{"schema_version":"1.0","counts":{"pages":918,"sigma_rules":2791,"sigma_technique_links":3773,"techniques_with_sigma":390,"atlas_basic_concepts":99,"techniques_with_basic_concepts":97,"atlas_anomaly_models":52,"techniques_with_anomaly_models":51,"techniques_with_mitre_guidance":918,"status":{"guidance_only":528,"rule_source_available":390},"live_validated":0},"status_labels":{"rule_source_available":"Rule source available · not validated","guidance_only":"Detection guidance / concepts only","evidence_gap":"Detection evidence gap"},"records":[{"key":"enterprise/T1001","id":"T1001","name":"Data Obfuscation","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1001/","technique_page":"techniques/enterprise/T1001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1001.001","id":"T1001.001","name":"Junk Data","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1001.001/","technique_page":"techniques/enterprise/T1001.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1001.002","id":"T1001.002","name":"Steganography","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1001.002/","technique_page":"techniques/enterprise/T1001.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1001.003","id":"T1001.003","name":"Protocol or Service Impersonation","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1001.003/","technique_page":"techniques/enterprise/T1001.003/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003/","technique_page":"techniques/enterprise/T1003/","status":"rule_source_available","counts":{"sigma":33,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}]},{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.001/","technique_page":"techniques/enterprise/T1003.001/","status":"rule_source_available","counts":{"sigma":73,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.002","id":"T1003.002","name":"Security Account Manager","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.002/","technique_page":"techniques/enterprise/T1003.002/","status":"rule_source_available","counts":{"sigma":28,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.003/","technique_page":"techniques/enterprise/T1003.003/","status":"rule_source_available","counts":{"sigma":23,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.004","id":"T1003.004","name":"LSA Secrets","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.004/","technique_page":"techniques/enterprise/T1003.004/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.005","id":"T1003.005","name":"Cached Domain Credentials","domain":"enterprise","platforms":["Windows","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.005/","technique_page":"techniques/enterprise/T1003.005/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.006","id":"T1003.006","name":"DCSync","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.006/","technique_page":"techniques/enterprise/T1003.006/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.007","id":"T1003.007","name":"Proc Filesystem","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.007/","technique_page":"techniques/enterprise/T1003.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1003.008","id":"T1003.008","name":"/etc/passwd and /etc/shadow","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1003.008/","technique_page":"techniques/enterprise/T1003.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1005/","technique_page":"techniques/enterprise/T1005/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1006","id":"T1006","name":"Direct Volume Access","domain":"enterprise","platforms":["Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1006/","technique_page":"techniques/enterprise/T1006/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1007/","technique_page":"techniques/enterprise/T1007/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1008","id":"T1008","name":"Fallback Channels","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1008/","technique_page":"techniques/enterprise/T1008/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1010","id":"T1010","name":"Application Window Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1010/","technique_page":"techniques/enterprise/T1010/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1011","id":"T1011","name":"Exfiltration Over Other Network Medium","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1011/","technique_page":"techniques/enterprise/T1011/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1011.001","id":"T1011.001","name":"Exfiltration Over Bluetooth","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1011.001/","technique_page":"techniques/enterprise/T1011.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1012","id":"T1012","name":"Query Registry","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1012/","technique_page":"techniques/enterprise/T1012/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1014","id":"T1014","name":"Rootkit","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1014/","technique_page":"techniques/enterprise/T1014/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1016","id":"T1016","name":"System Network Configuration Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1016/","technique_page":"techniques/enterprise/T1016/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1016.001","id":"T1016.001","name":"Internet Connection Discovery","domain":"enterprise","platforms":["Windows","Linux","macOS","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1016.001/","technique_page":"techniques/enterprise/T1016.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1016.002","id":"T1016.002","name":"Wi-Fi Discovery","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1016.002/","technique_page":"techniques/enterprise/T1016.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1018/","technique_page":"techniques/enterprise/T1018/","status":"rule_source_available","counts":{"sigma":16,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1020","id":"T1020","name":"Automated Exfiltration","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1020/","technique_page":"techniques/enterprise/T1020/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1020.001","id":"T1020.001","name":"Traffic Duplication","domain":"enterprise","platforms":["Network Devices","IaaS"],"environments":["cloud","network-infrastructure"],"page":"detections/enterprise/T1020.001/","technique_page":"techniques/enterprise/T1020.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021","id":"T1021","name":"Remote Services","domain":"enterprise","platforms":["Linux","macOS","Windows","IaaS","ESXi"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1021/","technique_page":"techniques/enterprise/T1021/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Graph-Path-Length Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#74-graph-path-length-anomaly"}]},{"key":"enterprise/T1021.001","id":"T1021.001","name":"Remote Desktop Protocol","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1021.001/","technique_page":"techniques/enterprise/T1021.001/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1021.002/","technique_page":"techniques/enterprise/T1021.002/","status":"rule_source_available","counts":{"sigma":36,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.003","id":"T1021.003","name":"Distributed Component Object Model","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1021.003/","technique_page":"techniques/enterprise/T1021.003/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.004","id":"T1021.004","name":"SSH","domain":"enterprise","platforms":["ESXi","Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1021.004/","technique_page":"techniques/enterprise/T1021.004/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.005","id":"T1021.005","name":"VNC","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1021.005/","technique_page":"techniques/enterprise/T1021.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.006","id":"T1021.006","name":"Windows Remote Management","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1021.006/","technique_page":"techniques/enterprise/T1021.006/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.007","id":"T1021.007","name":"Cloud Services","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1021.007/","technique_page":"techniques/enterprise/T1021.007/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1021.008","id":"T1021.008","name":"Direct Cloud VM Connections","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1021.008/","technique_page":"techniques/enterprise/T1021.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1025","id":"T1025","name":"Data from Removable Media","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1025/","technique_page":"techniques/enterprise/T1025/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1027/","technique_page":"techniques/enterprise/T1027/","status":"rule_source_available","counts":{"sigma":87,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"},{"title":"Entropy Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#43-entropy-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"}]},{"key":"enterprise/T1027.001","id":"T1027.001","name":"Binary Padding","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.001/","technique_page":"techniques/enterprise/T1027.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.002","id":"T1027.002","name":"Software Packing","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.002/","technique_page":"techniques/enterprise/T1027.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.003","id":"T1027.003","name":"Steganography","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.003/","technique_page":"techniques/enterprise/T1027.003/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.004","id":"T1027.004","name":"Compile After Delivery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.004/","technique_page":"techniques/enterprise/T1027.004/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.005","id":"T1027.005","name":"Indicator Removal from Tools","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.005/","technique_page":"techniques/enterprise/T1027.005/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.006","id":"T1027.006","name":"HTML Smuggling","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.006/","technique_page":"techniques/enterprise/T1027.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.007","id":"T1027.007","name":"Dynamic API Resolution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.007/","technique_page":"techniques/enterprise/T1027.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.008","id":"T1027.008","name":"Stripped Payloads","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1027.008/","technique_page":"techniques/enterprise/T1027.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.009","id":"T1027.009","name":"Embedded Payloads","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.009/","technique_page":"techniques/enterprise/T1027.009/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.010/","technique_page":"techniques/enterprise/T1027.010/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.011","id":"T1027.011","name":"Fileless Storage","domain":"enterprise","platforms":["Linux","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.011/","technique_page":"techniques/enterprise/T1027.011/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.012","id":"T1027.012","name":"LNK Icon Smuggling","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.012/","technique_page":"techniques/enterprise/T1027.012/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.013","id":"T1027.013","name":"Encrypted/Encoded File","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.013/","technique_page":"techniques/enterprise/T1027.013/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.014","id":"T1027.014","name":"Polymorphic Code","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.014/","technique_page":"techniques/enterprise/T1027.014/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.015","id":"T1027.015","name":"Compression","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.015/","technique_page":"techniques/enterprise/T1027.015/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.016","id":"T1027.016","name":"Junk Code Insertion","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.016/","technique_page":"techniques/enterprise/T1027.016/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.017","id":"T1027.017","name":"SVG Smuggling","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.017/","technique_page":"techniques/enterprise/T1027.017/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1027.018","id":"T1027.018","name":"Invisible Unicode","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1027.018/","technique_page":"techniques/enterprise/T1027.018/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1029","id":"T1029","name":"Scheduled Transfer","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1029/","technique_page":"techniques/enterprise/T1029/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1030","id":"T1030","name":"Data Transfer Size Limits","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1030/","technique_page":"techniques/enterprise/T1030/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Autocorrelation Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#32-autocorrelation-anomaly"},{"title":"Periodicity Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#27-periodicity-anomaly"},{"title":"Persistent Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#111-persistent-anomaly"}]},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1033/","technique_page":"techniques/enterprise/T1033/","status":"rule_source_available","counts":{"sigma":29,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"page":"detections/enterprise/T1036/","technique_page":"techniques/enterprise/T1036/","status":"rule_source_available","counts":{"sigma":38,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"}]},{"key":"enterprise/T1036.001","id":"T1036.001","name":"Invalid Code Signature","domain":"enterprise","platforms":["macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.001/","technique_page":"techniques/enterprise/T1036.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.002","id":"T1036.002","name":"Right-to-Left Override","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.002/","technique_page":"techniques/enterprise/T1036.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.003/","technique_page":"techniques/enterprise/T1036.003/","status":"rule_source_available","counts":{"sigma":26,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.004","id":"T1036.004","name":"Masquerade Task or Service","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.004/","technique_page":"techniques/enterprise/T1036.004/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"page":"detections/enterprise/T1036.005/","technique_page":"techniques/enterprise/T1036.005/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.006","id":"T1036.006","name":"Space after Filename","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.006/","technique_page":"techniques/enterprise/T1036.006/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.007","id":"T1036.007","name":"Double File Extension","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.007/","technique_page":"techniques/enterprise/T1036.007/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.008","id":"T1036.008","name":"Masquerade File Type","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.008/","technique_page":"techniques/enterprise/T1036.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.009","id":"T1036.009","name":"Break Process Trees","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.009/","technique_page":"techniques/enterprise/T1036.009/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.010","id":"T1036.010","name":"Masquerade Account Name","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","onprem","saas"],"page":"detections/enterprise/T1036.010/","technique_page":"techniques/enterprise/T1036.010/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.011","id":"T1036.011","name":"Overwrite Process Arguments","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.011/","technique_page":"techniques/enterprise/T1036.011/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1036.012","id":"T1036.012","name":"Browser Fingerprint","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1036.012/","technique_page":"techniques/enterprise/T1036.012/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1037","id":"T1037","name":"Boot or Logon Initialization Scripts","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1037/","technique_page":"techniques/enterprise/T1037/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1037.001","id":"T1037.001","name":"Logon Script (Windows)","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1037.001/","technique_page":"techniques/enterprise/T1037.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1037.002","id":"T1037.002","name":"Login Hook","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1037.002/","technique_page":"techniques/enterprise/T1037.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1037.003","id":"T1037.003","name":"Network Logon Script","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1037.003/","technique_page":"techniques/enterprise/T1037.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1037.004","id":"T1037.004","name":"RC Scripts","domain":"enterprise","platforms":["macOS","Linux","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1037.004/","technique_page":"techniques/enterprise/T1037.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1037.005","id":"T1037.005","name":"Startup Items","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1037.005/","technique_page":"techniques/enterprise/T1037.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1039","id":"T1039","name":"Data from Network Shared Drive","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1039/","technique_page":"techniques/enterprise/T1039/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1040","id":"T1040","name":"Network Sniffing","domain":"enterprise","platforms":["IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1040/","technique_page":"techniques/enterprise/T1040/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1041","id":"T1041","name":"Exfiltration Over C2 Channel","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1041/","technique_page":"techniques/enterprise/T1041/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","domain":"enterprise","platforms":["Containers","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem"],"page":"detections/enterprise/T1046/","technique_page":"techniques/enterprise/T1046/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"}]},{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1047/","technique_page":"techniques/enterprise/T1047/","status":"rule_source_available","counts":{"sigma":47,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1048","id":"T1048","name":"Exfiltration Over Alternative Protocol","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1048/","technique_page":"techniques/enterprise/T1048/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1048.001","id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1048.001/","technique_page":"techniques/enterprise/T1048.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1048.002","id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1048.002/","technique_page":"techniques/enterprise/T1048.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1048.003/","technique_page":"techniques/enterprise/T1048.003/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1049","id":"T1049","name":"System Network Connections Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1049/","technique_page":"techniques/enterprise/T1049/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1052","id":"T1052","name":"Exfiltration Over Physical Medium","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1052/","technique_page":"techniques/enterprise/T1052/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1052.001","id":"T1052.001","name":"Exfiltration over USB","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1052.001/","technique_page":"techniques/enterprise/T1052.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1053/","technique_page":"techniques/enterprise/T1053/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":2,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Phase Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#28-phase-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1053.002","id":"T1053.002","name":"At","domain":"enterprise","platforms":["Windows","Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1053.002/","technique_page":"techniques/enterprise/T1053.002/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1053.003","id":"T1053.003","name":"Cron","domain":"enterprise","platforms":["Linux","macOS","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1053.003/","technique_page":"techniques/enterprise/T1053.003/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1053.005/","technique_page":"techniques/enterprise/T1053.005/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1053.006","id":"T1053.006","name":"Systemd Timers","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1053.006/","technique_page":"techniques/enterprise/T1053.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1053.007","id":"T1053.007","name":"Container Orchestration Job","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1053.007/","technique_page":"techniques/enterprise/T1053.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055/","technique_page":"techniques/enterprise/T1055/","status":"rule_source_available","counts":{"sigma":24,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Subgraph Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#70-subgraph-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1055.001","id":"T1055.001","name":"Dynamic-link Library Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.001/","technique_page":"techniques/enterprise/T1055.001/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.002","id":"T1055.002","name":"Portable Executable Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.002/","technique_page":"techniques/enterprise/T1055.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.003","id":"T1055.003","name":"Thread Execution Hijacking","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.003/","technique_page":"techniques/enterprise/T1055.003/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.004","id":"T1055.004","name":"Asynchronous Procedure Call","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.004/","technique_page":"techniques/enterprise/T1055.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.005","id":"T1055.005","name":"Thread Local Storage","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.005/","technique_page":"techniques/enterprise/T1055.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.008","id":"T1055.008","name":"Ptrace System Calls","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.008/","technique_page":"techniques/enterprise/T1055.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.009","id":"T1055.009","name":"Proc Memory","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.009/","technique_page":"techniques/enterprise/T1055.009/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.011","id":"T1055.011","name":"Extra Window Memory Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.011/","technique_page":"techniques/enterprise/T1055.011/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.012","id":"T1055.012","name":"Process Hollowing","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.012/","technique_page":"techniques/enterprise/T1055.012/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.013","id":"T1055.013","name":"Process Doppelgänging","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.013/","technique_page":"techniques/enterprise/T1055.013/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.014","id":"T1055.014","name":"VDSO Hijacking","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.014/","technique_page":"techniques/enterprise/T1055.014/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1055.015","id":"T1055.015","name":"ListPlanting","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1055.015/","technique_page":"techniques/enterprise/T1055.015/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1056","id":"T1056","name":"Input Capture","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1056/","technique_page":"techniques/enterprise/T1056/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1056.001","id":"T1056.001","name":"Keylogging","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1056.001/","technique_page":"techniques/enterprise/T1056.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1056.002","id":"T1056.002","name":"GUI Input Capture","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1056.002/","technique_page":"techniques/enterprise/T1056.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1056.003","id":"T1056.003","name":"Web Portal Capture","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1056.003/","technique_page":"techniques/enterprise/T1056.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1056.004","id":"T1056.004","name":"Credential API Hooking","domain":"enterprise","platforms":["Windows","Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1056.004/","technique_page":"techniques/enterprise/T1056.