discovery", "t1018" ] }, { "t": "T1021.001", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "internal_rdp_lateral", "t1021.001" ] }, { "t": "T1021.002", "nguon": [ "auth", "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "psexec_service_creation", "t1021.002", "win_smb_psexec_lateral" ] }, { "t": "T1027", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_powershell_obfuscation" ] }, { "t": "T1041", "nguon": [ "network" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "net_exfil_over_c2", "net_exfil_over_c2_large_upload" ] }, { "t": "T1046", "nguon": [ "auth", "network" ], "ve_khai": "substitutable", "ve_XAC_MINH": "substitutable", "sigma": [ "lin_ssh_invalid_protocol", "net_internal_port_scan" ] }, { "t": "T1047", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_wmic_process_creation" ] }, { "t": "T1048.003", "nguon": [ "dns" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "dns_exfiltration_high_volume" ] }, { "t": "T1053.005", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_schtasks_creation", "schtasks_creation_persistence" ] }, { "t": "T1055.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "sysmon_createremotethread_loadlibrary" ] }, { "t": "T1056.001", "nguon": [ "edr" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "keylogger_hook_behavior" ] }, { "t": "T1059.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_iis_susp_child_powershell", "proc_creation_win_office_spawn_powershell", "proc_creation_win_powershell_encoded", "t1059.001" ] }, { "t": "T1059.004", "nguon": [ "edr" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_lnx_shell_susp_rev_shells" ] }, { "t": "T1059.005", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_office_susp_macro" ] }, { "t": "T1068", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "win_byovd_vulnerable_driver_load" ] }, { "t": "T1069.002", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "domain_group_recon" ] }, { "t": "T1070.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_wevtutil_clear_logs", "t1070.001" ] }, { "t": "T1071.001", "nguon": [ "network" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "net_beacon_ja3", "net_cobaltstrike_beacon_ja3", "net_meterpreter_ja3", "net_webshell_http_command", "t1071.001" ] }, { "t": "T1071.004", "nguon": [ "dns" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "dns_tunneling_high_entropy" ] }, { "t": "T1074.001", "nguon": [ "[0 KHAI]", "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_staging_mass_copy" ] }, { "t": "T1078", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "t1078", "win_auth_anomalous_valid_account", "win_security_susp_logon_after_spray" ] }, { "t": "T1078.004", "nguon": [ "azuread", "cloud_audit", "cloudtrail" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "cloud_anomalous_console_login", "t1078.004" ] }, { "t": "T1087.002", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "ldap_recon_sharphound" ] }, { "t": "T1090", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1090" ] }, { "t": "T1098", "nguon": [ "cloudtrail" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T1098.001", "nguon": [ "azuread", "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1098.001" ] }, { "t": "T1098.005", "nguon": [ "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1098.005" ] }, { "t": "T1105", "nguon": [ "network" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "net_tool_transfer_ingress", "proc_creation_lnx_susp_curl_download" ] }, { "t": "T1110.001", "nguon": [ "active-response", "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "lin_auth_ssh_bruteforce", "win_auth_rdp_bruteforce" ] }, { "t": "T1110.003", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "t1110.003", "win_security_password_spray" ] }, { "t": "T1114.002", "nguon": [ "cloud_audit", "m365" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1114.002" ] }, { "t": "T1133", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "t1133" ] }, { "t": "T1134.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_potato_seimpersonate" ] }, { "t": "T1190", "nguon": [ "network" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "t1190", "web_exchange_proxylogon", "web_exploit_public_app", "web_log4j_jndi_exploit" ] }, { "t": "T1204.002", "nguon": [ "[0 KHAI]", "mail" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_event_win_office_maldoc_open" ] }, { "t": "T1207", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "win_rogue_dc_dcshadow" ] }, { "t": "T1213", "nguon": [ "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "cloud_info_repo_bulk_download" ] }, { "t": "T1219", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_remote_access_tool" ] }, { "t": "T1482", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "domain_trust_discovery" ] }, { "t": "T1484.001", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "win_gpo_modification" ] }, { "t": "T1485", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_mass_overwrite_delete", "t1485" ] }, { "t": "T1486", "nguon": [ "edr" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_mass_encryption", "t1486" ] }, { "t": "T1489", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "service_stop_backup", "service_stop_critical", "t1489" ] }, { "t": "T1490", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1490" ] }, { "t": "T1491.