Suspicious and Malicious Activity Explained by Statistical Anomalies
This catalog explains how observable suspicious and malicious activity can manifest as statistical anomalies. It connects ATT&CK-aligned activity to the reference population, expected behavior, measurable deviation, applicable statistical anomaly types, and supporting log sources.
An anomaly does not prove malicious intent. It establishes that observed behavior differs materially from an explicit expectation. Activities that are better detected through signatures, deterministic policy checks, or threat intelligence are marked as weak anomaly candidates.
Integrated research path
Research foundations · Operational families · Telemetry contracts · Maintained query examples · Validation limits.
Each row below retains its original model anchor. Family links are editorial conceptual associations, not a one-to-one taxonomy or proof of a successful detector. The retained CTI report associations are context, not newly re-audited per-row incident evidence. For explicit observed-versus-inferred case statements, use the incident register. Historical ATT&CK IDs remain visible where the old catalog used them; the version boundary explains why identifiers must not be silently treated as current.
Mapping Model
For every mapping:
- Comparison unit identifies the entity, group, sequence, graph, or distribution being evaluated.
- Expected behavior defines the relevant baseline or reference model.
- Statistical explanation states the measurable deviation produced by the activity.
- Anomaly types link to the precise statistical concepts that explain the deviation.
- Evidence sources link to telemetry capable of measuring it.
- Contextual report links to a retained report reference and its original publisher. Per-row support was not re-audited in this review; a link alone does not verify the behavior-to-report association. Statistical interpretation remains the catalog author’s proposal.
A report may provide useful context for multiple mappings. Unless an exact supporting page/section is recorded and checked, treat the row association as contextual, not established incident evidence. This status does not assert that the report is false or that no support exists.
Reconnaissance
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Repeated probing of public services — T1595 Active Scanning · simulation · detections | Unit: source address or source network. Expected: ordinary clients contact a small set of exposed services. Deviation: unusually high destination-port or destination-host fan-out within a short interval. Research: Frequency / Rate | Rate Anomaly, Burst Anomaly, Fan-Out Anomaly | Network Firewall Logs, Network Flow Logs | Documented in FortiGuard Incident Response Report H1 2023 — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Enumeration of public web paths and APIs — T1595.003 Wordlist Scanning · simulation · detections | Unit: client session. Expected: requests follow common application paths with ordinary response-code proportions. Deviation: high path diversity, repeated missing-resource responses, and an unusual request composition. Research: Protocol / Application Usage | Count Anomaly, Ratio or Proportion Anomaly, Categorical-Distribution Anomaly | Web Server Access Logs, Web Application Firewall Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| DNS enumeration or zone-transfer attempts — T1590 Gather Victim Network Information · simulation · detections | Unit: requesting client. Expected: clients request a limited distribution of record types and names. Deviation: rare query types, unusually broad name coverage, or a sudden increase in authoritative queries. Research: Protocol / Application Usage | Rare-Category Anomaly, Volume Anomaly, Distribution-Shift Anomaly | Authoritative DNS Logs, DNS Resolver Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
Initial Access
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Malicious attachment, link, or message delivery — T1566 Phishing · simulation · detections | Unit: sender-recipient relationship and message feature vector. Expected: established senders use recurring infrastructure, content types, and recipient groups. Deviation: first-seen sender-recipient edge combined with unusual attachment, URL, or message characteristics. Research: Sequence | Edge Anomaly, Novel-Category Anomaly, Multivariate Combination Anomaly | Email Gateway Logs, Mailbox Audit Logs | Documented in Truebot joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| User opens delivered content followed by execution — T1566 Phishing · simulation · detections | Unit: user and endpoint event sequence. Expected: opening messages or documents rarely transitions directly to script or command execution. Deviation: low-probability communication-to-file-to-process transition. Research: Sequence · Parent-Child Execution · Multi-Event Correlation | Sequence-Order Anomaly, Transition Anomaly, Cross-View Anomaly | Email Gateway Logs, File-System Activity Logs, Process Execution Logs | Documented in Truebot joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Public-facing application exploitation — T1190 Exploit Public-Facing Application · simulation · detections | Unit: request and application process. Expected: requests produce known response patterns and application behavior. Deviation: request feature combinations, error distributions, or request-to-child-process transitions outside the normal application flow. Signature detection is often stronger for known exploits. Research: Parent-Child Execution | Conditional Anomaly, Transition Anomaly, Distribution-Shift Anomaly | Web Application Firewall Logs, Web Server Access Logs, Application Runtime Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Valid credentials used from an unexpected context — T1078 Valid Accounts · simulation · detections | Unit: identity. Expected: each identity and peer group uses a stable set of locations, devices, applications, times, and authentication methods. Deviation: a rare combination or abrupt shift across those attributes. Research: Geographic / ASN · Identity / Access | Self-Baseline Anomaly, Peer-Group Anomaly, Temporal-Context Anomaly, Multivariate Combination Anomaly | Identity Provider Sign-In Logs, Directory-Service Authentication Logs, Remote Access and VPN Authentication Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| External remote-service session — T1133 External Remote Services · simulation · detections | Unit: user-device-service relationship. Expected: remote access follows established source, device, and destination relationships. Deviation: a new edge, unusual session duration, or access outside the entity's temporal context. Research: Temporal · Geographic / ASN | Edge Anomaly, Duration Anomaly, Temporal-Context Anomaly | Remote Access and VPN Authentication Logs, Remote Desktop and Remote Support Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Compromised software or update installation — T1195 Supply Chain Compromise · simulation · detections | Unit: package, publisher, and installation population. Expected: approved packages originate from known publishers and produce consistent post-install behavior. Deviation: novel package-publisher combination or synchronized behavioral shift across many endpoints. Research: State-Change | Category-Combination Anomaly, Synchronization Anomaly, Population Anomaly | Package and Software Installation Logs, Artifact Repository Logs, Process Execution Logs | Documented in Mandiant SUNBURST investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
Execution
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Command or scripting interpreter execution — T1059 Command and Scripting Interpreter · simulation · detections | Unit: user, host, and process lineage. Expected: interpreters are launched by recurring parents with familiar arguments. Deviation: rare parent-interpreter edge, first-seen argument pattern, or unusual execution rate. Research: Rare Process / Service | Self-Baseline Anomaly, Edge Anomaly, Rare-Category Anomaly | Process Execution Logs, Script-Execution Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| PowerShell script, encoded content, or remote command execution — T1059.001 PowerShell · simulation · detections | Unit: account-host-script combination. Expected: recurring administrative scripts use known modules, hosts, and execution paths. Deviation: novel script features, uncommon account-host relationship, or unusual sequence of module and process activity. Research: Parent-Child Execution | Novel-Category Anomaly, Category-Combination Anomaly, Sequence-Order Anomaly | Windows PowerShell Logs, Process Execution Logs | Documented in Truebot joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Trusted system binary launches unexpected content — T1218 System Binary Proxy Execution · simulation · detections | Unit: parent-child process relationship and command context. Expected: trusted binaries execute a limited set of recurring children or resources. Deviation: an otherwise common binary forms a rare edge or conditional combination. Research: Parent-Child Execution | Conditional Anomaly, Edge Anomaly, Category-Combination Anomaly | Process Execution Logs, Application-Control Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Scheduled job, service, or automation executes payload — T1053 Scheduled Task/Job · simulation · detections | Unit: scheduled object and resulting process sequence. Expected: scheduled objects run consistent actions at recurring times. Deviation: new action, new owner, phase change, or unexpected task-to-process transition. Research: Temporal | Phase Anomaly, Transition Anomaly, Novel-Category Anomaly | Scheduled Task and Job Logs, Process Execution Logs | Documented in FortiGuard Incident Response Report H1 2023 — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Container administration interface executes command — T1609 Container Administration Command · simulation · detections | Unit: identity-namespace-workload relationship. Expected: a small approved set of identities performs interactive execution in specific namespaces. Deviation: new identity-to-namespace edge or rare service-account action. Research: Sequence | Edge Anomaly, Peer-Group Anomaly, Rare-Category Anomaly | Orchestrator Audit Logs, Container Runtime Logs | Documented in Sysdig TeamTNT kubelet investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Unexpected serverless or cloud-workload invocation — T1648 Serverless Execution · simulation · detections | Unit: function, caller, and trigger. Expected: functions are invoked by known trigger and caller combinations with stable rates. Deviation: new caller-trigger edge, burst, or invocation outside established temporal context. Research: Sequence | Edge Anomaly, Burst Anomaly, Temporal-Context Anomaly | Cloud Function and Serverless Logs, Cloud Control-Plane Audit Logs | Documented in Sysdig AI-assisted cloud intrusion investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