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1057/","technique_page":"techniques/enterprise/T1057/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1059/","technique_page":"techniques/enterprise/T1059/","status":"rule_source_available","counts":{"sigma":75,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"}]},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1059.001/","technique_page":"techniques/enterprise/T1059.001/","status":"rule_source_available","counts":{"sigma":179,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Sequence-Order Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#60-sequence-order-anomaly"}]},{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1059.002/","technique_page":"techniques/enterprise/T1059.002/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1059.003/","technique_page":"techniques/enterprise/T1059.003/","status":"rule_source_available","counts":{"sigma":27,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1059.004/","technique_page":"techniques/enterprise/T1059.004/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1059.005/","technique_page":"techniques/enterprise/T1059.005/","status":"rule_source_available","counts":{"sigma":23,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.006","id":"T1059.006","name":"Python","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1059.006/","technique_page":"techniques/enterprise/T1059.006/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1059.007/","technique_page":"techniques/enterprise/T1059.007/","status":"rule_source_available","counts":{"sigma":21,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.008","id":"T1059.008","name":"Network Device CLI","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1059.008/","technique_page":"techniques/enterprise/T1059.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.009","id":"T1059.009","name":"Cloud API","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1059.009/","technique_page":"techniques/enterprise/T1059.009/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.010","id":"T1059.010","name":"AutoHotKey & AutoIT","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1059.010/","technique_page":"techniques/enterprise/T1059.010/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.011","id":"T1059.011","name":"Lua","domain":"enterprise","platforms":["Linux","Network Devices","Windows","macOS"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1059.011/","technique_page":"techniques/enterprise/T1059.011/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","domain":"enterprise","platforms":["ESXi"],"environments":["onprem","virtualization"],"page":"detections/enterprise/T1059.012/","technique_page":"techniques/enterprise/T1059.012/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1059.013","id":"T1059.013","name":"Container CLI/API","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1059.013/","technique_page":"techniques/enterprise/T1059.013/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","domain":"enterprise","platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1068/","technique_page":"techniques/enterprise/T1068/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1069","id":"T1069","name":"Permission Groups Discovery","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","onprem","saas"],"page":"detections/enterprise/T1069/","technique_page":"techniques/enterprise/T1069/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1069.001","id":"T1069.001","name":"Local Groups","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1069.001/","technique_page":"techniques/enterprise/T1069.001/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1069.002/","technique_page":"techniques/enterprise/T1069.002/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1069.003","id":"T1069.003","name":"Cloud Groups","domain":"enterprise","platforms":["SaaS","IaaS","Office Suite","Identity Provider"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1069.003/","technique_page":"techniques/enterprise/T1069.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Network Devices","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1070/","technique_page":"techniques/enterprise/T1070/","status":"rule_source_available","counts":{"sigma":20,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Drought or Silence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#17-drought-or-silence-anomaly"},{"title":"Missing-Correspondence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#92-missing-correspondence-anomaly"}]},{"key":"enterprise/T1070.003","id":"T1070.003","name":"Clear Command History","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1070.003/","technique_page":"techniques/enterprise/T1070.003/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.004","id":"T1070.004","name":"File Deletion","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1070.004/","technique_page":"techniques/enterprise/T1070.004/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.005","id":"T1070.005","name":"Network Share Connection Removal","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1070.005/","technique_page":"techniques/enterprise/T1070.005/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.006","id":"T1070.006","name":"Timestomp","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1070.006/","technique_page":"techniques/enterprise/T1070.006/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.007","id":"T1070.007","name":"Clear Network Connection History and Configurations","domain":"enterprise","platforms":["Linux","macOS","Windows","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1070.007/","technique_page":"techniques/enterprise/T1070.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.008","id":"T1070.008","name":"Clear Mailbox Data","domain":"enterprise","platforms":["Linux","macOS","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1070.008/","technique_page":"techniques/enterprise/T1070.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.009","id":"T1070.009","name":"Clear Persistence","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1070.009/","technique_page":"techniques/enterprise/T1070.009/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1070.010","id":"T1070.010","name":"Relocate Malware","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1070.010/","technique_page":"techniques/enterprise/T1070.010/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1071","id":"T1071","name":"Application Layer Protocol","domain":"enterprise","platforms":["Linux","macOS","Windows","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1071/","technique_page":"techniques/enterprise/T1071/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Autocorrelation Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#32-autocorrelation-anomaly"},{"title":"Inter-Arrival-Time Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#19-inter-arrival-time-anomaly"},{"title":"Periodicity Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#27-periodicity-anomaly"}]},{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1071.001/","technique_page":"techniques/enterprise/T1071.001/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1071.002","id":"T1071.002","name":"File Transfer Protocols","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1071.002/","technique_page":"techniques/enterprise/T1071.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1071.003","id":"T1071.003","name":"Mail Protocols","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1071.003/","technique_page":"techniques/enterprise/T1071.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1071.004","id":"T1071.004","name":"DNS","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1071.004/","technique_page":"techniques/enterprise/T1071.004/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Entropy Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#43-entropy-anomaly"},{"title":"Subsequence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#30-subsequence-anomaly"}]},{"key":"enterprise/T1071.005","id":"T1071.005","name":"Publish/Subscribe Protocols","domain":"enterprise","platforms":["macOS","Linux","Windows","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1071.005/","technique_page":"techniques/enterprise/T1071.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1072","id":"T1072","name":"Software Deployment Tools","domain":"enterprise","platforms":["Linux","macOS","Network Devices","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","saas"],"page":"detections/enterprise/T1072/","technique_page":"techniques/enterprise/T1072/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1074","id":"T1074","name":"Data Staged","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1074/","technique_page":"techniques/enterprise/T1074/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1074.001","id":"T1074.001","name":"Local Data Staging","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1074.001/","technique_page":"techniques/enterprise/T1074.001/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1074.002","id":"T1074.002","name":"Remote Data Staging","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1074.002/","technique_page":"techniques/enterprise/T1074.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1078/","technique_page":"techniques/enterprise/T1078/","status":"rule_source_available","counts":{"sigma":55,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}]},{"key":"enterprise/T1078.001","id":"T1078.001","name":"Default Accounts","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1078.001/","technique_page":"techniques/enterprise/T1078.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1078.002","id":"T1078.002","name":"Domain Accounts","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1078.002/","technique_page":"techniques/enterprise/T1078.002/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1078.003","id":"T1078.003","name":"Local Accounts","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1078.003/","technique_page":"techniques/enterprise/T1078.003/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1078.004","id":"T1078.004","name":"Cloud Accounts","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1078.004/","technique_page":"techniques/enterprise/T1078.004/","status":"rule_source_available","counts":{"sigma":40,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1080","id":"T1080","name":"Taint Shared Content","domain":"enterprise","platforms":["Windows","SaaS","Linux","macOS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1080/","technique_page":"techniques/enterprise/T1080/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1082/","technique_page":"techniques/enterprise/T1082/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1083/","technique_page":"techniques/enterprise/T1083/","status":"rule_source_available","counts":{"sigma":22,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas","virtualization"],"page":"detections/enterprise/T1087/","technique_page":"techniques/enterprise/T1087/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":8,"live_validated":0},"anomaly_types":[{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1087.001","id":"T1087.001","name":"Local Account","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1087.001/","technique_page":"techniques/enterprise/T1087.001/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1087.002/","technique_page":"techniques/enterprise/T1087.002/","status":"rule_source_available","counts":{"sigma":20,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1087.003","id":"T1087.003","name":"Email Account","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1087.003/","technique_page":"techniques/enterprise/T1087.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1087.004","id":"T1087.004","name":"Cloud Account","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1087.004/","technique_page":"techniques/enterprise/T1087.004/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1090","id":"T1090","name":"Proxy","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1090/","technique_page":"techniques/enterprise/T1090/","status":"rule_source_available","counts":{"sigma":21,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1090.001","id":"T1090.001","name":"Internal Proxy","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1090.001/","technique_page":"techniques/enterprise/T1090.001/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1090.002","id":"T1090.002","name":"External Proxy","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1090.002/","technique_page":"techniques/enterprise/T1090.002/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1090.003","id":"T1090.003","name":"Multi-hop Proxy","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1090.003/","technique_page":"techniques/enterprise/T1090.003/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1090.004","id":"T1090.004","name":"Domain Fronting","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1090.004/","technique_page":"techniques/enterprise/T1090.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1091","id":"T1091","name":"Replication Through Removable Media","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1091/","technique_page":"techniques/enterprise/T1091/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1092","id":"T1092","name":"Communication Through Removable Media","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1092/","technique_page":"techniques/enterprise/T1092/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1095","id":"T1095","name":"Non-Application Layer Protocol","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1095/","technique_page":"techniques/enterprise/T1095/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1098/","technique_page":"techniques/enterprise/T1098/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"},{"title":"Graph-Path-Length Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#74-graph-path-length-anomaly"}]},{"key":"enterprise/T1098.001","id":"T1098.001","name":"Additional Cloud Credentials","domain":"enterprise","platforms":["IaaS","Identity Provider","SaaS"],"environments":["cloud","identity","saas"],"page":"detections/enterprise/T1098.001/","technique_page":"techniques/enterprise/T1098.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098.002","id":"T1098.002","name":"Additional Email Delegate Permissions","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1098.002/","technique_page":"techniques/enterprise/T1098.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098.003","id":"T1098.003","name":"Additional Cloud Roles","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1098.003/","technique_page":"techniques/enterprise/T1098.003/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098.004","id":"T1098.004","name":"SSH Authorized Keys","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Network Devices"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1098.004/","technique_page":"techniques/enterprise/T1098.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098.005","id":"T1098.005","name":"Device Registration","domain":"enterprise","platforms":["Windows","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1098.005/","technique_page":"techniques/enterprise/T1098.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098.006","id":"T1098.006","name":"Additional Container Cluster Roles","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1098.006/","technique_page":"techniques/enterprise/T1098.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1098.007","id":"T1098.007","name":"Additional Local or Domain Groups","domain":"enterprise","platforms":["Windows","macOS","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1098.007/","technique_page":"techniques/enterprise/T1098.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1102","id":"T1102","name":"Web Service","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1102/","technique_page":"techniques/enterprise/T1102/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Persistent Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#111-persistent-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}]},{"key":"enterprise/T1102.001","id":"T1102.001","name":"Dead Drop Resolver","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1102.001/","technique_page":"techniques/enterprise/T1102.001/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1102.002","id":"T1102.002","name":"Bidirectional Communication","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1102.002/","technique_page":"techniques/enterprise/T1102.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1102.003","id":"T1102.003","name":"One-Way Communication","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1102.003/","technique_page":"techniques/enterprise/T1102.003/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1104","id":"T1104","name":"Multi-Stage Channels","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1104/","technique_page":"techniques/enterprise/T1104/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1105/","technique_page":"techniques/enterprise/T1105/","status":"rule_source_available","counts":{"sigma":70,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1106","id":"T1106","name":"Native API","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1106/","technique_page":"techniques/enterprise/T1106/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1110/","technique_page":"techniques/enterprise/T1110/","status":"rule_source_available","counts":{"sigma":25,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}]},{"key":"enterprise/T1110.001","id":"T1110.001","name":"Password Guessing","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1110.001/","technique_page":"techniques/enterprise/T1110.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1110.002","id":"T1110.002","name":"Password Cracking","domain":"enterprise","platforms":["Identity Provider","Linux","macOS","Network Devices","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","identity","network-infrastructure","onprem"],"page":"detections/enterprise/T1110.002/","technique_page":"techniques/enterprise/T1110.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1110.003","id":"T1110.003","name":"Password Spraying","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1110.003/","technique_page":"techniques/enterprise/T1110.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":8,"live_validated":0},"anomaly_types":[{"title":"Collective Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#4-collective-anomaly"},{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"}]},{"key":"enterprise/T1110.004","id":"T1110.004","name":"Credential Stuffing","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1110.004/","technique_page":"techniques/enterprise/T1110.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":9,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1111","id":"T1111","name":"Multi-Factor Authentication Interception","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1111/","technique_page":"techniques/enterprise/T1111/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1112/","technique_page":"techniques/enterprise/T1112/","status":"rule_source_available","counts":{"sigma":78,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1113","id":"T1113","name":"Screen Capture","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1113/","technique_page":"techniques/enterprise/T1113/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1114","id":"T1114","name":"Email Collection","domain":"enterprise","platforms":["Windows","macOS","Linux","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1114/","technique_page":"techniques/enterprise/T1114/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1114.001","id":"T1114.001","name":"Local Email Collection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1114.001/","technique_page":"techniques/enterprise/T1114.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1114.002","id":"T1114.002","name":"Remote Email Collection","domain":"enterprise","platforms":["Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1114.002/","technique_page":"techniques/enterprise/T1114.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1114.003","id":"T1114.003","name":"Email Forwarding Rule","domain":"enterprise","platforms":["Linux","macOS","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1114.003/","technique_page":"techniques/enterprise/T1114.003/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}]},{"key":"enterprise/T1115","id":"T1115","name":"Clipboard Data","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1115/","technique_page":"techniques/enterprise/T1115/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1119","id":"T1119","name":"Automated Collection","domain":"enterprise","platforms":["IaaS","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1119/","technique_page":"techniques/enterprise/T1119/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1120","id":"T1120","name":"Peripheral Device Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1120/","technique_page":"techniques/enterprise/T1120/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1123","id":"T1123","name":"Audio Capture","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1123/","technique_page":"techniques/enterprise/T1123/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1124","id":"T1124","name":"System Time Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1124/","technique_page":"techniques/enterprise/T1124/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1125","id":"T1125","name":"Video Capture","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1125/","technique_page":"techniques/enterprise/T1125/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1127","id":"T1127","name":"Trusted Developer Utilities Proxy Execution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1127/","technique_page":"techniques/enterprise/T1127/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1127.001","id":"T1127.001","name":"MSBuild","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1127.001/","technique_page":"techniques/enterprise/T1127.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1127.002","id":"T1127.002","name":"ClickOnce","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1127.002/","technique_page":"techniques/enterprise/T1127.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1127.003","id":"T1127.003","name":"JamPlus","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1127.003/","technique_page":"techniques/enterprise/T1127.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1129","id":"T1129","name":"Shared Modules","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1129/","technique_page":"techniques/enterprise/T1129/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1132","id":"T1132","name":"Data Encoding","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1132/","technique_page":"techniques/enterprise/T1132/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1132.001","id":"T1132.001","name":"Standard Encoding","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1132.001/","technique_page":"techniques/enterprise/T1132.001/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1132.002","id":"T1132.002","name":"Non-Standard Encoding","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1132.002/","technique_page":"techniques/enterprise/T1132.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","domain":"enterprise","platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1133/","technique_page":"techniques/enterprise/T1133/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Duration Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#18-duration-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}]},{"key":"enterprise/T1134","id":"T1134","name":"Access Token Manipulation","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1134/","technique_page":"techniques/enterprise/T1134/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1134.001","id":"T1134.001","name":"Token Impersonation/Theft","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1134.001/","technique_page":"techniques/enterprise/T1134.001/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1134.002","id":"T1134.002","name":"Create Process with Token","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1134.002/","technique_page":"techniques/enterprise/T1134.002/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1134.003","id":"T1134.003","name":"Make and Impersonate Token","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1134.003/","technique_page":"techniques/enterprise/T1134.003/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1134.004","id":"T1134.004","name":"Parent PID Spoofing","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1134.004/","technique_page":"techniques/enterprise/T1134.004/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1134.005","id":"T1134.005","name":"SID-History Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1134.005/","technique_page":"techniques/enterprise/T1134.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1135","id":"T1135","name":"Network Share Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1135/","technique_page":"techniques/enterprise/T1135/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1136","id":"T1136","name":"Create Account","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","Network Devices","Containers","SaaS","Office Suite","Identity Provider","ESXi"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"page":"detections/enterprise/T1136/","technique_page":"techniques/enterprise/T1136/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1136.001","id":"T1136.001","name":"Local Account","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1136.001/","technique_page":"techniques/enterprise/T1136.001/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1136.002","id":"T1136.002","name":"Domain Account","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1136.002/","technique_page":"techniques/enterprise/T1136.