Skip to content

attack-coverage.md

Latest commit

 

History

History
31 lines (25 loc) · 1.5 KB

attack-coverage.md

File metadata and controls

31 lines (25 loc) · 1.5 KB
Raw

ATT&CK coverage

Generated by scripts/gen_docs.py. Do not edit by hand.

Coverage here means a rule is tagged with the technique. It does not claim the rule detects every procedure of that technique. Names come from the ATT&CK data bundled with the installed pySigma.

Technique Name Rules
T1078 Valid Accounts erp_emergency_access_started
T1078.004 Cloud Accounts entra_anonymous_signin_then_inbox_rule, entra_finance_signin_anonymous_ip, entra_finance_signin_unlisted_country
T1090.003 Multi-hop Proxy entra_finance_signin_anonymous_ip
T1098 Account Manipulation erp_privileged_role_assigned_without_approval
T1114.003 Email Forwarding Rule m365_inbox_rule_external_forward_finance, m365_mailbox_forwarding_external_finance
T1564.008 Email Hiding Rules entra_anonymous_signin_then_inbox_rule, m365_inbox_rule_hides_finance_mail
T1657 Financial Theft erp_vendor_bank_change_then_payment, erp_vendor_bank_details_changed

Rules without a technique tag

Allowed only when listed in scripts/policy.yml with a reason.

  • entra_finance_anonymous_signin_event
  • erp_new_vendor_created_event
  • erp_new_vendor_paid_quickly
  • erp_new_vendor_payment_released_event
  • erp_payment_run_modified_outside_hours
  • erp_sod_payment_approved_event
  • erp_sod_vendor_created_event
  • erp_vendor_bank_change_event
  • erp_vendor_created_and_payment_approved_by_same_user
  • erp_vendor_payment_released
  • m365_inbox_rule_change_event