Persistence and Privilege Escalation
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| New local, domain, cloud, or service account — T1136 Create Account · simulation · detections | Unit: creator, target account type, and time. Expected: account creation is performed by a small set of provisioning identities following recurring workflows. Deviation: rare creator, unusual account type, or creation outside expected sequence. Research: Identity / Access · State-Change | Peer-Group Anomaly, Rare-Category Anomaly, Transition Anomaly | Directory-Service Audit Logs, Identity Provider Audit Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Credential, group, role, or account-property modification — T1098 Account Manipulation · simulation · detections | Unit: identity privilege graph. Expected: privilege edges are created through known administrators and approved paths. Deviation: new high-impact edge, uncommon path to privilege, or sudden graph restructuring. Research: Graph / Relationship · Identity / Access · State-Change | Edge Anomaly, Graph-Path-Length Anomaly, Graph-Evolution Anomaly | Directory-Service Audit Logs, Cloud Identity and Access Management Logs | Documented in FortiGuard Incident Response Report H1 2023 — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Startup or logon configuration changed to launch code — T1547 Boot or Logon Autostart Execution · simulation · detections | Unit: host and autostart location. Expected: stable set of startup entries and executable targets. Deviation: first-seen target, unusual modification actor, or abrupt state transition. Research: State-Change | Novel-Category Anomaly, Self-Baseline Anomaly, Change-Point Anomaly | Registry and Configuration-Store Logs, File-System Activity Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| New or modified system service — T1543 Create or Modify System Process · simulation · detections | Unit: host-service-binary relationship. Expected: services and binary paths remain stable for a host class. Deviation: new edge or service configuration unlike peers. Research: Rare Process / Service · State-Change | Edge Anomaly, Peer-Group Anomaly, Novel-Category Anomaly | Service and Daemon Management Logs, Windows System Event Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Email forwarding rule created — T1114.003 Email Forwarding Rule · simulation · detections | Unit: mailbox-destination relationship. Expected: forwarding is absent or targets a small stable destination set. Deviation: first-seen external destination or rule created outside the user's normal workflow. Research: Identity / Access · State-Change | Edge Anomaly, Novel-Category Anomaly, Temporal-Context Anomaly | Mailbox Audit Logs, Application Audit Logs | Documented in FortiGuard Incident Response Report H1 2023 — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Privileged or long-running container workload deployed — T1610 Deploy Container · simulation · detections | Unit: deployer-image-namespace-runtime configuration. Expected: peer workloads use approved images and recurring privilege profiles. Deviation: rare combination of privilege, image, mounts, identity, and namespace. Research: Peer-Group | Multivariate Combination Anomaly, Peer-Group Anomaly, Novel-Category Anomaly | Orchestrator Audit Logs, Container Runtime Logs, Container Image Registry Logs | Documented in Sysdig SCARLETEEL 2.0 ATT&CK analysis — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Process or account invokes elevation mechanism — T1548 Abuse Elevation Control Mechanism · simulation · detections | Unit: identity, host, and elevation action. Expected: elevation is concentrated among specific roles and tools. Deviation: peer-group deviation, unusual transition from low to high privilege, or burst of elevation actions. Research: Peer-Group | Peer-Group Anomaly, Transition Anomaly, Burst Anomaly | Windows Security Event Logs, Linux Authentication Logs | Documented in Sysdig AI-assisted cloud intrusion investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
Defense Evasion