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1136.003","id":"T1136.003","name":"Cloud Account","domain":"enterprise","platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1136.003/","technique_page":"techniques/enterprise/T1136.003/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137","id":"T1137","name":"Office Application Startup","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137/","technique_page":"techniques/enterprise/T1137/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137.001","id":"T1137.001","name":"Office Template Macros","domain":"enterprise","platforms":["Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137.001/","technique_page":"techniques/enterprise/T1137.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137.002","id":"T1137.002","name":"Office Test","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137.002/","technique_page":"techniques/enterprise/T1137.002/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137.003","id":"T1137.003","name":"Outlook Forms","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137.003/","technique_page":"techniques/enterprise/T1137.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137.004","id":"T1137.004","name":"Outlook Home Page","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137.004/","technique_page":"techniques/enterprise/T1137.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137.005","id":"T1137.005","name":"Outlook Rules","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137.005/","technique_page":"techniques/enterprise/T1137.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1137.006","id":"T1137.006","name":"Add-ins","domain":"enterprise","platforms":["Windows","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1137.006/","technique_page":"techniques/enterprise/T1137.006/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1140/","technique_page":"techniques/enterprise/T1140/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1176","id":"T1176","name":"Software Extensions","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1176/","technique_page":"techniques/enterprise/T1176/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1176.001","id":"T1176.001","name":"Browser Extensions","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1176.001/","technique_page":"techniques/enterprise/T1176.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1176.002","id":"T1176.002","name":"IDE Extensions","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1176.002/","technique_page":"techniques/enterprise/T1176.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1185","id":"T1185","name":"Browser Session Hijacking","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1185/","technique_page":"techniques/enterprise/T1185/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1187","id":"T1187","name":"Forced Authentication","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1187/","technique_page":"techniques/enterprise/T1187/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1189","id":"T1189","name":"Drive-by Compromise","domain":"enterprise","platforms":["Identity Provider","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1189/","technique_page":"techniques/enterprise/T1189/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1190/","technique_page":"techniques/enterprise/T1190/","status":"rule_source_available","counts":{"sigma":46,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1195","id":"T1195","name":"Supply Chain Compromise","domain":"enterprise","platforms":["Linux","Windows","macOS","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1195/","technique_page":"techniques/enterprise/T1195/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Population Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#9-population-anomaly"},{"title":"Synchronization Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#33-synchronization-anomaly"}]},{"key":"enterprise/T1195.001","id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1195.001/","technique_page":"techniques/enterprise/T1195.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1195.002","id":"T1195.002","name":"Compromise Software Supply Chain","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1195.002/","technique_page":"techniques/enterprise/T1195.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1195.003","id":"T1195.003","name":"Compromise Hardware Supply Chain","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1195.003/","technique_page":"techniques/enterprise/T1195.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1197/","technique_page":"techniques/enterprise/T1197/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1199","id":"T1199","name":"Trusted Relationship","domain":"enterprise","platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1199/","technique_page":"techniques/enterprise/T1199/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1200","id":"T1200","name":"Hardware Additions","domain":"enterprise","platforms":["Windows","Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1200/","technique_page":"techniques/enterprise/T1200/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1201","id":"T1201","name":"Password Policy Discovery","domain":"enterprise","platforms":["Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","identity","network-infrastructure","onprem","saas"],"page":"detections/enterprise/T1201/","technique_page":"techniques/enterprise/T1201/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1202/","technique_page":"techniques/enterprise/T1202/","status":"rule_source_available","counts":{"sigma":39,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1203/","technique_page":"techniques/enterprise/T1203/","status":"rule_source_available","counts":{"sigma":17,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1204","id":"T1204","name":"User Execution","domain":"enterprise","platforms":["Linux","Windows","macOS","IaaS","Containers"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1204/","technique_page":"techniques/enterprise/T1204/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1204.001","id":"T1204.001","name":"Malicious Link","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1204.001/","technique_page":"techniques/enterprise/T1204.001/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1204.002/","technique_page":"techniques/enterprise/T1204.002/","status":"rule_source_available","counts":{"sigma":27,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1204.003","id":"T1204.003","name":"Malicious Image","domain":"enterprise","platforms":["IaaS","Containers"],"environments":["cloud","containers"],"page":"detections/enterprise/T1204.003/","technique_page":"techniques/enterprise/T1204.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1204.004/","technique_page":"techniques/enterprise/T1204.004/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1204.005","id":"T1204.005","name":"Malicious Library","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1204.005/","technique_page":"techniques/enterprise/T1204.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1205","id":"T1205","name":"Traffic Signaling","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1205/","technique_page":"techniques/enterprise/T1205/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1205.001","id":"T1205.001","name":"Port Knocking","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1205.001/","technique_page":"techniques/enterprise/T1205.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1205.002","id":"T1205.002","name":"Socket Filters","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1205.002/","technique_page":"techniques/enterprise/T1205.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1207","id":"T1207","name":"Rogue Domain Controller","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1207/","technique_page":"techniques/enterprise/T1207/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1210","id":"T1210","name":"Exploitation of Remote Services","domain":"enterprise","platforms":["Linux","Windows","macOS","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1210/","technique_page":"techniques/enterprise/T1210/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1211","id":"T1211","name":"Exploitation for Stealth","domain":"enterprise","platforms":["Linux","Windows","macOS","SaaS","IaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1211/","technique_page":"techniques/enterprise/T1211/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1212","id":"T1212","name":"Exploitation for Credential Access","domain":"enterprise","platforms":["Linux","Windows","macOS","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1212/","technique_page":"techniques/enterprise/T1212/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213","id":"T1213","name":"Data from Information Repositories","domain":"enterprise","platforms":["Linux","Windows","macOS","SaaS","IaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1213/","technique_page":"techniques/enterprise/T1213/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213.001","id":"T1213.001","name":"Confluence","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"page":"detections/enterprise/T1213.001/","technique_page":"techniques/enterprise/T1213.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213.002","id":"T1213.002","name":"Sharepoint","domain":"enterprise","platforms":["Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1213.002/","technique_page":"techniques/enterprise/T1213.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213.003","id":"T1213.003","name":"Code Repositories","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"page":"detections/enterprise/T1213.003/","technique_page":"techniques/enterprise/T1213.003/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213.004","id":"T1213.004","name":"Customer Relationship Management Software","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"page":"detections/enterprise/T1213.004/","technique_page":"techniques/enterprise/T1213.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213.005","id":"T1213.005","name":"Messaging Applications","domain":"enterprise","platforms":["Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1213.005/","technique_page":"techniques/enterprise/T1213.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1213.006","id":"T1213.006","name":"Databases","domain":"enterprise","platforms":["IaaS","Linux","macOS","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1213.006/","technique_page":"techniques/enterprise/T1213.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1216","id":"T1216","name":"System Script Proxy Execution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1216/","technique_page":"techniques/enterprise/T1216/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1216.001","id":"T1216.001","name":"PubPrn","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1216.001/","technique_page":"techniques/enterprise/T1216.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1216.002","id":"T1216.002","name":"SyncAppvPublishingServer","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1216.002/","technique_page":"techniques/enterprise/T1216.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1217","id":"T1217","name":"Browser Information Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1217/","technique_page":"techniques/enterprise/T1217/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218/","technique_page":"techniques/enterprise/T1218/","status":"rule_source_available","counts":{"sigma":135,"atlas_basic":2,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"}]},{"key":"enterprise/T1218.001","id":"T1218.001","name":"Compiled HTML File","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.001/","technique_page":"techniques/enterprise/T1218.001/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.002","id":"T1218.002","name":"Control Panel","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.002/","technique_page":"techniques/enterprise/T1218.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.003","id":"T1218.003","name":"CMSTP","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.003/","technique_page":"techniques/enterprise/T1218.003/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.004","id":"T1218.004","name":"InstallUtil","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.004/","technique_page":"techniques/enterprise/T1218.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.005","id":"T1218.005","name":"Mshta","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.005/","technique_page":"techniques/enterprise/T1218.005/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.007","id":"T1218.007","name":"Msiexec","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.007/","technique_page":"techniques/enterprise/T1218.007/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.008","id":"T1218.008","name":"Odbcconf","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.008/","technique_page":"techniques/enterprise/T1218.008/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.009","id":"T1218.009","name":"Regsvcs/Regasm","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.009/","technique_page":"techniques/enterprise/T1218.009/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.010/","technique_page":"techniques/enterprise/T1218.010/","status":"rule_source_available","counts":{"sigma":17,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.011/","technique_page":"techniques/enterprise/T1218.011/","status":"rule_source_available","counts":{"sigma":27,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.012","id":"T1218.012","name":"Verclsid","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.012/","technique_page":"techniques/enterprise/T1218.012/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.013","id":"T1218.013","name":"Mavinject","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.013/","technique_page":"techniques/enterprise/T1218.013/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.014","id":"T1218.014","name":"MMC","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.014/","technique_page":"techniques/enterprise/T1218.014/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1218.015","id":"T1218.015","name":"Electron Applications","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1218.015/","technique_page":"techniques/enterprise/T1218.015/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1219/","technique_page":"techniques/enterprise/T1219/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1219.001","id":"T1219.001","name":"IDE Tunneling","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1219.001/","technique_page":"techniques/enterprise/T1219.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1219.002","id":"T1219.002","name":"Remote Desktop Software","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1219.002/","technique_page":"techniques/enterprise/T1219.002/","status":"rule_source_available","counts":{"sigma":41,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1219.003","id":"T1219.003","name":"Remote Access Hardware","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1219.003/","technique_page":"techniques/enterprise/T1219.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1220","id":"T1220","name":"XSL Script Processing","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1220/","technique_page":"techniques/enterprise/T1220/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1221","id":"T1221","name":"Template Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1221/","technique_page":"techniques/enterprise/T1221/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1222","id":"T1222","name":"File and Directory Permissions Modification","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1222/","technique_page":"techniques/enterprise/T1222/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1222.001","id":"T1222.001","name":"Windows Permissions","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1222.001/","technique_page":"techniques/enterprise/T1222.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1222.002","id":"T1222.002","name":"Linux and Mac Permissions","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1222.002/","technique_page":"techniques/enterprise/T1222.002/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1480","id":"T1480","name":"Execution Guardrails","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1480/","technique_page":"techniques/enterprise/T1480/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1480.001","id":"T1480.001","name":"Environmental Keying","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1480.001/","technique_page":"techniques/enterprise/T1480.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1480.002","id":"T1480.002","name":"Mutual Exclusion","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1480.002/","technique_page":"techniques/enterprise/T1480.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1482/","technique_page":"techniques/enterprise/T1482/","status":"rule_source_available","counts":{"sigma":17,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1484","id":"T1484","name":"Domain or Tenant Policy Modification","domain":"enterprise","platforms":["Windows","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1484/","technique_page":"techniques/enterprise/T1484/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1484.001","id":"T1484.001","name":"Group Policy Modification","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1484.001/","technique_page":"techniques/enterprise/T1484.001/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1484.002","id":"T1484.002","name":"Trust Modification","domain":"enterprise","platforms":["Identity Provider","Windows"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1484.002/","technique_page":"techniques/enterprise/T1484.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1485","id":"T1485","name":"Data Destruction","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem","virtualization"],"page":"detections/enterprise/T1485/","technique_page":"techniques/enterprise/T1485/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1485.001","id":"T1485.001","name":"Lifecycle-Triggered Deletion","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1485.001/","technique_page":"techniques/enterprise/T1485.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1486/","technique_page":"techniques/enterprise/T1486/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Cascading Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#114-cascading-anomaly"},{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1489/","technique_page":"techniques/enterprise/T1489/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1490/","technique_page":"techniques/enterprise/T1490/","status":"rule_source_available","counts":{"sigma":23,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Missing-Correspondence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#92-missing-correspondence-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1491","id":"T1491","name":"Defacement","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","ESXi"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1491/","technique_page":"techniques/enterprise/T1491/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1491.001","id":"T1491.001","name":"Internal Defacement","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1491.001/","technique_page":"techniques/enterprise/T1491.001/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1491.002","id":"T1491.002","name":"External Defacement","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1491.002/","technique_page":"techniques/enterprise/T1491.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1495","id":"T1495","name":"Firmware Corruption","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1495/","technique_page":"techniques/enterprise/T1495/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","Containers","SaaS"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem","saas"],"page":"detections/enterprise/T1496/","technique_page":"techniques/enterprise/T1496/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[{"title":"Emerging Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#113-emerging-anomaly"},{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"}]},{"key":"enterprise/T1496.001","id":"T1496.001","name":"Compute Hijacking","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","Containers"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1496.001/","technique_page":"techniques/enterprise/T1496.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1496.002","id":"T1496.002","name":"Bandwidth Hijacking","domain":"enterprise","platforms":["Linux","Windows","macOS","IaaS","Containers"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1496.002/","technique_page":"techniques/enterprise/T1496.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1496.003","id":"T1496.003","name":"SMS Pumping","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"page":"detections/enterprise/T1496.003/","technique_page":"techniques/enterprise/T1496.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1496.004","id":"T1496.004","name":"Cloud Service Hijacking","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"page":"detections/enterprise/T1496.004/","technique_page":"techniques/enterprise/T1496.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1497","id":"T1497","name":"Virtualization/Sandbox Evasion","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1497/","technique_page":"techniques/enterprise/T1497/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1497.001","id":"T1497.001","name":"System Checks","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1497.001/","technique_page":"techniques/enterprise/T1497.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1497.002","id":"T1497.002","name":"User Activity Based Checks","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1497.002/","technique_page":"techniques/enterprise/T1497.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1497.003","id":"T1497.003","name":"Time Based Checks","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1497.003/","technique_page":"techniques/enterprise/T1497.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1498","id":"T1498","name":"Network Denial of Service","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","Containers"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1498/","technique_page":"techniques/enterprise/T1498/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1498.001","id":"T1498.001","name":"Direct Network Flood","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1498.001/","technique_page":"techniques/enterprise/T1498.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1498.002","id":"T1498.002","name":"Reflection Amplification","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1498.002/","technique_page":"techniques/enterprise/T1498.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1499","id":"T1499","name":"Endpoint Denial of Service","domain":"enterprise","platforms":["Windows","Linux","macOS","Containers","IaaS"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1499/","technique_page":"techniques/enterprise/T1499/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Synchronization Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#33-synchronization-anomaly"}]},{"key":"enterprise/T1499.001","id":"T1499.001","name":"OS Exhaustion Flood","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1499.001/","technique_page":"techniques/enterprise/T1499.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1499.002","id":"T1499.002","name":"Service Exhaustion Flood","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1499.002/","technique_page":"techniques/enterprise/T1499.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1499.003","id":"T1499.003","name":"Application Exhaustion Flood","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1499.003/","technique_page":"techniques/enterprise/T1499.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1499.004","id":"T1499.004","name":"Application or System Exploitation","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1499.004/","technique_page":"techniques/enterprise/T1499.004/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505","id":"T1505","name":"Server Software Component","domain":"enterprise","platforms":["Windows","Linux","macOS","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1505/","technique_page":"techniques/enterprise/T1505/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505.001","id":"T1505.001","name":"SQL Stored Procedures","domain":"enterprise","platforms":["Windows","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1505.001/","technique_page":"techniques/enterprise/T1505.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505.002","id":"T1505.002","name":"Transport Agent","domain":"enterprise","platforms":["Linux","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1505.002/","technique_page":"techniques/enterprise/T1505.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1505.003/","technique_page":"techniques/enterprise/T1505.003/","status":"rule_source_available","counts":{"sigma":23,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505.004","id":"T1505.004","name":"IIS Components","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1505.004/","technique_page":"techniques/enterprise/T1505.004/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505.005","id":"T1505.005","name":"Terminal Services DLL","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1505.005/","technique_page":"techniques/enterprise/T1505.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1505.006","id":"T1505.006","name":"vSphere Installation Bundles","domain":"enterprise","platforms":["ESXi"],"environments":["onprem","virtualization"],"page":"detections/enterprise/T1505.006/","technique_page":"techniques/enterprise/T1505.