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_mod_webroot_index" ] }, { "t": "T1496", "nguon": [ "network" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "net_stratum_mining_pool" ] }, { "t": "T1505.003", "nguon": [ "edr", "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_event_win_exchange_webshell_drop", "web_shell_drop_iis", "webshell_drop_child_shell" ] }, { "t": "T1528", "nguon": [ "azuread", "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1528" ] }, { "t": "T1529", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "t1529" ] }, { "t": "T1530", "nguon": [ "cloud_audit", "cloudtrail" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "cloud_storage_mass_object_access" ] }, { "t": "T1539", "nguon": [ "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "cloud_stolen_session_cookie", "t1539" ] }, { "t": "T1543.003", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "win_new_service_creation" ] }, { "t": "T1546.003", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "sysmon_wmi_event_subscription" ] }, { "t": "T1547.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "reg_persistence_run_key", "registry_run_key_persistence" ] }, { "t": "T1548.002", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_uac_bypass_fodhelper", "registry_uac_bypass_fodhelper" ] }, { "t": "T1550.002", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "pass_the_hash_ntlm" ] }, { "t": "T1550.003", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "pass_the_ticket_kerberos" ] }, { "t": "T1552.004", "nguon": [ "process" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "t1552.004" ] }, { "t": "T1558.001", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [] }, { "t": "T1558.003", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "win_kerberoasting_tgs", "win_security_kerberoasting_4769" ] }, { "t": "T1558.004", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "win_security_asreproast_4768" ] }, { "t": "T1560.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_7z_rar_password_archive" ] }, { "t": "T1561.002", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "raw_disk_write_mbr", "t1561.002" ] }, { "t": "T1562.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "proc_creation_win_powershell_set_mppreference", "t1562.001", "win_security_tool_tampering" ] }, { "t": "T1564.008", "nguon": [ "m365" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T1565.001", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "db_stored_data_tamper" ] }, { "t": "T1566.001", "nguon": [ "mail" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "mail_phishing_link", "t1566.001" ] }, { "t": "T1566.002", "nguon": [ "m365", "proxy" ], "ve_khai": "substitutable", "ve_XAC_MINH": "still unknown", "sigma": [ "phish_credential_harvest_url" ] }, { "t": "T1567.002", "nguon": [ "cloudtrail", "network" ], "ve_khai": "substitutable", "ve_XAC_MINH": "still unknown", "sigma": [ "net_exfil_cloud_rclone", "net_exfil_cloud_storage", "t1567.002" ] }, { "t": "T1570", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "lateral_tool_transfer_smb" ] }, { "t": "T1573.002", "nguon": [ "network" ], "ve_khai": "essential", "ve_XAC_MINH": "still unknown", "sigma": [ "net_malleable_c2_profile" ] }, { "t": "T1574.009", "nguon": [ "sysmon" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "file_event_win_unquoted_service_path", "proc_creation_win_wmic_service_discovery" ] }, { "t": "T1606.002", "nguon": [ "auth" ], "ve_khai": "complementary", "ve_XAC_MINH": "complementary", "sigma": [ "t1606.002" ] }, { "t": "T1610", "nguon": [ "kubernetes" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T1611", "nguon": [ "falco" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T1613", "nguon": [ "kubernetes" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [] }, { "t": "T1621", "nguon": [ "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "cloud_mfa_push_fatigue", "t1621" ] }, { "t": "T1648", "nguon": [ "cloud_audit" ], "ve_khai": "complementary", "ve_XAC_MINH": "still unknown", "sigma": [ "cloud_serverless_malicious_function" ] } ]