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Object renamed to resemble trusted object — T1036 Masquerading · simulation · detections | Unit: name-path-hash-publisher combination. Expected: trusted names correspond to stable paths, hashes, and publishers. Deviation: common name appears in an improbable feature combination. Research: Rare Process / Service | Conditional Anomaly, Category-Combination Anomaly, Multivariate Combination Anomaly | Process Execution Logs, Application-Control Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Encoded, packed, or obfuscated content — T1027 Obfuscated Files or Information · simulation · detections | Unit: content or command representation. Expected: ordinary content has stable length, entropy, token, and character distributions. Deviation: extreme entropy, rare token composition, or distribution shift. Research: Multi-Event Correlation | Tail Anomaly, Entropy Anomaly, Distribution-Shift Anomaly | Script-Execution Logs, Content Inspection and Malware Scanning Logs | Documented in Mandiant SUNBURST investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Process injection or in-memory execution — T1055 Process Injection · simulation · detections | Unit: process-to-process access graph and event sequence. Expected: cross-process memory and thread relationships occur among a limited set of process pairs. Deviation: rare edge followed by an unusual write-to-execution transition. Research: Graph / Relationship · Multi-Event Correlation | Edge Anomaly, Transition Anomaly, Subgraph Anomaly | Endpoint Detection and Response Telemetry, Memory-Protection and Exploit-Mitigation Logs | Documented in Truebot joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| File timestamps, metadata, logs, or indicators modified — T1070 Indicator Removal · simulation · detections | Unit: file or telemetry stream. Expected: metadata follows causal ordering and log sources emit regularly. Deviation: impossible timestamp relationships, sudden missing telemetry, or abrupt state change. Research: Negative Anomaly (Absence) | Conditional Anomaly, Drought or Silence Anomaly, Missing-Correspondence Anomaly | File-System Activity Logs, Central Log Collector Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Security tool, sensor, or logging disabled — T1562.001 Disable or Modify Tools Historical identifier retained from the older catalog; absent from the imported current enterprise crosswalk. Verify version before operational mapping; no replacement ID is inferred. | Unit: endpoint or source heartbeat stream. Expected: sensors emit recurring telemetry and remain enabled. Deviation: abrupt level shift to zero, missing correspondence, or sustained silence. Research: Negative Anomaly (Absence) | Drought or Silence Anomaly, Level-Shift Anomaly, Missing-Correspondence Anomaly | Endpoint Sensor Health Logs, Central Log Collector Logs, Security Information and Event Management Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Firewall policy disabled or weakened — T1562.004 Disable or Modify System Firewall Historical identifier retained from the older catalog; absent from the imported current enterprise crosswalk. Verify version before operational mapping; no replacement ID is inferred. | Unit: firewall rule population and actor. Expected: policy changes originate from a limited admin group and approved change process. Deviation: rare actor-rule combination or abrupt distribution shift toward permissive rules. Research: State-Change | Peer-Group Anomaly, Category-Combination Anomaly, Distribution-Shift Anomaly | Local Firewall Logs, Network Firewall Logs, Cloud Firewall and Security-Group Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
Credential Access
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Repeated password guessing against an account — T1110 Brute Force · simulation · detections | Unit: account and source. Expected: low failure counts and stable success-to-failure ratio. Deviation: burst, rate increase, or ratio shift. Research: Frequency / Rate | Rate Anomaly, Burst Anomaly, Ratio or Proportion Anomaly | Identity Provider Sign-In Logs, Directory-Service Authentication Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Low-volume failures distributed across many accounts — T1110.003 Password Spraying · simulation · detections | Unit: source-to-account authentication graph. Expected: a source authenticates to a small set of accounts. Deviation: unusually high fan-out with low per-account frequency. Research: Frequency / Rate · Identity / Access | Fan-Out Anomaly, Graph-Evolution Anomaly, Collective Anomaly | Identity Provider Sign-In Logs, Directory-Service Authentication Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Repeated MFA prompts and denials — T1621 Multi-Factor Authentication Request Generation · simulation · detections | Unit: account challenge sequence. Expected: isolated prompts followed by a prompt response. Deviation: burst of repeated prompts, abnormal inter-arrival times, or unusual denial ratio. Research: Frequency / Rate | Burst Anomaly, Inter-Arrival-Time Anomaly, Ratio or Proportion Anomaly | Multi-Factor Authentication Logs, Identity Provider Sign-In Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Protected credential memory or stores accessed — T1003 OS Credential Dumping · simulation · detections | Unit: process-to-protected-resource relationship. Expected: only a small approved process set accesses credential resources. Deviation: first-seen edge or rare process-resource combination. Research: Rare Process / Service | Edge Anomaly, Rare-Category Anomaly, Conditional Anomaly | Endpoint Detection and Response Telemetry, Memory-Protection and Exploit-Mitigation Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Unusual