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1518","id":"T1518","name":"Software Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1518/","technique_page":"techniques/enterprise/T1518/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1518.001","id":"T1518.001","name":"Security Software Discovery","domain":"enterprise","platforms":["IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1518.001/","technique_page":"techniques/enterprise/T1518.001/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1518.002","id":"T1518.002","name":"Backup Software Discovery","domain":"enterprise","platforms":["Windows","macOS","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1518.002/","technique_page":"techniques/enterprise/T1518.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1525","id":"T1525","name":"Implant Internal Image","domain":"enterprise","platforms":["IaaS","Containers"],"environments":["cloud","containers"],"page":"detections/enterprise/T1525/","technique_page":"techniques/enterprise/T1525/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1526","id":"T1526","name":"Cloud Service Discovery","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1526/","technique_page":"techniques/enterprise/T1526/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1528","id":"T1528","name":"Steal Application Access Token","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","containers","identity","onprem","saas"],"page":"detections/enterprise/T1528/","technique_page":"techniques/enterprise/T1528/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1529/","technique_page":"techniques/enterprise/T1529/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1530","id":"T1530","name":"Data from Cloud Storage","domain":"enterprise","platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1530/","technique_page":"techniques/enterprise/T1530/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1531","id":"T1531","name":"Account Access Removal","domain":"enterprise","platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite","ESXi"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas","virtualization"],"page":"detections/enterprise/T1531/","technique_page":"techniques/enterprise/T1531/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1534","id":"T1534","name":"Internal Spearphishing","domain":"enterprise","platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1534/","technique_page":"techniques/enterprise/T1534/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1535","id":"T1535","name":"Unused/Unsupported Cloud Regions","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1535/","technique_page":"techniques/enterprise/T1535/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1537","id":"T1537","name":"Transfer Data to Cloud Account","domain":"enterprise","platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1537/","technique_page":"techniques/enterprise/T1537/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1538","id":"T1538","name":"Cloud Service Dashboard","domain":"enterprise","platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1538/","technique_page":"techniques/enterprise/T1538/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1539","id":"T1539","name":"Steal Web Session Cookie","domain":"enterprise","platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1539/","technique_page":"techniques/enterprise/T1539/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1542","id":"T1542","name":"Pre-OS Boot","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1542/","technique_page":"techniques/enterprise/T1542/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1542.001","id":"T1542.001","name":"System Firmware","domain":"enterprise","platforms":["Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1542.001/","technique_page":"techniques/enterprise/T1542.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1542.002","id":"T1542.002","name":"Component Firmware","domain":"enterprise","platforms":["Windows","Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1542.002/","technique_page":"techniques/enterprise/T1542.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1542.003","id":"T1542.003","name":"Bootkit","domain":"enterprise","platforms":["Linux","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1542.003/","technique_page":"techniques/enterprise/T1542.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1542.004","id":"T1542.004","name":"ROMMONkit","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1542.004/","technique_page":"techniques/enterprise/T1542.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1542.005","id":"T1542.005","name":"TFTP Boot","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1542.005/","technique_page":"techniques/enterprise/T1542.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1543","id":"T1543","name":"Create or Modify System Process","domain":"enterprise","platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1543/","technique_page":"techniques/enterprise/T1543/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}]},{"key":"enterprise/T1543.001","id":"T1543.001","name":"Launch Agent","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1543.001/","technique_page":"techniques/enterprise/T1543.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1543.002","id":"T1543.002","name":"Systemd Service","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1543.002/","technique_page":"techniques/enterprise/T1543.002/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1543.003/","technique_page":"techniques/enterprise/T1543.003/","status":"rule_source_available","counts":{"sigma":38,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1543.004","id":"T1543.004","name":"Launch Daemon","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1543.004/","technique_page":"techniques/enterprise/T1543.004/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1543.005","id":"T1543.005","name":"Container Service","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1543.005/","technique_page":"techniques/enterprise/T1543.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546","id":"T1546","name":"Event Triggered Execution","domain":"enterprise","platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1546/","technique_page":"techniques/enterprise/T1546/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.001","id":"T1546.001","name":"Change Default File Association","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.001/","technique_page":"techniques/enterprise/T1546.001/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.002","id":"T1546.002","name":"Screensaver","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.002/","technique_page":"techniques/enterprise/T1546.002/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.003/","technique_page":"techniques/enterprise/T1546.003/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.004","id":"T1546.004","name":"Unix Shell Configuration Modification","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.004/","technique_page":"techniques/enterprise/T1546.004/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.005","id":"T1546.005","name":"Trap","domain":"enterprise","platforms":["macOS","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.005/","technique_page":"techniques/enterprise/T1546.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.006","id":"T1546.006","name":"LC_LOAD_DYLIB Addition","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1546.006/","technique_page":"techniques/enterprise/T1546.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.007","id":"T1546.007","name":"Netsh Helper DLL","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.007/","technique_page":"techniques/enterprise/T1546.007/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.008","id":"T1546.008","name":"Accessibility Features","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.008/","technique_page":"techniques/enterprise/T1546.008/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.009","id":"T1546.009","name":"AppCert DLLs","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.009/","technique_page":"techniques/enterprise/T1546.009/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.010","id":"T1546.010","name":"AppInit DLLs","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.010/","technique_page":"techniques/enterprise/T1546.010/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.011","id":"T1546.011","name":"Application Shimming","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.011/","technique_page":"techniques/enterprise/T1546.011/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.012","id":"T1546.012","name":"Image File Execution Options Injection","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.012/","technique_page":"techniques/enterprise/T1546.012/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.013","id":"T1546.013","name":"PowerShell Profile","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.013/","technique_page":"techniques/enterprise/T1546.013/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.014","id":"T1546.014","name":"Emond","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1546.014/","technique_page":"techniques/enterprise/T1546.014/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.015","id":"T1546.015","name":"Component Object Model Hijacking","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.015/","technique_page":"techniques/enterprise/T1546.015/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.016","id":"T1546.016","name":"Installer Packages","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.016/","technique_page":"techniques/enterprise/T1546.016/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.017","id":"T1546.017","name":"Udev Rules","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.017/","technique_page":"techniques/enterprise/T1546.017/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1546.018","id":"T1546.018","name":"Python Startup Hooks","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1546.018/","technique_page":"techniques/enterprise/T1546.018/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547","id":"T1547","name":"Boot or Logon Autostart Execution","domain":"enterprise","platforms":["Linux","macOS","Windows","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1547/","technique_page":"techniques/enterprise/T1547/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Change-Point Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#25-change-point-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"}]},{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.001/","technique_page":"techniques/enterprise/T1547.001/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.002","id":"T1547.002","name":"Authentication Package","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.002/","technique_page":"techniques/enterprise/T1547.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.003","id":"T1547.003","name":"Time Providers","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.003/","technique_page":"techniques/enterprise/T1547.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.004","id":"T1547.004","name":"Winlogon Helper DLL","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.004/","technique_page":"techniques/enterprise/T1547.004/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.005","id":"T1547.005","name":"Security Support Provider","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.005/","technique_page":"techniques/enterprise/T1547.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.006","id":"T1547.006","name":"Kernel Modules and Extensions","domain":"enterprise","platforms":["macOS","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.006/","technique_page":"techniques/enterprise/T1547.006/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.007","id":"T1547.007","name":"Re-opened Applications","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1547.007/","technique_page":"techniques/enterprise/T1547.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.008","id":"T1547.008","name":"LSASS Driver","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.008/","technique_page":"techniques/enterprise/T1547.008/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.009","id":"T1547.009","name":"Shortcut Modification","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.009/","technique_page":"techniques/enterprise/T1547.009/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.010","id":"T1547.010","name":"Port Monitors","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.010/","technique_page":"techniques/enterprise/T1547.010/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.012","id":"T1547.012","name":"Print Processors","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.012/","technique_page":"techniques/enterprise/T1547.012/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.013","id":"T1547.013","name":"XDG Autostart Entries","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.013/","technique_page":"techniques/enterprise/T1547.013/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.014","id":"T1547.014","name":"Active Setup","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1547.014/","technique_page":"techniques/enterprise/T1547.014/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1547.015","id":"T1547.015","name":"Login Items","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1547.015/","technique_page":"techniques/enterprise/T1547.015/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","domain":"enterprise","platforms":["Linux","macOS","Windows","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1548/","technique_page":"techniques/enterprise/T1548/","status":"rule_source_available","counts":{"sigma":22,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1548.001","id":"T1548.001","name":"Setuid and Setgid","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1548.001/","technique_page":"techniques/enterprise/T1548.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1548.002/","technique_page":"techniques/enterprise/T1548.002/","status":"rule_source_available","counts":{"sigma":56,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1548.003","id":"T1548.003","name":"Sudo and Sudo Caching","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1548.003/","technique_page":"techniques/enterprise/T1548.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1548.004","id":"T1548.004","name":"Elevated Execution with Prompt","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1548.004/","technique_page":"techniques/enterprise/T1548.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1548.005","id":"T1548.005","name":"Temporary Elevated Cloud Access","domain":"enterprise","platforms":["IaaS","Office Suite","Identity Provider"],"environments":["cloud","identity","onprem"],"page":"detections/enterprise/T1548.005/","technique_page":"techniques/enterprise/T1548.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1548.006","id":"T1548.006","name":"TCC Manipulation","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1548.006/","technique_page":"techniques/enterprise/T1548.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1550","id":"T1550","name":"Use Alternate Authentication Material","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","onprem","saas"],"page":"detections/enterprise/T1550/","technique_page":"techniques/enterprise/T1550/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1550.001","id":"T1550.001","name":"Application Access Token","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","containers","identity","onprem","saas"],"page":"detections/enterprise/T1550.001/","technique_page":"techniques/enterprise/T1550.001/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1550.002","id":"T1550.002","name":"Pass the Hash","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1550.002/","technique_page":"techniques/enterprise/T1550.002/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1550.003","id":"T1550.003","name":"Pass the Ticket","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1550.003/","technique_page":"techniques/enterprise/T1550.003/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1550.004","id":"T1550.004","name":"Web Session Cookie","domain":"enterprise","platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1550.004/","technique_page":"techniques/enterprise/T1550.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","domain":"enterprise","platforms":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas"],"page":"detections/enterprise/T1552/","technique_page":"techniques/enterprise/T1552/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}]},{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","domain":"enterprise","platforms":["Containers","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"page":"detections/enterprise/T1552.001/","technique_page":"techniques/enterprise/T1552.001/","status":"rule_source_available","counts":{"sigma":20,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.002","id":"T1552.002","name":"Credentials in Registry","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1552.002/","technique_page":"techniques/enterprise/T1552.002/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.003","id":"T1552.003","name":"Shell History","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1552.003/","technique_page":"techniques/enterprise/T1552.003/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.004","id":"T1552.004","name":"Private Keys","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1552.004/","technique_page":"techniques/enterprise/T1552.004/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.005","id":"T1552.005","name":"Cloud Instance Metadata API","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1552.005/","technique_page":"techniques/enterprise/T1552.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.006","id":"T1552.006","name":"Group Policy Preferences","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1552.006/","technique_page":"techniques/enterprise/T1552.006/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.007","id":"T1552.007","name":"Container API","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1552.007/","technique_page":"techniques/enterprise/T1552.007/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1552.008","id":"T1552.008","name":"Chat Messages","domain":"enterprise","platforms":["SaaS","Office Suite"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1552.008/","technique_page":"techniques/enterprise/T1552.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553","id":"T1553","name":"Subvert Trust Controls","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1553/","technique_page":"techniques/enterprise/T1553/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553.001","id":"T1553.001","name":"Gatekeeper Bypass","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1553.001/","technique_page":"techniques/enterprise/T1553.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553.002","id":"T1553.002","name":"Code Signing","domain":"enterprise","platforms":["macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1553.002/","technique_page":"techniques/enterprise/T1553.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553.003","id":"T1553.003","name":"SIP and Trust Provider Hijacking","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1553.003/","technique_page":"techniques/enterprise/T1553.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553.004","id":"T1553.004","name":"Install Root Certificate","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1553.004/","technique_page":"techniques/enterprise/T1553.004/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553.005","id":"T1553.005","name":"Mark-of-the-Web Bypass","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1553.005/","technique_page":"techniques/enterprise/T1553.005/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1553.006","id":"T1553.006","name":"Code Signing Policy Modification","domain":"enterprise","platforms":["macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1553.006/","technique_page":"techniques/enterprise/T1553.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1554","id":"T1554","name":"Compromise Host Software Binary","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1554/","technique_page":"techniques/enterprise/T1554/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555","id":"T1555","name":"Credentials from Password Stores","domain":"enterprise","platforms":["IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1555/","technique_page":"techniques/enterprise/T1555/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555.001","id":"T1555.001","name":"Keychain","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1555.001/","technique_page":"techniques/enterprise/T1555.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555.002","id":"T1555.002","name":"Securityd Memory","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1555.002/","technique_page":"techniques/enterprise/T1555.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555.003","id":"T1555.003","name":"Credentials from Web Browsers","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1555.003/","technique_page":"techniques/enterprise/T1555.003/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555.004","id":"T1555.004","name":"Windows Credential Manager","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1555.004/","technique_page":"techniques/enterprise/T1555.004/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555.005","id":"T1555.005","name":"Password Managers","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1555.005/","technique_page":"techniques/enterprise/T1555.005/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1555.006","id":"T1555.006","name":"Cloud Secrets Management Stores","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1555.006/","technique_page":"techniques/enterprise/T1555.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556","id":"T1556","name":"Modify Authentication Process","domain":"enterprise","platforms":["IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","network-infrastructure","onprem","saas"],"page":"detections/enterprise/T1556/","technique_page":"techniques/enterprise/T1556/","status":"rule_source_available","counts":{"sigma":12,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.001","id":"T1556.001","name":"Domain Controller Authentication","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1556.001/","technique_page":"techniques/enterprise/T1556.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.002","id":"T1556.002","name":"Password Filter DLL","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1556.002/","technique_page":"techniques/enterprise/T1556.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.003","id":"T1556.003","name":"Pluggable Authentication Modules","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1556.003/","technique_page":"techniques/enterprise/T1556.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.004","id":"T1556.004","name":"Network Device Authentication","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1556.004/","technique_page":"techniques/enterprise/T1556.004/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.005","id":"T1556.005","name":"Reversible Encryption","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1556.005/","technique_page":"techniques/enterprise/T1556.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.006","id":"T1556.006","name":"Multi-Factor Authentication","domain":"enterprise","platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1556.006/","technique_page":"techniques/enterprise/T1556.006/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.007","id":"T1556.007","name":"Hybrid Identity","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1556.007/","technique_page":"techniques/enterprise/T1556.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.008","id":"T1556.008","name":"Network Provider DLL","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1556.008/","technique_page":"techniques/enterprise/T1556.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1556.009","id":"T1556.009","name":"Conditional Access Policies","domain":"enterprise","platforms":["IaaS","Identity Provider"],"environments":["cloud","identity"],"page":"detections/enterprise/T1556.009/","technique_page":"techniques/enterprise/T1556.009/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1557/","technique_page":"techniques/enterprise/T1557/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1557.001","id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1557.001/","technique_page":"techniques/enterprise/T1557.001/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1557.002","id":"T1557.002","name":"ARP Cache Poisoning","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1557.002/","technique_page":"techniques/enterprise/T1557.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1557.003","id":"T1557.003","name":"DHCP Spoofing","domain":"enterprise","platforms":["Linux","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1557.003/","technique_page":"techniques/enterprise/T1557.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1557.004","id":"T1557.004","name":"Evil Twin","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1557.004/","technique_page":"techniques/enterprise/T1557.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1558","id":"T1558","name":"Steal or Forge Kerberos Tickets","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1558/","technique_page":"techniques/enterprise/T1558/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1558.001","id":"T1558.001","name":"Golden Ticket","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1558.001/","technique_page":"techniques/enterprise/T1558.