| DET0210 |
Abuse of Domain Accounts |
T1078.002 |
| DET0354 |
Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers |
T1133 |
| DET0283 |
Behavior-chain detection for T1134 Access Token Manipulation on Windows |
T1134 |
| DET0456 |
Behavior-chain detection for T1134.002 Create Process with Token (Windows) |
T1134.002 |
| DET0021 |
Behavioral Detection for Service Stop across Platforms |
T1489 |
| DET0590 |
Behavioral Detection of External Website Defacement across Platforms |
T1491.002 |
| DET0596 |
Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution |
T1021.004 |
| DET0178 |
Behavioral Detection of Unauthorized VNC Remote Control Sessions |
T1021.005 |
| DET0498 |
Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows) |
T1134.003 |
| DET0488 |
Detect abuse of Trusted Relationships (third-party and delegated admin access) |
T1199 |
| DET0312 |
Detect Active Setup Persistence via StubPath Execution |
T1547.014 |
| DET0507 |
Detect browser session hijacking via privilege, handle access, and remote thread into browsers |
T1185 |
| DET0061 |
Detect Default File Association Hijack via Registry & Execution Correlation on Windows |
T1546.001 |
| DET0144 |
Detect Forged Kerberos Golden Tickets (T1558.001) |
T1558.001 |
| DET0241 |
Detect Forged Kerberos Silver Tickets (T1558.002) |
T1558.002 |
| DET0157 |
Detect Kerberoasting Attempts (T1558.003) |
T1558.003 |
| DET0522 |
Detect Kerberos Ticket Theft or Forgery (T1558) |
T1558 |
| DET0125 |
Detect persistence via reopened application plist modification (macOS) |
T1547.007 |
| DET0420 |
Detect User Activity Based Sandbox Evasion via Input & Artifact Probing |
T1497.002 |
| DET0546 |
Detection of Abused or Compromised Cloud Accounts for Access and Persistence |
T1078.004 |
| DET0465 |
Detection of Default Account Abuse Across Platforms |
T1078.001 |
| DET0803 |
Detection of External Remote Services |
T0822 |
| DET0796 |
Detection of Internet Accessible Device |
T0883 |
| DET0407 |
Detection of Local Account Abuse for Initial Access and Persistence |
T1078.003 |
| DET0560 |
Detection of Valid Account Abuse Across Platforms |
T1078 |
| DET0724 |
Detection of Valid Accounts |
T0859 |
| DET0345 |
Detection Strategy for Abuse Elevation Control Mechanism (T1548) |
T1548 |
| DET0514 |
Detection Strategy for Exploitation for Privilege Escalation |
T1068 |
| DET0148 |
Detection Strategy for Forged SAML Tokens |
T1606.002 |
| DET0160 |
Detection Strategy for Multi-Factor Authentication Request Generation (T1621) |
T1621 |
| DET0388 |
Detection Strategy for T1548.002 – Bypass User Account Control (UAC) |
T1548.002 |
| DET0054 |
Internal Spearphishing via Trusted Accounts |
T1534 |
| DET0327 |
Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity |
T1021.001 |