service-ticket requests — T1558.003 Kerberoasting · simulation · detections | Unit: account-service ticket relationships. Expected: accounts request tickets for a stable service set and encryption distribution. Deviation: fan-out across services, request burst, or rare encryption category. Research: Multi-Event Correlation | Fan-Out Anomaly, Burst Anomaly, Rare-Category Anomaly | Directory-Service Authentication Logs, Windows Security Event Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Cloud secrets, keys, or tokens retrieved — T1552 Unsecured Credentials · simulation · detections | Unit: identity-secret relationship. Expected: stable identities access specific secret sets. Deviation: new edge, peer-group deviation, or sudden access burst. Research: Peer-Group · Identity / Access | Edge Anomaly, Peer-Group Anomaly, Burst Anomaly | Cloud Secrets-Manager Logs, Secrets-Management Logs | Documented in Sysdig SCARLETEEL investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
Discovery and Lateral Movement
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Accounts, groups, roles, or permissions enumerated — T1087 Account Discovery · simulation · detections | Unit: actor and directory-object access stream. Expected: ordinary identities query a narrow object subset. Deviation: broad object fan-out, burst, or peer-group deviation. Research: Graph / Relationship | Fan-Out Anomaly, Volume Anomaly, Peer-Group Anomaly | Directory-Service Audit Logs, Cloud Identity and Access Management Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Internal network services or systems scanned — T1046 Network Service Discovery · simulation · detections | Unit: internal source host. Expected: hosts communicate with a stable peer and service set. Deviation: rapid fan-out across destinations or ports and abrupt graph growth. Research: Frequency / Rate | Fan-Out Anomaly, Rate Anomaly, Graph-Evolution Anomaly | Network Flow Logs, Network Detection and Response Telemetry | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Cloud resources or configurations enumerated — T1580 Cloud Infrastructure Discovery · simulation · detections | Unit: cloud identity and API action distribution. Expected: identities use a role-specific action set. Deviation: peer-group deviation, high API category diversity, or burst of list and describe operations. Research: Peer-Group | Peer-Group Anomaly, Categorical-Distribution Anomaly, Burst Anomaly | Cloud Control-Plane Audit Logs, Cloud Resource-Configuration Inventory | Documented in Sysdig SCARLETEEL investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Remote administrative service used between systems — T1021 Remote Services · simulation · detections | Unit: user-source-destination graph. Expected: administrative connections follow recurring paths. Deviation: new edge, unusual path, or broad fan-out from one source. Research: Graph / Relationship | Edge Anomaly, Graph-Path-Length Anomaly, Fan-Out Anomaly | Network Flow Logs, Windows Security Event Logs, Linux Authentication Logs | Documented in Volt Typhoon joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Tool or payload transferred internally — T1570 Lateral Tool Transfer · simulation · detections | Unit: source-destination-file relationship and sequence. Expected: internal file transfers follow established system pairs and content types. Deviation: new edge followed by remote execution or unusual file category. Research: Sequence · Multi-Event Correlation | Edge Anomaly, Sequence-Order Anomaly, Category-Combination Anomaly | File-System Activity Logs, Network Flow Logs, Process Execution Logs | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
Collection and Exfiltration
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Files, records, messages, or objects accessed in bulk — T1119 Automated Collection · simulation · detections | Unit: identity or process. Expected: stable access volume, object mix, and rate. Deviation: tail-level volume, access burst, or sustained level shift. Research: Volumetric · Data Movement | Volume Anomaly, Tail Anomaly, Level-Shift Anomaly | File-System Activity Logs, Database Audit Logs, Cloud Object-Storage Access Logs | Documented in Sysdig SCARLETEEL investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Email content collected — T1114 Email Collection · simulation · detections | Unit: mailbox actor and operation stream. Expected: users read and export bounded message sets. Deviation: unusual read volume, export operation, or actor-mailbox edge. Research: Data Movement | Volume Anomaly, Edge Anomaly, Rare-Category Anomaly | Mailbox Audit Logs, Application Audit Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Data staged, compressed, or archived — T1074 Data Staged · simulation · detections | Unit: process-path-file sequence. Expected: archive creation occurs in known workflows and paths. Deviation: rare process-path combination, sudden volume accumulation, or collection-to-archive transition. Research: Sequence · Data Movement | Category-Combination Anomaly, Volume Anomaly, Transition Anomaly | Process Execution Logs, File-System Activity Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Large