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1558.002","id":"T1558.002","name":"Silver Ticket","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1558.002/","technique_page":"techniques/enterprise/T1558.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1558.003","id":"T1558.003","name":"Kerberoasting","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1558.003/","technique_page":"techniques/enterprise/T1558.003/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}]},{"key":"enterprise/T1558.004","id":"T1558.004","name":"AS-REP Roasting","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1558.004/","technique_page":"techniques/enterprise/T1558.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1558.005","id":"T1558.005","name":"Ccache Files","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1558.005/","technique_page":"techniques/enterprise/T1558.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1559","id":"T1559","name":"Inter-Process Communication","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1559/","technique_page":"techniques/enterprise/T1559/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1559.001","id":"T1559.001","name":"Component Object Model","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1559.001/","technique_page":"techniques/enterprise/T1559.001/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1559.002","id":"T1559.002","name":"Dynamic Data Exchange","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1559.002/","technique_page":"techniques/enterprise/T1559.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1559.003","id":"T1559.003","name":"XPC Services","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1559.003/","technique_page":"techniques/enterprise/T1559.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1560","id":"T1560","name":"Archive Collected Data","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1560/","technique_page":"techniques/enterprise/T1560/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1560.001","id":"T1560.001","name":"Archive via Utility","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1560.001/","technique_page":"techniques/enterprise/T1560.001/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1560.002","id":"T1560.002","name":"Archive via Library","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1560.002/","technique_page":"techniques/enterprise/T1560.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1560.003","id":"T1560.003","name":"Archive via Custom Method","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1560.003/","technique_page":"techniques/enterprise/T1560.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1561","id":"T1561","name":"Disk Wipe","domain":"enterprise","platforms":["Linux","macOS","Windows","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1561/","technique_page":"techniques/enterprise/T1561/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1561.001","id":"T1561.001","name":"Disk Content Wipe","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1561.001/","technique_page":"techniques/enterprise/T1561.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1561.002","id":"T1561.002","name":"Disk Structure Wipe","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1561.002/","technique_page":"techniques/enterprise/T1561.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1563","id":"T1563","name":"Remote Service Session Hijacking","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1563/","technique_page":"techniques/enterprise/T1563/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1563.001","id":"T1563.001","name":"SSH Hijacking","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1563.001/","technique_page":"techniques/enterprise/T1563.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1563.002","id":"T1563.002","name":"RDP Hijacking","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1563.002/","technique_page":"techniques/enterprise/T1563.002/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","domain":"enterprise","platforms":["ESXi","Linux","macOS","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1564/","technique_page":"techniques/enterprise/T1564/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.001","id":"T1564.001","name":"Hidden Files and Directories","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.001/","technique_page":"techniques/enterprise/T1564.001/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.002","id":"T1564.002","name":"Hidden Users","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.002/","technique_page":"techniques/enterprise/T1564.002/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.003/","technique_page":"techniques/enterprise/T1564.003/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.004/","technique_page":"techniques/enterprise/T1564.004/","status":"rule_source_available","counts":{"sigma":22,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.005","id":"T1564.005","name":"Hidden File System","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.005/","technique_page":"techniques/enterprise/T1564.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.006","id":"T1564.006","name":"Run Virtual Instance","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1564.006/","technique_page":"techniques/enterprise/T1564.006/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.007","id":"T1564.007","name":"VBA Stomping","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.007/","technique_page":"techniques/enterprise/T1564.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.008","id":"T1564.008","name":"Email Hiding Rules","domain":"enterprise","platforms":["Windows","Linux","macOS","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.008/","technique_page":"techniques/enterprise/T1564.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.009","id":"T1564.009","name":"Resource Forking","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1564.009/","technique_page":"techniques/enterprise/T1564.009/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.010","id":"T1564.010","name":"Process Argument Spoofing","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.010/","technique_page":"techniques/enterprise/T1564.010/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.011","id":"T1564.011","name":"Ignore Process Interrupts","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.011/","technique_page":"techniques/enterprise/T1564.011/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.012","id":"T1564.012","name":"File/Path Exclusions","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.012/","technique_page":"techniques/enterprise/T1564.012/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.013","id":"T1564.013","name":"Bind Mounts","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.013/","technique_page":"techniques/enterprise/T1564.013/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1564.014","id":"T1564.014","name":"Extended Attributes","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1564.014/","technique_page":"techniques/enterprise/T1564.014/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1565","id":"T1565","name":"Data Manipulation","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1565/","technique_page":"techniques/enterprise/T1565/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1565.001","id":"T1565.001","name":"Stored Data Manipulation","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1565.001/","technique_page":"techniques/enterprise/T1565.001/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1565.002","id":"T1565.002","name":"Transmitted Data Manipulation","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1565.002/","technique_page":"techniques/enterprise/T1565.002/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1565.003","id":"T1565.003","name":"Runtime Data Manipulation","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1565.003/","technique_page":"techniques/enterprise/T1565.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1566","id":"T1566","name":"Phishing","domain":"enterprise","platforms":["Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1566/","technique_page":"techniques/enterprise/T1566/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":0,"atlas_anomaly":2,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[{"title":"Cross-View Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#93-cross-view-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Sequence-Order Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#60-sequence-order-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}]},{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1566.001/","technique_page":"techniques/enterprise/T1566.001/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1566.002","id":"T1566.002","name":"Spearphishing Link","domain":"enterprise","platforms":["Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1566.002/","technique_page":"techniques/enterprise/T1566.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1566.003","id":"T1566.003","name":"Spearphishing via Service","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1566.003/","technique_page":"techniques/enterprise/T1566.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1566.004","id":"T1566.004","name":"Spearphishing Voice","domain":"enterprise","platforms":["Linux","macOS","Windows","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1566.004/","technique_page":"techniques/enterprise/T1566.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1567","id":"T1567","name":"Exfiltration Over Web Service","domain":"enterprise","platforms":["ESXi","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas","virtualization"],"page":"detections/enterprise/T1567/","technique_page":"techniques/enterprise/T1567/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"}]},{"key":"enterprise/T1567.001","id":"T1567.001","name":"Exfiltration to Code Repository","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1567.001/","technique_page":"techniques/enterprise/T1567.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1567.002","id":"T1567.002","name":"Exfiltration to Cloud Storage","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1567.002/","technique_page":"techniques/enterprise/T1567.002/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1567.003","id":"T1567.003","name":"Exfiltration to Text Storage Sites","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1567.003/","technique_page":"techniques/enterprise/T1567.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1567.004","id":"T1567.004","name":"Exfiltration Over Webhook","domain":"enterprise","platforms":["ESXi","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas","virtualization"],"page":"detections/enterprise/T1567.004/","technique_page":"techniques/enterprise/T1567.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1568","id":"T1568","name":"Dynamic Resolution","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1568/","technique_page":"techniques/enterprise/T1568/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1568.001","id":"T1568.001","name":"Fast Flux DNS","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1568.001/","technique_page":"techniques/enterprise/T1568.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1568.002","id":"T1568.002","name":"Domain Generation Algorithms","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1568.002/","technique_page":"techniques/enterprise/T1568.002/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1568.003","id":"T1568.003","name":"DNS Calculation","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1568.003/","technique_page":"techniques/enterprise/T1568.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1569","id":"T1569","name":"System Services","domain":"enterprise","platforms":["Windows","macOS","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1569/","technique_page":"techniques/enterprise/T1569/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1569.001","id":"T1569.001","name":"Launchctl","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1569.001/","technique_page":"techniques/enterprise/T1569.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1569.002/","technique_page":"techniques/enterprise/T1569.002/","status":"rule_source_available","counts":{"sigma":39,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1569.003","id":"T1569.003","name":"Systemctl","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1569.003/","technique_page":"techniques/enterprise/T1569.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1570","id":"T1570","name":"Lateral Tool Transfer","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1570/","technique_page":"techniques/enterprise/T1570/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Sequence-Order Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#60-sequence-order-anomaly"}]},{"key":"enterprise/T1571","id":"T1571","name":"Non-Standard Port","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1571/","technique_page":"techniques/enterprise/T1571/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1572/","technique_page":"techniques/enterprise/T1572/","status":"rule_source_available","counts":{"sigma":23,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1573","id":"T1573","name":"Encrypted Channel","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1573/","technique_page":"techniques/enterprise/T1573/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}]},{"key":"enterprise/T1573.001","id":"T1573.001","name":"Symmetric Cryptography","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1573.001/","technique_page":"techniques/enterprise/T1573.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1573.002","id":"T1573.002","name":"Asymmetric Cryptography","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1573.002/","technique_page":"techniques/enterprise/T1573.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574","id":"T1574","name":"Hijack Execution Flow","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574/","technique_page":"techniques/enterprise/T1574/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.001/","technique_page":"techniques/enterprise/T1574.001/","status":"rule_source_available","counts":{"sigma":80,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.004","id":"T1574.004","name":"Dylib Hijacking","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1574.004/","technique_page":"techniques/enterprise/T1574.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.005","id":"T1574.005","name":"Executable Installer File Permissions Weakness","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.005/","technique_page":"techniques/enterprise/T1574.005/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.006","id":"T1574.006","name":"Dynamic Linker Hijacking","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.006/","technique_page":"techniques/enterprise/T1574.006/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.007","id":"T1574.007","name":"Path Interception by PATH Environment Variable","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.007/","technique_page":"techniques/enterprise/T1574.007/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.008","id":"T1574.008","name":"Path Interception by Search Order Hijacking","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.008/","technique_page":"techniques/enterprise/T1574.008/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.009","id":"T1574.009","name":"Path Interception by Unquoted Path","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.009/","technique_page":"techniques/enterprise/T1574.009/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.010","id":"T1574.010","name":"Services File Permissions Weakness","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.010/","technique_page":"techniques/enterprise/T1574.010/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.011","id":"T1574.011","name":"Services Registry Permissions Weakness","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.011/","technique_page":"techniques/enterprise/T1574.011/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.012","id":"T1574.012","name":"COR_PROFILER","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.012/","technique_page":"techniques/enterprise/T1574.012/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.013","id":"T1574.013","name":"KernelCallbackTable","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.013/","technique_page":"techniques/enterprise/T1574.013/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1574.014","id":"T1574.014","name":"AppDomainManager","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1574.014/","technique_page":"techniques/enterprise/T1574.014/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1578","id":"T1578","name":"Modify Cloud Compute Infrastructure","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1578/","technique_page":"techniques/enterprise/T1578/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1578.001","id":"T1578.001","name":"Create Snapshot","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1578.001/","technique_page":"techniques/enterprise/T1578.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1578.002","id":"T1578.002","name":"Create Cloud Instance","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1578.002/","technique_page":"techniques/enterprise/T1578.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1578.003","id":"T1578.003","name":"Delete Cloud Instance","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1578.003/","technique_page":"techniques/enterprise/T1578.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1578.004","id":"T1578.004","name":"Revert Cloud Instance","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1578.004/","technique_page":"techniques/enterprise/T1578.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1578.005","id":"T1578.005","name":"Modify Cloud Compute Configurations","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1578.005/","technique_page":"techniques/enterprise/T1578.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1580","id":"T1580","name":"Cloud Infrastructure Discovery","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1580/","technique_page":"techniques/enterprise/T1580/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}]},{"key":"enterprise/T1583","id":"T1583","name":"Acquire Infrastructure","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583/","technique_page":"techniques/enterprise/T1583/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.001","id":"T1583.001","name":"Domains","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.001/","technique_page":"techniques/enterprise/T1583.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.002","id":"T1583.002","name":"DNS Server","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.002/","technique_page":"techniques/enterprise/T1583.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.003","id":"T1583.003","name":"Virtual Private Server","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.003/","technique_page":"techniques/enterprise/T1583.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.004","id":"T1583.004","name":"Server","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.004/","technique_page":"techniques/enterprise/T1583.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.005","id":"T1583.005","name":"Botnet","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.005/","technique_page":"techniques/enterprise/T1583.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.006","id":"T1583.006","name":"Web Services","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.006/","technique_page":"techniques/enterprise/T1583.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.007","id":"T1583.007","name":"Serverless","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.007/","technique_page":"techniques/enterprise/T1583.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1583.008","id":"T1583.008","name":"Malvertising","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1583.008/","technique_page":"techniques/enterprise/T1583.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584/","technique_page":"techniques/enterprise/T1584/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.001","id":"T1584.001","name":"Domains","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.001/","technique_page":"techniques/enterprise/T1584.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.002","id":"T1584.002","name":"DNS Server","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.002/","technique_page":"techniques/enterprise/T1584.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.003","id":"T1584.003","name":"Virtual Private Server","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.003/","technique_page":"techniques/enterprise/T1584.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.004","id":"T1584.004","name":"Server","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.004/","technique_page":"techniques/enterprise/T1584.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.005","id":"T1584.005","name":"Botnet","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.005/","technique_page":"techniques/enterprise/T1584.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.006","id":"T1584.006","name":"Web Services","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.006/","technique_page":"techniques/enterprise/T1584.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.007","id":"T1584.007","name":"Serverless","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.007/","technique_page":"techniques/enterprise/T1584.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1584.008","id":"T1584.008","name":"Network Devices","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1584.008/","technique_page":"techniques/enterprise/T1584.008/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1585","id":"T1585","name":"Establish Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1585/","technique_page":"techniques/enterprise/T1585/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1585.001","id":"T1585.001","name":"Social Media Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1585.001/","technique_page":"techniques/enterprise/T1585.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1585.002","id":"T1585.002","name":"Email Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1585.002/","technique_page":"techniques/enterprise/T1585.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1585.003","id":"T1585.003","name":"Cloud Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1585.003/","technique_page":"techniques/enterprise/T1585.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1586","id":"T1586","name":"Compromise Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1586/","technique_page":"techniques/enterprise/T1586/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1586.001","id":"T1586.001","name":"Social Media Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1586.001/","technique_page":"techniques/enterprise/T1586.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1586.002","id":"T1586.002","name":"Email Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1586.002/","technique_page":"techniques/enterprise/T1586.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1586.003","id":"T1586.003","name":"Cloud Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1586.003/","technique_page":"techniques/enterprise/T1586.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1587","id":"T1587","name":"Develop Capabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1587/","technique_page":"techniques/enterprise/T1587/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1587.001","id":"T1587.001","name":"Malware","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1587.001/","technique_page":"techniques/enterprise/T1587.001/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1587.002","id":"T1587.002","name":"Code Signing Certificates","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1587.002/","technique_page":"techniques/enterprise/T1587.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1587.003","id":"T1587.003","name":"Digital Certificates","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1587.003/","technique_page":"techniques/enterprise/T1587.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1587.004","id":"T1587.004","name":"Exploits","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1587.004/","technique_page":"techniques/enterprise/T1587.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588","id":"T1588","name":"Obtain Capabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588/","technique_page":"techniques/enterprise/T1588/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.001","id":"T1588.001","name":"Malware","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.001/","technique_page":"techniques/enterprise/T1588.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.002","id":"T1588.002","name":"Tool","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.002/","technique_page":"techniques/enterprise/T1588.002/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.003","id":"T1588.003","name":"Code Signing Certificates","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.003/","technique_page":"techniques/enterprise/T1588.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.004","id":"T1588.004","name":"Digital Certificates","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.004/","technique_page":"techniques/enterprise/T1588.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.005","id":"T1588.005","name":"Exploits","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.005/","technique_page":"techniques/enterprise/T1588.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.006","id":"T1588.006","name":"Vulnerabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.006/","technique_page":"techniques/enterprise/T1588.