| DET0397 |
Automated Exfiltration Detection Strategy |
T1020 |
| DET0151 |
Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery |
T1124 |
| DET0010 |
Behavioral Detection of Event Triggered Execution Across Platforms |
T1546 |
| DET0231 |
Behavioral Detection of Systemd Timer Abuse for Scheduled Execution |
T1053.006 |
| DET0112 |
Boot or Logon Initialization Scripts Detection Strategy |
T1037 |
| DET0094 |
Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse |
T1053 |
| DET0290 |
Cross-Platform Detection of Cron Job Abuse for Persistence and Execution |
T1053.003 |
| DET0333 |
Cross-Platform Detection of Scheduled Task/Job Abuse via at Utility |
T1053.002 |
| DET0206 |
Detection of Malicious Kubernetes CronJob Scheduling |
T1053.007 |
| DET0117 |
Detection of Masqueraded Tasks or Services with Suspicious Naming and Execution |
T1036.004 |
| DET0725 |
Detection of Masquerading |
T0849 |
| DET0040 |
Detection of Persistence Artifact Removal Across Host Platforms |
T1070.009 |
| DET0441 |
Detection of Suspicious Scheduled Task Creation and Execution on Windows |
T1053.005 |
| DET0347 |
Detection Strategy for Masquerading via Legitimate Resource Name or Location |
T1036.005 |
| DET0547 |
Detection Strategy for T1505 - Server Software Component |
T1505 |
| DET0540 |
Multi-Platform Behavioral Detection for Compute Hijacking |
T1496.001 |