outbound transfer — T1041 Exfiltration Over C2 Channel · simulation · detections | Unit: source-destination flow. Expected: outbound byte volume and destination relationships remain within an entity's normal range. Deviation: extreme volume, new edge, or abrupt level shift. Research: Volumetric · Data Movement | Volume Anomaly, Tail Anomaly, Edge Anomaly | Network Flow Logs, Data Loss Prevention Logs | Documented in FortiGuard Incident Response Report H1 2023 — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Data uploaded to cloud or web service — T1567 Exfiltration Over Web Service · simulation · detections | Unit: identity-destination-upload stream. Expected: approved users upload bounded data to known services. Deviation: new destination edge, peer-group deviation, or upload-volume tail event. Research: Data Movement | Edge Anomaly, Peer-Group Anomaly, Tail Anomaly | Proxy and Secure Web Gateway Logs, Data Loss Prevention Logs | Documented in Scattered Spider joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Transfers deliberately limited to evade controls — T1030 Data Transfer Size Limits · simulation · detections | Unit: repeated source-destination transfers. Expected: transfer sizes and inter-arrival times vary with ordinary usage. Deviation: persistent repeated small transfers, unusual periodicity, or changed autocorrelation. Research: Temporal · Data Movement | Periodicity Anomaly, Autocorrelation Anomaly, Persistent Anomaly | Network Flow Logs, Proxy and Secure Web Gateway Logs | Documented in Truebot joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
Command and Control
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Endpoint communicates periodically with external destination — T1071 Application Layer Protocol · simulation · detections | Unit: source-destination event series. Expected: human and application traffic has characteristic timing variability. Deviation: strong periodicity, unusual autocorrelation, or repeated fixed inter-arrival times. Research: Temporal · Protocol / Application Usage | Periodicity Anomaly, Autocorrelation Anomaly, Inter-Arrival-Time Anomaly | Network Flow Logs, Network Detection and Response Telemetry | Documented in Mandiant SUNBURST investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| DNS carries command, control, or encoded data — T1071.004 DNS · simulation · detections | Unit: client query distribution and sequence. Expected: domain lengths, record types, entropy, and response codes follow stable distributions. Deviation: entropy increase, novel category mix, or unusual periodic query subsequence. Research: Protocol / Application Usage | Entropy Anomaly, Categorical-Distribution Anomaly, Subsequence Anomaly | DNS Resolver Logs, Packet-Capture Data | Documented in Mandiant SUNBURST investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Encrypted or obfuscated network channel — T1573 Encrypted Channel · simulation · detections | Unit: host-destination TLS feature vector. Expected: hosts use recurring certificate, protocol, cipher, and destination combinations. Deviation: first-seen combination or peer-group deviation. Research: Protocol / Application Usage | Novel-Category Anomaly, Multivariate Combination Anomaly, Peer-Group Anomaly | TLS and Certificate Metadata Logs, Network Metadata Logs | Documented in Truebot joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Web or collaboration service used as control channel — T1102 Web Service · simulation · detections | Unit: process-user-service relationship. Expected: approved processes and users access a known service set. Deviation: new relationship, unusual service category, or repeated low-volume sequence. Research: Protocol / Application Usage | Edge Anomaly, Rare-Category Anomaly, Persistent Anomaly | Proxy and Secure Web Gateway Logs, Collaboration Platform Audit Logs | Documented in FortiGuard Incident Response Report H1 2023 — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
Impact
| Activity and ATT&CK | Statistical explanation | Anomaly types | Evidence sources | Contextual report and support status |
|---|---|---|---|---|
| Files, records, or resources deleted or destroyed — T1485 Data Destruction · simulation · detections | Unit: actor or process deletion stream. Expected: deletions occur at bounded rates and within known workflows. Deviation: extreme deletion volume, burst, or abrupt transition from read/write to deletion. Research: State-Change | Volume Anomaly, Burst Anomaly, Transition Anomaly | File-System Activity Logs, Database Audit Logs, Cloud Object-Storage Access Logs | Documented in LockBit joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Files encrypted for impact — T1486 Data Encrypted for Impact · simulation · detections | Unit: process file-operation stream and file population. Expected: ordinary processes modify limited file sets with stable extension distributions. Deviation: sudden high-volume writes, extension-distribution shift, and cascading impact across directories. Research: Volumetric | Volume Anomaly, Categorical-Distribution Anomaly, Cascading Anomaly | File-System Activity Logs, Endpoint Detection and Response Telemetry | Documented in Play ransomware joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Service or system availability disrupted — T1499 Endpoint Denial of Service · simulation · detections | Unit: service metrics and request stream. Expected: request rate, latency, error ratio, and availability stay within operating ranges. Deviation: rate tail event, abrupt level shift, and synchronized error increase. Research: Volumetric | Rate Anomaly, Level-Shift Anomaly, Synchronization Anomaly | Metrics and Monitoring-System Logs, Application Runtime Logs | Documented in F5 Labs 2024 DDoS Attack Trends — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