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1588.007","id":"T1588.007","name":"Artificial Intelligence","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1588.007/","technique_page":"techniques/enterprise/T1588.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1589","id":"T1589","name":"Gather Victim Identity Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1589/","technique_page":"techniques/enterprise/T1589/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1589.001","id":"T1589.001","name":"Credentials","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1589.001/","technique_page":"techniques/enterprise/T1589.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1589.002","id":"T1589.002","name":"Email Addresses","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1589.002/","technique_page":"techniques/enterprise/T1589.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1589.003","id":"T1589.003","name":"Employee Names","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1589.003/","technique_page":"techniques/enterprise/T1589.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1590","id":"T1590","name":"Gather Victim Network Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590/","technique_page":"techniques/enterprise/T1590/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}]},{"key":"enterprise/T1590.001","id":"T1590.001","name":"Domain Properties","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590.001/","technique_page":"techniques/enterprise/T1590.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1590.002","id":"T1590.002","name":"DNS","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590.002/","technique_page":"techniques/enterprise/T1590.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1590.003","id":"T1590.003","name":"Network Trust Dependencies","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590.003/","technique_page":"techniques/enterprise/T1590.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1590.004","id":"T1590.004","name":"Network Topology","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590.004/","technique_page":"techniques/enterprise/T1590.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1590.005","id":"T1590.005","name":"IP Addresses","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590.005/","technique_page":"techniques/enterprise/T1590.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1590.006","id":"T1590.006","name":"Network Security Appliances","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1590.006/","technique_page":"techniques/enterprise/T1590.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1591","id":"T1591","name":"Gather Victim Org Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1591/","technique_page":"techniques/enterprise/T1591/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1591.001","id":"T1591.001","name":"Determine Physical Locations","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1591.001/","technique_page":"techniques/enterprise/T1591.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1591.002","id":"T1591.002","name":"Business Relationships","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1591.002/","technique_page":"techniques/enterprise/T1591.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1591.003","id":"T1591.003","name":"Identify Business Tempo","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1591.003/","technique_page":"techniques/enterprise/T1591.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1591.004","id":"T1591.004","name":"Identify Roles","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1591.004/","technique_page":"techniques/enterprise/T1591.004/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1592","id":"T1592","name":"Gather Victim Host Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1592/","technique_page":"techniques/enterprise/T1592/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1592.001","id":"T1592.001","name":"Hardware","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1592.001/","technique_page":"techniques/enterprise/T1592.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1592.002","id":"T1592.002","name":"Software","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1592.002/","technique_page":"techniques/enterprise/T1592.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1592.003","id":"T1592.003","name":"Firmware","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1592.003/","technique_page":"techniques/enterprise/T1592.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1592.004","id":"T1592.004","name":"Client Configurations","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1592.004/","technique_page":"techniques/enterprise/T1592.004/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1593","id":"T1593","name":"Search Open Websites/Domains","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1593/","technique_page":"techniques/enterprise/T1593/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1593.001","id":"T1593.001","name":"Social Media","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1593.001/","technique_page":"techniques/enterprise/T1593.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1593.002","id":"T1593.002","name":"Search Engines","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1593.002/","technique_page":"techniques/enterprise/T1593.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1593.003","id":"T1593.003","name":"Code Repositories","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1593.003/","technique_page":"techniques/enterprise/T1593.003/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1594","id":"T1594","name":"Search Victim-Owned Websites","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1594/","technique_page":"techniques/enterprise/T1594/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1595","id":"T1595","name":"Active Scanning","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1595/","technique_page":"techniques/enterprise/T1595/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"}]},{"key":"enterprise/T1595.001","id":"T1595.001","name":"Scanning IP Blocks","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1595.001/","technique_page":"techniques/enterprise/T1595.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1595.002","id":"T1595.002","name":"Vulnerability Scanning","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1595.002/","technique_page":"techniques/enterprise/T1595.002/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1595.003","id":"T1595.003","name":"Wordlist Scanning","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1595.003/","technique_page":"techniques/enterprise/T1595.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Count Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#13-count-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}]},{"key":"enterprise/T1596","id":"T1596","name":"Search Open Technical Databases","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1596/","technique_page":"techniques/enterprise/T1596/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1596.001","id":"T1596.001","name":"DNS/Passive DNS","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1596.001/","technique_page":"techniques/enterprise/T1596.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1596.002","id":"T1596.002","name":"WHOIS","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1596.002/","technique_page":"techniques/enterprise/T1596.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1596.003","id":"T1596.003","name":"Digital Certificates","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1596.003/","technique_page":"techniques/enterprise/T1596.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1596.004","id":"T1596.004","name":"CDNs","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1596.004/","technique_page":"techniques/enterprise/T1596.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1596.005","id":"T1596.005","name":"Scan Databases","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1596.005/","technique_page":"techniques/enterprise/T1596.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1597","id":"T1597","name":"Search Closed Sources","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1597/","technique_page":"techniques/enterprise/T1597/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1597.001","id":"T1597.001","name":"Threat Intel Vendors","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1597.001/","technique_page":"techniques/enterprise/T1597.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1597.002","id":"T1597.002","name":"Purchase Technical Data","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1597.002/","technique_page":"techniques/enterprise/T1597.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1598","id":"T1598","name":"Phishing for Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1598/","technique_page":"techniques/enterprise/T1598/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1598.001","id":"T1598.001","name":"Spearphishing Service","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1598.001/","technique_page":"techniques/enterprise/T1598.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1598.002","id":"T1598.002","name":"Spearphishing Attachment","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1598.002/","technique_page":"techniques/enterprise/T1598.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1598.003","id":"T1598.003","name":"Spearphishing Link","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1598.003/","technique_page":"techniques/enterprise/T1598.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1598.004","id":"T1598.004","name":"Spearphishing Voice","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1598.004/","technique_page":"techniques/enterprise/T1598.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1599","id":"T1599","name":"Network Boundary Bridging","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1599/","technique_page":"techniques/enterprise/T1599/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1599.001","id":"T1599.001","name":"Network Address Translation Traversal","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1599.001/","technique_page":"techniques/enterprise/T1599.001/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1600","id":"T1600","name":"Weaken Encryption","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1600/","technique_page":"techniques/enterprise/T1600/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1600.001","id":"T1600.001","name":"Reduce Key Space","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1600.001/","technique_page":"techniques/enterprise/T1600.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1600.002","id":"T1600.002","name":"Disable Crypto Hardware","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1600.002/","technique_page":"techniques/enterprise/T1600.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1601","id":"T1601","name":"Modify System Image","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1601/","technique_page":"techniques/enterprise/T1601/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1601.001","id":"T1601.001","name":"Patch System Image","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1601.001/","technique_page":"techniques/enterprise/T1601.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1601.002","id":"T1601.002","name":"Downgrade System Image","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1601.002/","technique_page":"techniques/enterprise/T1601.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1602","id":"T1602","name":"Data from Configuration Repository","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1602/","technique_page":"techniques/enterprise/T1602/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1602.001","id":"T1602.001","name":"SNMP (MIB Dump)","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1602.001/","technique_page":"techniques/enterprise/T1602.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1602.002","id":"T1602.002","name":"Network Device Configuration Dump","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1602.002/","technique_page":"techniques/enterprise/T1602.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1606","id":"T1606","name":"Forge Web Credentials","domain":"enterprise","platforms":["SaaS","Windows","macOS","Linux","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1606/","technique_page":"techniques/enterprise/T1606/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1606.001","id":"T1606.001","name":"Web Cookies","domain":"enterprise","platforms":["Linux","macOS","Windows","SaaS","IaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1606.001/","technique_page":"techniques/enterprise/T1606.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1606.002","id":"T1606.002","name":"SAML Tokens","domain":"enterprise","platforms":["SaaS","Windows","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1606.002/","technique_page":"techniques/enterprise/T1606.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608","id":"T1608","name":"Stage Capabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608/","technique_page":"techniques/enterprise/T1608/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608.001","id":"T1608.001","name":"Upload Malware","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608.001/","technique_page":"techniques/enterprise/T1608.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608.002","id":"T1608.002","name":"Upload Tool","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608.002/","technique_page":"techniques/enterprise/T1608.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608.003","id":"T1608.003","name":"Install Digital Certificate","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608.003/","technique_page":"techniques/enterprise/T1608.003/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608.004","id":"T1608.004","name":"Drive-by Target","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608.004/","technique_page":"techniques/enterprise/T1608.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608.005","id":"T1608.005","name":"Link Target","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608.005/","technique_page":"techniques/enterprise/T1608.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1608.006","id":"T1608.006","name":"SEO Poisoning","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1608.006/","technique_page":"techniques/enterprise/T1608.006/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1609","id":"T1609","name":"Container Administration Command","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1609/","technique_page":"techniques/enterprise/T1609/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}]},{"key":"enterprise/T1610","id":"T1610","name":"Deploy Container","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1610/","technique_page":"techniques/enterprise/T1610/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}]},{"key":"enterprise/T1611","id":"T1611","name":"Escape to Host","domain":"enterprise","platforms":["Windows","Linux","Containers","ESXi"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"page":"detections/enterprise/T1611/","technique_page":"techniques/enterprise/T1611/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1612","id":"T1612","name":"Build Image on Host","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1612/","technique_page":"techniques/enterprise/T1612/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1613","id":"T1613","name":"Container and Resource Discovery","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"page":"detections/enterprise/T1613/","technique_page":"techniques/enterprise/T1613/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1614","id":"T1614","name":"System Location Discovery","domain":"enterprise","platforms":["IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1614/","technique_page":"techniques/enterprise/T1614/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1614.001","id":"T1614.001","name":"System Language Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1614.001/","technique_page":"techniques/enterprise/T1614.001/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1615","id":"T1615","name":"Group Policy Discovery","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1615/","technique_page":"techniques/enterprise/T1615/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1619","id":"T1619","name":"Cloud Storage Object Discovery","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1619/","technique_page":"techniques/enterprise/T1619/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1620","id":"T1620","name":"Reflective Code Loading","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1620/","technique_page":"techniques/enterprise/T1620/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1621","id":"T1621","name":"Multi-Factor Authentication Request Generation","domain":"enterprise","platforms":["Windows","Linux","macOS","IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"page":"detections/enterprise/T1621/","technique_page":"techniques/enterprise/T1621/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Inter-Arrival-Time Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#19-inter-arrival-time-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}]},{"key":"enterprise/T1622","id":"T1622","name":"Debugger Evasion","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1622/","technique_page":"techniques/enterprise/T1622/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1647","id":"T1647","name":"Plist File Modification","domain":"enterprise","platforms":["macOS"],"environments":["onprem"],"page":"detections/enterprise/T1647/","technique_page":"techniques/enterprise/T1647/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1648","id":"T1648","name":"Serverless Execution","domain":"enterprise","platforms":["SaaS","IaaS","Office Suite"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1648/","technique_page":"techniques/enterprise/T1648/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}]},{"key":"enterprise/T1649","id":"T1649","name":"Steal or Forge Authentication Certificates","domain":"enterprise","platforms":["Windows","Linux","macOS","Identity Provider"],"environments":["cloud-hosted-endpoint","identity","onprem"],"page":"detections/enterprise/T1649/","technique_page":"techniques/enterprise/T1649/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1650","id":"T1650","name":"Acquire Access","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1650/","technique_page":"techniques/enterprise/T1650/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1651","id":"T1651","name":"Cloud Administration Command","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1651/","technique_page":"techniques/enterprise/T1651/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1652","id":"T1652","name":"Device Driver Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1652/","technique_page":"techniques/enterprise/T1652/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1653","id":"T1653","name":"Power Settings","domain":"enterprise","platforms":["Windows","Linux","macOS","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1653/","technique_page":"techniques/enterprise/T1653/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1654","id":"T1654","name":"Log Enumeration","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1654/","technique_page":"techniques/enterprise/T1654/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1657","id":"T1657","name":"Financial Theft","domain":"enterprise","platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1657/","technique_page":"techniques/enterprise/T1657/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1659","id":"T1659","name":"Content Injection","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1659/","technique_page":"techniques/enterprise/T1659/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1665","id":"T1665","name":"Hide Infrastructure","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1665/","technique_page":"techniques/enterprise/T1665/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1666","id":"T1666","name":"Modify Cloud Resource Hierarchy","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1666/","technique_page":"techniques/enterprise/T1666/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1667","id":"T1667","name":"Email Bombing","domain":"enterprise","platforms":["Linux","Office Suite","Windows","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1667/","technique_page":"techniques/enterprise/T1667/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1668","id":"T1668","name":"Exclusive Control","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1668/","technique_page":"techniques/enterprise/T1668/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1669","id":"T1669","name":"Wi-Fi Networks","domain":"enterprise","platforms":["Linux","Network Devices","Windows","macOS"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"page":"detections/enterprise/T1669/","technique_page":"techniques/enterprise/T1669/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1671","id":"T1671","name":"Cloud Application Integration","domain":"enterprise","platforms":["Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"page":"detections/enterprise/T1671/","technique_page":"techniques/enterprise/T1671/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1673","id":"T1673","name":"Virtual Machine Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1673/","technique_page":"techniques/enterprise/T1673/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1674","id":"T1674","name":"Input Injection","domain":"enterprise","platforms":["Windows","macOS","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1674/","technique_page":"techniques/enterprise/T1674/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1675","id":"T1675","name":"ESXi Administration Command","domain":"enterprise","platforms":["ESXi"],"environments":["onprem","virtualization"],"page":"detections/enterprise/T1675/","technique_page":"techniques/enterprise/T1675/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1677","id":"T1677","name":"Poisoned Pipeline Execution","domain":"enterprise","platforms":["SaaS"],"environments":["cloud","saas"],"page":"detections/enterprise/T1677/","technique_page":"techniques/enterprise/T1677/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1678","id":"T1678","name":"Delay Execution","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1678/","technique_page":"techniques/enterprise/T1678/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1679","id":"T1679","name":"Selective Exclusion","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1679/","technique_page":"techniques/enterprise/T1679/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1680","id":"T1680","name":"Local Storage Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"page":"detections/enterprise/T1680/","technique_page":"techniques/enterprise/T1680/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1681","id":"T1681","name":"Search Threat Vendor Data","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1681/","technique_page":"techniques/enterprise/T1681/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1682","id":"T1682","name":"Query Public AI Services","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1682/","technique_page":"techniques/enterprise/T1682/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1683","id":"T1683","name":"Generate Content","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1683/","technique_page":"techniques/enterprise/T1683/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1683.001","id":"T1683.001","name":"Written Content","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1683.001/","technique_page":"techniques/enterprise/T1683.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1683.002","id":"T1683.002","name":"Audio-Visual Content","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"page":"detections/enterprise/T1683.002/","technique_page":"techniques/enterprise/T1683.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1684","id":"T1684","name":"Social Engineering","domain":"enterprise","platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1684/","technique_page":"techniques/enterprise/T1684/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1684.001","id":"T1684.001","name":"Impersonation","domain":"enterprise","platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1684.001/","technique_page":"techniques/enterprise/T1684.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1684.002","id":"T1684.002","name":"Email Spoofing","domain":"enterprise","platforms":["Linux","macOS","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1684.002/","technique_page":"techniques/enterprise/T1684.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1685/","technique_page":"techniques/enterprise/T1685/","status":"rule_source_available","counts":{"sigma":156,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1685.001/","technique_page":"techniques/enterprise/T1685.001/","status":"rule_source_available","counts":{"sigma":26,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685.002","id":"T1685.002","name":"Disable or Modify Cloud Log","domain":"enterprise","platforms":["IaaS","SaaS","Identity Provider","Office Suite"],"environments":["cloud","identity","onprem","saas"],"page":"detections/enterprise/T1685.002/","technique_page":"techniques/enterprise/T1685.002/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685.003","id":"T1685.003","name":"Modify or Spoof Tool UI","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1685.003/","technique_page":"techniques/enterprise/T1685.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685.004","id":"T1685.004","name":"Disable or Modify Linux Audit System Log","domain":"enterprise","platforms":["Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1685.004/","technique_page":"techniques/enterprise/T1685.004/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685.005","id":"T1685.005","name":"Clear Windows Event Logs","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1685.005/","technique_page":"techniques/enterprise/T1685.005/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","domain":"enterprise","platforms":["Linux","macOS"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1685.006/","technique_page":"techniques/enterprise/T1685.006/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1686/","technique_page":"techniques/enterprise/T1686/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1686.001","id":"T1686.001","name":"Cloud Firewall","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"page":"detections/enterprise/T1686.001/","technique_page":"techniques/enterprise/T1686.001/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1686.002","id":"T1686.002","name":"Network Device Firewall","domain":"enterprise","platforms":["Network Devices"],"environments":["network-infrastructure"],"page":"detections/enterprise/T1686.002/","technique_page":"techniques/enterprise/T1686.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1686.003","id":"T1686.003","name":"Windows Host Firewall","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1686.003/","technique_page":"techniques/enterprise/T1686.003/","status":"rule_source_available","counts":{"sigma":17,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1687","id":"T1687","name":"Exploitation for Defense Impairment","domain":"enterprise","platforms":["IaaS","Linux","macOS","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"page":"detections/enterprise/T1687/","technique_page":"techniques/enterprise/T1687/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1688","id":"T1688","name":"Safe Mode Boot","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1688/","technique_page":"techniques/enterprise/T1688/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1689","id":"T1689","name":"Downgrade Attack","domain":"enterprise","platforms":["macOS","Windows","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"page":"detections/enterprise/T1689/","technique_page":"techniques/enterprise/T1689/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"anomaly_types":[]},{"key":"enterprise/T1690","id":"T1690","name":"Prevent Command History Logging","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"page":"detections/enterprise/T1690/","technique_page":"techniques/enterprise/T1690/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0800","id":"T0800","name":"Activate Firmware Update Mode","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0800/","technique_page":"techniques/ics/T0800/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0801","id":"T0801","name":"Monitor Process State","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0801/","technique_page":"techniques/ics/T0801/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0802","id":"T0802","name":"Automated Collection","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0802/","technique_page":"techniques/ics/T0802/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0806","id":"T0806","name":"Brute Force I/O","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0806/","technique_page":"techniques/ics/T0806/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0807","id":"T0807","name":"Command-Line Interface","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0807/","technique_page":"techniques/ics/T0807/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0809","id":"T0809","name":"Data Destruction","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0809/","technique_page":"techniques/ics/T0809/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0811","id":"T0811","name":"Data from Information Repositories","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0811/","technique_page":"techniques/ics/T0811/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0813","id":"T0813","name":"Denial of Control","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0813/","technique_page":"techniques/ics/T0813/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0814","id":"T0814","name":"Denial of Service","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0814/","technique_page":"techniques/ics/T0814/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0815","id":"T0815","name":"Denial of View","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0815/","technique_page":"techniques/ics/T0815/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0816","id":"T0816","name":"Device Restart/Shutdown","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0816/","technique_page":"techniques/ics/T0816/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0817","id":"T0817","name":"Drive-by Compromise","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0817/","technique_page":"techniques/ics/T0817/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0819","id":"T0819","name":"Exploit Public-Facing Application","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0819/","technique_page":"techniques/ics/T0819/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0820","id":"T0820","name":"Exploitation for Evasion","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0820/","technique_page":"techniques/ics/T0820/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0821","id":"T0821","name":"Modify Controller Tasking","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0821/","technique_page":"techniques/ics/T0821/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0822","id":"T0822","name":"External Remote Services","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0822/","technique_page":"techniques/ics/T0822/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0823","id":"T0823","name":"Graphical User Interface","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0823/","technique_page":"techniques/ics/T0823/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0826","id":"T0826","name":"Loss of Availability","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0826/","technique_page":"techniques/ics/T0826/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0827","id":"T0827","name":"Loss of Control","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0827/","technique_page":"techniques/ics/T0827/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0828","id":"T0828","name":"Loss of Productivity and Revenue","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0828/","technique_page":"techniques/ics/T0828/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0829","id":"T0829","name":"Loss of View","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0829/","technique_page":"techniques/ics/T0829/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0830","id":"T0830","name":"Adversary-in-the-Middle","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0830/","technique_page":"techniques/ics/T0830/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0831","id":"T0831","name":"Manipulation of Control","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0831/","technique_page":"techniques/ics/T0831/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0832","id":"T0832","name":"Manipulation of View","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0832/","technique_page":"techniques/ics/T0832/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0834","id":"T0834","name":"Native API","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0834/","technique_page":"techniques/ics/T0834/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0835","id":"T0835","name":"Manipulate I/O Image","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0835/","technique_page":"techniques/ics/T0835/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0836","id":"T0836","name":"Modify Parameter","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0836/","technique_page":"techniques/ics/T0836/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0837","id":"T0837","name":"Loss of Protection","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0837/","technique_page":"techniques/ics/T0837/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0838","id":"T0838","name":"Modify Alarm Settings","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0838/","technique_page":"techniques/ics/T0838/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0840","id":"T0840","name":"Network Connection Enumeration","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0840/","technique_page":"techniques/ics/T0840/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0842","id":"T0842","name":"Network Sniffing","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0842/","technique_page":"techniques/ics/T0842/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0843","id":"T0843","name":"Program Download","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0843/","technique_page":"techniques/ics/T0843/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0843.001","id":"T0843.001","name":"Download All","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0843.001/","technique_page":"techniques/ics/T0843.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0843.002","id":"T0843.002","name":"Online Edit","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0843.002/","technique_page":"techniques/ics/T0843.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0843.003","id":"T0843.003","name":"Program Append","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0843.003/","technique_page":"techniques/ics/T0843.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0845","id":"T0845","name":"Program Upload","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0845/","technique_page":"techniques/ics/T0845/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0846","id":"T0846","name":"Remote System Discovery","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0846/","technique_page":"techniques/ics/T0846/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0846.001","id":"T0846.001","name":"Port Scan","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0846.001/","technique_page":"techniques/ics/T0846.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0846.002","id":"T0846.002","name":"Broadcast Discovery","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0846.002/","technique_page":"techniques/ics/T0846.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0846.003","id":"T0846.003","name":"Multicast Discovery","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0846.003/","technique_page":"techniques/ics/T0846.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0847","id":"T0847","name":"Replication Through Removable Media","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0847/","technique_page":"techniques/ics/T0847/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0848","id":"T0848","name":"Rogue Master","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0848/","technique_page":"techniques/ics/T0848/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0849","id":"T0849","name":"Masquerading","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0849/","technique_page":"techniques/ics/T0849/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0851","id":"T0851","name":"Rootkit","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0851/","technique_page":"techniques/ics/T0851/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0852","id":"T0852","name":"Screen Capture","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0852/","technique_page":"techniques/ics/T0852/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0853","id":"T0853","name":"Scripting","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0853/","technique_page":"techniques/ics/T0853/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0858","id":"T0858","name":"Change Operating Mode","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0858/","technique_page":"techniques/ics/T0858/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0859","id":"T0859","name":"Valid Accounts","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0859/","technique_page":"techniques/ics/T0859/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0860","id":"T0860","name":"Wireless Compromise","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0860/","technique_page":"techniques/ics/T0860/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0861","id":"T0861","name":"Point & Tag Identification","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0861/","technique_page":"techniques/ics/T0861/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0862","id":"T0862","name":"Supply Chain Compromise","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0862/","technique_page":"techniques/ics/T0862/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0863","id":"T0863","name":"User Execution","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0863/","technique_page":"techniques/ics/T0863/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0864","id":"T0864","name":"Transient Cyber Asset","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0864/","technique_page":"techniques/ics/T0864/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0865","id":"T0865","name":"Spearphishing Attachment","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0865/","technique_page":"techniques/ics/T0865/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0866","id":"T0866","name":"Exploitation of Remote Services","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0866/","technique_page":"techniques/ics/T0866/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0867","id":"T0867","name":"Lateral Tool Transfer","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0867/","technique_page":"techniques/ics/T0867/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0868","id":"T0868","name":"Detect Operating Mode","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0868/","technique_page":"techniques/ics/T0868/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0869","id":"T0869","name":"Standard Application Layer Protocol","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0869/","technique_page":"techniques/ics/T0869/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0871","id":"T0871","name":"Execution through API","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0871/","technique_page":"techniques/ics/T0871/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0872","id":"T0872","name":"Indicator Removal on Host","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0872/","technique_page":"techniques/ics/T0872/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0873","id":"T0873","name":"Project File Infection","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0873/","technique_page":"techniques/ics/T0873/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0873.001","id":"T0873.001","name":"Siemens Project File Format","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0873.001/","technique_page":"techniques/ics/T0873.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0874","id":"T0874","name":"Hooking","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0874/","technique_page":"techniques/ics/T0874/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0877","id":"T0877","name":"I/O Image","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0877/","technique_page":"techniques/ics/T0877/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0878","id":"T0878","name":"Alarm Suppression","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0878/","technique_page":"techniques/ics/T0878/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0879","id":"T0879","name":"Damage to Property","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0879/","technique_page":"techniques/ics/T0879/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0880","id":"T0880","name":"Loss of Safety","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0880/","technique_page":"techniques/ics/T0880/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0881","id":"T0881","name":"Service Stop","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0881/","technique_page":"techniques/ics/T0881/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0882","id":"T0882","name":"Theft of Operational Information","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0882/","technique_page":"techniques/ics/T0882/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0883","id":"T0883","name":"Internet Accessible Device","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0883/","technique_page":"techniques/ics/T0883/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0884","id":"T0884","name":"Connection Proxy","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0884/","technique_page":"techniques/ics/T0884/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0885","id":"T0885","name":"Commonly Used Port","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0885/","technique_page":"techniques/ics/T0885/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0886","id":"T0886","name":"Remote Services","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0886/","technique_page":"techniques/ics/T0886/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0887","id":"T0887","name":"Wireless Sniffing","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0887/","technique_page":"techniques/ics/T0887/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0888","id":"T0888","name":"Remote System Information Discovery","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0888/","technique_page":"techniques/ics/T0888/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0889","id":"T0889","name":"Modify Program","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0889/","technique_page":"techniques/ics/T0889/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0890","id":"T0890","name":"Exploitation for Privilege Escalation","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0890/","technique_page":"techniques/ics/T0890/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0892","id":"T0892","name":"Change Credential","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0892/","technique_page":"techniques/ics/T0892/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0893","id":"T0893","name":"Data from Local System","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0893/","technique_page":"techniques/ics/T0893/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0894","id":"T0894","name":"System Binary Proxy Execution","domain":"ics","platforms":["None"],"environments":["ics-ot"],"page":"detections/ics/T0894/","technique_page":"techniques/ics/T0894/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T0895","id":"T0895","name":"Autorun Image","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T0895/","technique_page":"techniques/ics/T0895/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1691","id":"T1691","name":"Block Operational Technology Message","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1691/","technique_page":"techniques/ics/T1691/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1691.001","id":"T1691.001","name":"Command Message","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1691.001/","technique_page":"techniques/ics/T1691.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1691.002","id":"T1691.002","name":"Reporting Message","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1691.002/","technique_page":"techniques/ics/T1691.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1692","id":"T1692","name":"Unauthorized Message","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1692/","technique_page":"techniques/ics/T1692/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1692.001","id":"T1692.001","name":"Command Message","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1692.001/","technique_page":"techniques/ics/T1692.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1692.002","id":"T1692.002","name":"Reporting Message","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1692.002/","technique_page":"techniques/ics/T1692.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1693","id":"T1693","name":"Modify Firmware","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1693/","technique_page":"techniques/ics/T1693/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1693.001","id":"T1693.001","name":"System Firmware","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1693.001/","technique_page":"techniques/ics/T1693.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1693.002","id":"T1693.002","name":"Module Firmware","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1693.002/","technique_page":"techniques/ics/T1693.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1694","id":"T1694","name":"Insecure Credentials","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1694/","technique_page":"techniques/ics/T1694/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1694.001","id":"T1694.001","name":"Default Credentials","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1694.001/","technique_page":"techniques/ics/T1694.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1694.002","id":"T1694.002","name":"Hardcoded Credentials","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1694.002/","technique_page":"techniques/ics/T1694.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1695","id":"T1695","name":"Block Communications","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1695/","technique_page":"techniques/ics/T1695/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1695.001","id":"T1695.001","name":"Serial COM","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1695.001/","technique_page":"techniques/ics/T1695.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1695.002","id":"T1695.002","name":"Ethernet","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1695.002/","technique_page":"techniques/ics/T1695.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"ics/T1695.003","id":"T1695.003","name":"Wi-Fi","domain":"ics","platforms":[],"environments":["ics-ot"],"page":"detections/ics/T1695.003/","technique_page":"techniques/ics/T1695.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1398","id":"T1398","name":"Boot or Logon Initialization Scripts","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1398/","technique_page":"techniques/mobile/T1398/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1404","id":"T1404","name":"Exploitation for Privilege Escalation","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1404/","technique_page":"techniques/mobile/T1404/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1406","id":"T1406","name":"Obfuscated Files or Information","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1406/","technique_page":"techniques/mobile/T1406/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1406.001","id":"T1406.001","name":"Steganography","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1406.001/","technique_page":"techniques/mobile/T1406.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1406.002","id":"T1406.002","name":"Software Packing","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1406.002/","technique_page":"techniques/mobile/T1406.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1407","id":"T1407","name":"Download New Code at Runtime","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1407/","technique_page":"techniques/mobile/T1407/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1409","id":"T1409","name":"Stored Application Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1409/","technique_page":"techniques/mobile/T1409/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1414","id":"T1414","name":"Clipboard Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1414/","technique_page":"techniques/mobile/T1414/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1417","id":"T1417","name":"Input Capture","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1417/","technique_page":"techniques/mobile/T1417/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1417.001","id":"T1417.001","name":"Keylogging","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1417.001/","technique_page":"techniques/mobile/T1417.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1417.002","id":"T1417.002","name":"GUI Input Capture","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1417.002/","technique_page":"techniques/mobile/T1417.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1418","id":"T1418","name":"Software Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1418/","technique_page":"techniques/mobile/T1418/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1418.001","id":"T1418.001","name":"Security Software Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1418.001/","technique_page":"techniques/mobile/T1418.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1420","id":"T1420","name":"File and Directory Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1420/","technique_page":"techniques/mobile/T1420/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1421","id":"T1421","name":"System Network Connections Discovery","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1421/","technique_page":"techniques/mobile/T1421/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1422","id":"T1422","name":"System Network Configuration Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1422/","technique_page":"techniques/mobile/T1422/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1422.001","id":"T1422.001","name":"Internet Connection Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1422.001/","technique_page":"techniques/mobile/T1422.