| Backup, snapshot, or recovery capability impaired — T1490 Inhibit System Recovery · simulation · detections | Unit: backup system action sequence. Expected: backups follow recurring schedules and deletion operations are rare and controlled. Deviation: missing expected backup, unusual deletion transition, or abrupt level shift in protected coverage. Research: Negative Anomaly (Absence) | Missing-Correspondence Anomaly, Transition Anomaly, Level-Shift Anomaly | Backup and Recovery Logs, Cloud Control-Plane Audit Logs | Documented in LockBit joint advisory — downloaded copy (original source) Support: contextual; per-row association not re-audited; page/section not recorded. |
| Unauthorized computation or resource abuse — T1496 Resource Hijacking · simulation · detections | Unit: workload resource-consumption series. Expected: compute, power, cost, and network use follow workload schedules. Deviation: sustained level shift, tail consumption, or emerging upward trend. Research: Peer-Group | Level-Shift Anomaly, Tail Anomaly, Emerging Anomaly | Metrics and Monitoring-System Logs, Cloud Billing and Usage Logs | Documented in Sysdig SCARLETEEL investigation — publisher report Support: contextual; per-row association not re-audited; page/section not recorded. |
Activities with Weak Statistical Explanations
Some activity is suspicious because it matches known malicious content or violates an explicit policy, not because it is statistically unusual. Examples include a known exploit payload, a known-malicious hash, a prohibited tool signature, or a single forbidden configuration change. These should remain primarily signature-based or deterministic detections, with anomaly evidence used only as supporting context.
Downloaded CTI/IR Report Corpus
| Report | Publisher and investigation basis | Links |
|---|---|---|
| PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure | Joint advisory based on confirmed compromises and incident-response findings; commonly associated with Volt Typhoon. | Downloaded copy, original source |
| #StopRansomware: Play Ransomware | Joint FBI, CISA, and ASD's ACSC advisory based on investigations and observed Play ransomware TTPs. | Downloaded copy, original source |
| Scattered Spider | Joint advisory containing TTPs obtained through FBI investigations and partner reporting. | Downloaded copy, original source |
| Increased Truebot Activity Infects U.S. and Canada Based Networks | Joint advisory based on observed Truebot operations, analytical findings, and incident-response guidance. | Downloaded copy, original source |
| FortiGuard Incident Response Report H1 2023 | FortiGuard Labs analysis of incident-response engagements with observed activity mapped to ATT&CK. | Downloaded copy, original source |
| Understanding Ransomware Threat Actors: LockBit | Joint advisory based on FBI investigations and partner reporting, including observed LockBit 3.0 TTPs. | Downloaded copy, original source |
| 2024 DDoS Attack Trends | F5 Labs threat-intelligence analysis of observed DDoS attack telemetry mapped to ATT&CK. | Original publisher report |
| Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims with SUNBURST Backdoor | Mandiant investigation documenting the SolarWinds supply-chain compromise and post-compromise activity. | Original publisher report |
| SCARLETEEL: Operation Leveraging Terraform, Kubernetes, and AWS for Data Theft | Sysdig Threat Research Team investigation of a customer cloud environment and the resulting data theft. | Original publisher report |
| SCARLETEEL 2.0 and the MITRE ATT&CK Framework | Sysdig analysis correlating a documented cloud-native intrusion with ATT&CK behavior. | Original publisher report |
| TeamTNT Targeting Misconfigured Kubelet | Sysdig Threat Research Team investigation of a detected attack against a Kubernetes pod. | Original publisher report |
| AI-Assisted Cloud Intrusion Achieves Admin Access in Eight Minutes | Sysdig Threat Research Team analysis of an observed AWS intrusion involving Lambda code injection and rapid privilege escalation. | Original publisher report |
References
- Suspicious and Malicious Activity by MITRE ATT&CK
- Statistical Anomaly Taxonomy
- Security Log Source Taxonomy
- MITRE ATT&CK Enterprise Matrix
Connected attack and detection workspaces
Attack Tools · Attack Simulations · Detection Rules · Telemetry Library · Linked Tags
These links follow exact active technique IDs or the published model's taxonomy references. They are navigation context, not proof of live simulation, sensor equivalence or detection effectiveness. Retired IDs are not silently migrated.