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1422.002","id":"T1422.002","name":"Wi-Fi Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1422.002/","technique_page":"techniques/mobile/T1422.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1423","id":"T1423","name":"Network Service Scanning","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1423/","technique_page":"techniques/mobile/T1423/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1424","id":"T1424","name":"Process Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1424/","technique_page":"techniques/mobile/T1424/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1426","id":"T1426","name":"System Information Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1426/","technique_page":"techniques/mobile/T1426/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1428","id":"T1428","name":"Exploitation of Remote Services","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1428/","technique_page":"techniques/mobile/T1428/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1429","id":"T1429","name":"Audio Capture","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1429/","technique_page":"techniques/mobile/T1429/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1430","id":"T1430","name":"Location Tracking","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1430/","technique_page":"techniques/mobile/T1430/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1430.001","id":"T1430.001","name":"Remote Device Management Services","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1430.001/","technique_page":"techniques/mobile/T1430.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1430.002","id":"T1430.002","name":"Impersonate SS7 Nodes","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1430.002/","technique_page":"techniques/mobile/T1430.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1437","id":"T1437","name":"Application Layer Protocol","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1437/","technique_page":"techniques/mobile/T1437/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1437.001","id":"T1437.001","name":"Web Protocols","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1437.001/","technique_page":"techniques/mobile/T1437.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1451","id":"T1451","name":"SIM Card Swap","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1451/","technique_page":"techniques/mobile/T1451/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1453","id":"T1453","name":"Abuse Accessibility Features","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1453/","technique_page":"techniques/mobile/T1453/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1456","id":"T1456","name":"Drive-By Compromise","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1456/","technique_page":"techniques/mobile/T1456/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1458","id":"T1458","name":"Replication Through Removable Media","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1458/","technique_page":"techniques/mobile/T1458/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1461","id":"T1461","name":"Lockscreen Bypass","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1461/","technique_page":"techniques/mobile/T1461/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1464","id":"T1464","name":"Network Denial of Service","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1464/","technique_page":"techniques/mobile/T1464/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1471","id":"T1471","name":"Data Encrypted for Impact","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1471/","technique_page":"techniques/mobile/T1471/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1474","id":"T1474","name":"Supply Chain Compromise","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1474/","technique_page":"techniques/mobile/T1474/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1474.001","id":"T1474.001","name":"Compromise Software Dependencies and Development Tools","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1474.001/","technique_page":"techniques/mobile/T1474.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1474.002","id":"T1474.002","name":"Compromise Hardware Supply Chain","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1474.002/","technique_page":"techniques/mobile/T1474.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1474.003","id":"T1474.003","name":"Compromise Software Supply Chain","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1474.003/","technique_page":"techniques/mobile/T1474.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1481","id":"T1481","name":"Web Service","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1481/","technique_page":"techniques/mobile/T1481/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1481.001","id":"T1481.001","name":"Dead Drop Resolver","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1481.001/","technique_page":"techniques/mobile/T1481.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1481.002","id":"T1481.002","name":"Bidirectional Communication","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1481.002/","technique_page":"techniques/mobile/T1481.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1481.003","id":"T1481.003","name":"One-Way Communication","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1481.003/","technique_page":"techniques/mobile/T1481.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1509","id":"T1509","name":"Non-Standard Port","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1509/","technique_page":"techniques/mobile/T1509/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1512","id":"T1512","name":"Video Capture","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1512/","technique_page":"techniques/mobile/T1512/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1513","id":"T1513","name":"Screen Capture","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1513/","technique_page":"techniques/mobile/T1513/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1516","id":"T1516","name":"Input Injection","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1516/","technique_page":"techniques/mobile/T1516/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1517","id":"T1517","name":"Access Notifications","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1517/","technique_page":"techniques/mobile/T1517/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1521","id":"T1521","name":"Encrypted Channel","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1521/","technique_page":"techniques/mobile/T1521/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1521.001","id":"T1521.001","name":"Symmetric Cryptography","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1521.001/","technique_page":"techniques/mobile/T1521.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1521.002","id":"T1521.002","name":"Asymmetric Cryptography","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1521.002/","technique_page":"techniques/mobile/T1521.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1521.003","id":"T1521.003","name":"SSL Pinning","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1521.003/","technique_page":"techniques/mobile/T1521.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1532","id":"T1532","name":"Archive Collected Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1532/","technique_page":"techniques/mobile/T1532/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1533","id":"T1533","name":"Data from Local System","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1533/","technique_page":"techniques/mobile/T1533/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1541","id":"T1541","name":"Foreground Persistence","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1541/","technique_page":"techniques/mobile/T1541/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1544","id":"T1544","name":"Ingress Tool Transfer","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1544/","technique_page":"techniques/mobile/T1544/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1575","id":"T1575","name":"Native API","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1575/","technique_page":"techniques/mobile/T1575/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1577","id":"T1577","name":"Compromise Application Executable","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1577/","technique_page":"techniques/mobile/T1577/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1582","id":"T1582","name":"SMS Control","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1582/","technique_page":"techniques/mobile/T1582/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1603","id":"T1603","name":"Scheduled Task/Job","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1603/","technique_page":"techniques/mobile/T1603/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1604","id":"T1604","name":"Proxy Through Victim","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1604/","technique_page":"techniques/mobile/T1604/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1616","id":"T1616","name":"Call Control","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1616/","technique_page":"techniques/mobile/T1616/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1617","id":"T1617","name":"Hooking","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1617/","technique_page":"techniques/mobile/T1617/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1623","id":"T1623","name":"Command and Scripting Interpreter","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1623/","technique_page":"techniques/mobile/T1623/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1623.001","id":"T1623.001","name":"Unix Shell","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1623.001/","technique_page":"techniques/mobile/T1623.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1624","id":"T1624","name":"Event Triggered Execution","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1624/","technique_page":"techniques/mobile/T1624/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1624.001","id":"T1624.001","name":"Broadcast Receivers","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1624.001/","technique_page":"techniques/mobile/T1624.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1625","id":"T1625","name":"Hijack Execution Flow","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1625/","technique_page":"techniques/mobile/T1625/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1625.001","id":"T1625.001","name":"System Runtime API Hijacking","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1625.001/","technique_page":"techniques/mobile/T1625.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1626","id":"T1626","name":"Abuse Elevation Control Mechanism","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1626/","technique_page":"techniques/mobile/T1626/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1626.001","id":"T1626.001","name":"Device Administrator Permissions","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1626.001/","technique_page":"techniques/mobile/T1626.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1627","id":"T1627","name":"Execution Guardrails","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1627/","technique_page":"techniques/mobile/T1627/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1627.001","id":"T1627.001","name":"Geofencing","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1627.001/","technique_page":"techniques/mobile/T1627.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1628","id":"T1628","name":"Hide Artifacts","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1628/","technique_page":"techniques/mobile/T1628/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1628.001","id":"T1628.001","name":"Suppress Application Icon","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1628.001/","technique_page":"techniques/mobile/T1628.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1628.002","id":"T1628.002","name":"User Evasion","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1628.002/","technique_page":"techniques/mobile/T1628.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1628.003","id":"T1628.003","name":"Conceal Multimedia Files","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1628.003/","technique_page":"techniques/mobile/T1628.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1629","id":"T1629","name":"Impair Defenses","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1629/","technique_page":"techniques/mobile/T1629/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1629.001","id":"T1629.001","name":"Prevent Application Removal","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1629.001/","technique_page":"techniques/mobile/T1629.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1629.002","id":"T1629.002","name":"Device Lockout","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1629.002/","technique_page":"techniques/mobile/T1629.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1629.003","id":"T1629.003","name":"Disable or Modify Tools","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1629.003/","technique_page":"techniques/mobile/T1629.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1630","id":"T1630","name":"Indicator Removal on Host","domain":"mobile","platforms":["iOS","Android"],"environments":["mobile"],"page":"detections/mobile/T1630/","technique_page":"techniques/mobile/T1630/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1630.001","id":"T1630.001","name":"Uninstall Malicious Application","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1630.001/","technique_page":"techniques/mobile/T1630.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1630.002","id":"T1630.002","name":"File Deletion","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1630.002/","technique_page":"techniques/mobile/T1630.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1630.003","id":"T1630.003","name":"Disguise Root/Jailbreak Indicators","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1630.003/","technique_page":"techniques/mobile/T1630.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1631","id":"T1631","name":"Process Injection","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1631/","technique_page":"techniques/mobile/T1631/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1631.001","id":"T1631.001","name":"Ptrace System Calls","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1631.001/","technique_page":"techniques/mobile/T1631.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1632","id":"T1632","name":"Subvert Trust Controls","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1632/","technique_page":"techniques/mobile/T1632/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1632.001","id":"T1632.001","name":"Code Signing Policy Modification","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1632.001/","technique_page":"techniques/mobile/T1632.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1633","id":"T1633","name":"Virtualization/Sandbox Evasion","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1633/","technique_page":"techniques/mobile/T1633/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1633.001","id":"T1633.001","name":"System Checks","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1633.001/","technique_page":"techniques/mobile/T1633.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1634","id":"T1634","name":"Credentials from Password Store","domain":"mobile","platforms":["iOS"],"environments":["mobile"],"page":"detections/mobile/T1634/","technique_page":"techniques/mobile/T1634/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1634.001","id":"T1634.001","name":"Keychain","domain":"mobile","platforms":["iOS"],"environments":["mobile"],"page":"detections/mobile/T1634.001/","technique_page":"techniques/mobile/T1634.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1635","id":"T1635","name":"Steal Application Access Token","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1635/","technique_page":"techniques/mobile/T1635/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1635.001","id":"T1635.001","name":"URI Hijacking","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1635.001/","technique_page":"techniques/mobile/T1635.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1636","id":"T1636","name":"Protected User Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1636/","technique_page":"techniques/mobile/T1636/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1636.001","id":"T1636.001","name":"Calendar Entries","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1636.001/","technique_page":"techniques/mobile/T1636.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1636.002","id":"T1636.002","name":"Call Log","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1636.002/","technique_page":"techniques/mobile/T1636.002/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1636.003","id":"T1636.003","name":"Contact List","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1636.003/","technique_page":"techniques/mobile/T1636.003/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1636.004","id":"T1636.004","name":"SMS Messages","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1636.004/","technique_page":"techniques/mobile/T1636.004/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1636.005","id":"T1636.005","name":"Accounts","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1636.005/","technique_page":"techniques/mobile/T1636.005/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1637","id":"T1637","name":"Dynamic Resolution","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1637/","technique_page":"techniques/mobile/T1637/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1637.001","id":"T1637.001","name":"Domain Generation Algorithms","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1637.001/","technique_page":"techniques/mobile/T1637.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1638","id":"T1638","name":"Adversary-in-the-Middle","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1638/","technique_page":"techniques/mobile/T1638/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1639","id":"T1639","name":"Exfiltration Over Alternative Protocol","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1639/","technique_page":"techniques/mobile/T1639/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1639.001","id":"T1639.001","name":"Exfiltration Over Unencrypted Non-C2 Protocol","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1639.001/","technique_page":"techniques/mobile/T1639.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1640","id":"T1640","name":"Account Access Removal","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1640/","technique_page":"techniques/mobile/T1640/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1641","id":"T1641","name":"Data Manipulation","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1641/","technique_page":"techniques/mobile/T1641/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1641.001","id":"T1641.001","name":"Transmitted Data Manipulation","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1641.001/","technique_page":"techniques/mobile/T1641.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1642","id":"T1642","name":"Endpoint Denial of Service","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1642/","technique_page":"techniques/mobile/T1642/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1643","id":"T1643","name":"Generate Traffic from Victim","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1643/","technique_page":"techniques/mobile/T1643/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1644","id":"T1644","name":"Out of Band Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1644/","technique_page":"techniques/mobile/T1644/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1645","id":"T1645","name":"Compromise Client Software Binary","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1645/","technique_page":"techniques/mobile/T1645/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1646","id":"T1646","name":"Exfiltration Over C2 Channel","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1646/","technique_page":"techniques/mobile/T1646/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1655","id":"T1655","name":"Masquerading","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1655/","technique_page":"techniques/mobile/T1655/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1655.001","id":"T1655.001","name":"Match Legitimate Name or Location","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1655.001/","technique_page":"techniques/mobile/T1655.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1658","id":"T1658","name":"Exploitation for Client Execution","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1658/","technique_page":"techniques/mobile/T1658/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1660","id":"T1660","name":"Phishing","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1660/","technique_page":"techniques/mobile/T1660/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1661","id":"T1661","name":"Application Versioning","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1661/","technique_page":"techniques/mobile/T1661/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1662","id":"T1662","name":"Data Destruction","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1662/","technique_page":"techniques/mobile/T1662/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1663","id":"T1663","name":"Remote Access Software","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1663/","technique_page":"techniques/mobile/T1663/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1664","id":"T1664","name":"Exploitation for Initial Access","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1664/","technique_page":"techniques/mobile/T1664/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1670","id":"T1670","name":"Virtualization Solution","domain":"mobile","platforms":["Android"],"environments":["mobile"],"page":"detections/mobile/T1670/","technique_page":"techniques/mobile/T1670/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},{"key":"mobile/T1676","id":"T1676","name":"Linked Devices","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"page":"detections/mobile/T1676/","technique_page":"techniques/mobile/T1676/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"anomaly_types":[]}],"source_snapshot_sha256":"9694c3b435ce59a3ad0eb858604a3b3b5377158881d40a8ad62994fea027ad97","attack_manifest":{"retrieved_at":"2026-09-27T09:35:33.813451+00:00","attack_version":"19.2","attack_commit":"6cda5ad8462c79e14fbb872f4e09059b18e0cfc4","atomic_commit":"388942adbd9641f4dfdcf079d7efe9a75ec0ac43","sources":[{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/6cda5ad8462c79e14fbb872f4e09059b18e0cfc4/enterprise-attack/enterprise-attack-19.2.json","sha256":"dc1639caa5501d720e280cf1cbd8fbe009884a0c9b3e6e9ed9d0c25166c3d8f4","bytes":53835637},{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/6cda5ad8462c79e14fbb872f4e09059b18e0cfc4/mobile-attack/mobile-attack-19.2.json","sha256":"acfa5ca2d93484476f79bf38590e2b55bb675fc0ce85e76bffa0af2c82dada64","bytes":5750325},{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/6cda5ad8462c79e14fbb872f4e09059b18e0cfc4/ics-attack/ics-attack-19.2.json","sha256":"08b83d2cea6b6d6752468ef0e62e2ab2a53c9443ef72c439ecccb07ab9e89da9","bytes":4057891},{"file":"atomic-index.yaml","url":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/Indexes/index.yaml","sha256":"08f8bd071d96261e12e520a8bba4ef85df33e611491f2435671d4f8fe94c49a4","bytes":6608036}]},"sigma_provenance":{"repository":"https://github.com/anpa1200/sigma","commit":"b249e9683190cffdcaf188ccbfb90bf4759844e1","upstream":"https://github.com/SigmaHQ/sigma","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","scope":"Author-owned Sigma fork snapshot; rules/ only. Not claimed to be latest SigmaHQ."},"atlas_provenance":{"repository":"https://github.com/anpa1200/anomaly-detection-atlas","commit":"e1f75007376022b2f596e413bea8612e514a5aa3"},"imported_at":"2026-09-27T12:23:12.999219+00:00","policy":"Exact Enterprise ATT&CK IDs only. Preserve status and provenance. No parent inheritance, automatic migration of retired IDs, SIEM conversion or detection execution.","excluded_source_mappings":[{"kind":"atlas_basic","id":"atlas-basic-t1070-001-1","technique_ids":["T1070.001"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion"},{"kind":"atlas_basic","id":"atlas-basic-t1562-001-1","technique_ids":["T1562.001"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion"},{"kind":"atlas_basic","id":"atlas-basic-t1562-002-1","technique_ids":["T1562.002"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion"},{"kind":"atlas_basic","id":"atlas-basic-t1562-004-1","technique_ids":["T1562.004"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion"},{"kind":"atlas_basic","id":"atlas-basic-t1562-010-1","technique_ids":["T1562.010"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion"},{"kind":"atlas_anomaly","id":"atlas-anomaly-t1562-001-1","technique_ids":["T1562.001"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#tool-disablement"},{"kind":"atlas_anomaly","id":"atlas-anomaly-t1562-004-1","technique_ids":["T1562.004"],"reason":"not_active_in_pinned_enterprise_catalog","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#firewall-impairment"}],"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","evidence_boundary":"Rules are source-tagged candidates, not guaranteed full-technique detections. Atlas logic is vendor-neutral pseudocode; anomaly mappings are published hypotheses. YAML parsing is not SIEM compilation or live validation."}