- T1003 OS Credential Dumping detections — Exact published Atlas technique ID
- T1021 Remote Services detections — Exact published Atlas technique ID
- T1027 Obfuscated Files or Information detections — Exact published Atlas technique ID
- T1030 Data Transfer Size Limits detections — Exact published Atlas technique ID
- T1036 Masquerading detections — Exact published Atlas technique ID
- T1041 Exfiltration Over C2 Channel detections — Exact published Atlas technique ID
- T1046 Network Service Discovery detections — Exact published Atlas technique ID
- T1053 Scheduled Task/Job detections — Exact published Atlas technique ID
- T1055 Process Injection detections — Exact published Atlas technique ID
- T1059 Command and Scripting Interpreter detections — Exact published Atlas technique ID
- T1059.001 PowerShell detections — Exact published Atlas technique ID
- T1070 Indicator Removal detections — Exact published Atlas technique ID
- T1071 Application Layer Protocol detections — Exact published Atlas technique ID
- T1071.004 DNS detections — Exact published Atlas technique ID
- T1074 Data Staged detections — Exact published Atlas technique ID
- T1078 Valid Accounts detections — Exact published Atlas technique ID
- T1087 Account Discovery detections — Exact published Atlas technique ID
- T1098 Account Manipulation detections — Exact published Atlas technique ID
- T1102 Web Service detections — Exact published Atlas technique ID
- T1110 Brute Force detections — Exact published Atlas technique ID
- T1110.003 Password Spraying detections — Exact published Atlas technique ID
- T1114 Email Collection detections — Exact published Atlas technique ID
- T1114.003 Email Forwarding Rule detections — Exact published Atlas technique ID
- T1119 Automated Collection detections — Exact published Atlas technique ID
- T1133 External Remote Services detections — Exact published Atlas technique ID
- T1136 Create Account detections — Exact published Atlas technique ID
- T1190 Exploit Public-Facing Application detections — Exact published Atlas technique ID
- T1195 Supply Chain Compromise detections — Exact published Atlas technique ID
- T1218 System Binary Proxy Execution detections — Exact published Atlas technique ID
- T1485 Data Destruction detections — Exact published Atlas technique ID
- T1486 Data Encrypted for Impact detections — Exact published Atlas technique ID
- T1490 Inhibit System Recovery detections — Exact published Atlas technique ID
- T1496 Resource Hijacking detections — Exact published Atlas technique ID
- T1499 Endpoint Denial of Service detections — Exact published Atlas technique ID
- T1543 Create or Modify System Process detections — Exact published Atlas technique ID
- T1547 Boot or Logon Autostart Execution detections — Exact published Atlas technique ID
- T1548 Abuse Elevation Control Mechanism detections — Exact published Atlas technique ID
- T1552 Unsecured Credentials detections — Exact published Atlas technique ID
- T1558.003 Kerberoasting detections — Exact published Atlas technique ID
- T1566 Phishing detections — Exact published Atlas technique ID
- T1567 Exfiltration Over Web Service detections — Exact published Atlas technique ID
- T1570 Lateral Tool Transfer detections — Exact published Atlas technique ID
- T1573 Encrypted Channel detections — Exact published Atlas technique ID
- T1580 Cloud Infrastructure Discovery detections — Exact published Atlas technique ID
- T1590 Gather Victim Network Information detections — Exact published Atlas technique ID
- T1595 Active Scanning detections — Exact published Atlas technique ID
- T1595.003 Wordlist Scanning detections — Exact published Atlas technique ID
- T1609 Container Administration Command detections — Exact published Atlas technique ID
- T1610 Deploy Container detections — Exact published Atlas technique ID
- T1621 Multi-Factor Authentication Request Generation detections — Exact published Atlas technique ID
- T1648 Serverless Execution detections — Exact published Atlas technique ID