other:intel
Non-telemetry sources (internet scans, malware repositories, domain registration, persona)
- Host type
- Other / unclassified
- Techniques
- 39
- Rules listed
- 151
- Events
- 0
Techniques
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.004 Server
- T1583.006 Web Services
- T1583.007 Serverless
- T1583.008 Malvertising
- T1584 Compromise Infrastructure
- T1584.001 Domains
- T1584.002 DNS Server
- T1584.003 Virtual Private Server
- T1584.004 Server
- T1584.006 Web Services
- T1584.007 Serverless
- T1584.008 Network Devices
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1586 Compromise Accounts
- T1586.001 Social Media Accounts
- T1587 Develop Capabilities
- T1587.001 Malware
- T1587.002 Code Signing Certificates
- T1587.003 Digital Certificates
- T1588 Obtain Capabilities
- T1588.001 Malware
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1588.004 Digital Certificates
- T1592 Gather Victim Host Information
- T1592.001 Hardware
- T1592.002 Software
- T1592.004 Client Configurations
- T1608 Stage Capabilities
- T1608.001 Upload Malware
- T1608.002 Upload Tool
- T1608.003 Install Digital Certificate
- T1608.004 Drive-by Target
- T1608.005 Link Target
- T1608.006 SEO Poisoning
Rules
Microsoft Sentinel 151
- Dataverse - TI map IP to DataverseActivity
- Dataverse - TI map URL to DataverseActivity
- Datazag - impersonation domain resolved in DNS
- GSA - TI Domain Entity
- GSA - TI IP Entity
- GSA - TI URL Entity
- GitLab - TI - Connection from Malicious IP
- Google Threat Intelligence - Threat Hunting Domain
- Google Threat Intelligence - Threat Hunting Hash
- Google Threat Intelligence - Threat Hunting IP
- Google Threat Intelligence - Threat Hunting Url
- GreyNoise TI Map IP Entity to CommonSecurityLog
- GreyNoise TI Map IP Entity to DnsEvents
- GreyNoise TI Map IP Entity to SigninLogs
- GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
- GreyNoise TI map IP entity to OfficeActivity
- HoneyLabs TI Map IP Entity to CommonSecurityLog
- HoneyLabs TI Map IP Entity to SigninLogs
- HoneyLabs TI Map URL Entity to CommonSecurityLog
- Infoblox - TI - CommonSecurityLog Match Found - MalwareC2
- Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains
- Infoblox - TI - Syslog Match Found - URL
- Lumen TI IPAddress in CommonSecurityLog
- Lumen TI IPAddress in DeviceEvents
- Lumen TI IPAddress in IdentityLogonEvents
- Lumen TI IPAddress in OfficeActivity
- Lumen TI IPAddress in SecurityEvents
- Lumen TI IPAddress in SigninLogs
- Lumen TI IPAddress in WindowsEvents
- Lumen TI domain in DnsEvents
- PRODAFT USTA - TI map Domain to DnsEvents
- PRODAFT USTA - TI map File Hash to CommonSecurityLog
- PRODAFT USTA - TI map URL to Syslog
- Power Apps - Multiple users access a malicious link after launching new app
- Preview - TI map Domain entity to Cloud App Events
- Preview - TI map Email entity to Cloud App Events
- Preview - TI map IP entity to Cloud App Events
- Preview - TI map URL entity to Cloud App Events
- ProofpointPOD - Email sender IP in TI list
- ProofpointPOD - Email sender in TI list
- RecordedFuture Threat Hunting Domain All Actors
- RecordedFuture Threat Hunting Hash All Actors
- RecordedFuture Threat Hunting IP All Actors
- RecordedFuture Threat Hunting Url All Actors
- TI Map Domain Entity to DeviceNetworkEvents
- TI Map Domain Entity to DeviceNetworkEvents
- TI Map Domain entity to Cloud App Events
- TI Map Domain entity to Dns Events (ASIM DNS Schema)
- TI Map Domain entity to DnsEvents
- TI Map Domain entity to EmailEvents
- TI Map Domain entity to EmailUrlInfo
- TI Map Domain entity to PaloAlto
- TI Map Domain entity to PaloAlto CommonSecurityLog
- TI Map Domain entity to SecurityAlert
- TI Map Domain entity to Syslog
- TI Map Domain entity to Web Session Events (ASIM Web Session schema)
- TI Map Email entity to AzureActivity
- TI Map Email entity to Cloud App Events
- TI Map Email entity to EmailEvents
- TI Map Email entity to OfficeActivity
- TI Map Email entity to PaloAlto CommonSecurityLog
- TI Map Email entity to SecurityAlert
- TI Map Email entity to SecurityEvent
- TI Map Email entity to SigninLogs
- TI Map File Hash to CommonSecurityLog Event
- TI Map File Hash to DeviceFileEvents Event
- TI Map File Hash to Security Event
- TI Map IP Entity to Azure SQL Security Audit Events
- TI Map IP Entity to Azure SQL Security Audit Events
- TI Map IP Entity to AzureActivity
- TI Map IP Entity to AzureActivity
- TI Map IP Entity to CommonSecurityLog
- TI Map IP Entity to CommonSecurityLog
- TI Map IP Entity to DeviceNetworkEvents
- TI Map IP Entity to DeviceNetworkEvents
- TI Map IP Entity to DnsEvents
- TI Map IP Entity to DnsEvents
- TI Map IP Entity to Duo Security
- TI Map IP Entity to Duo Security
- TI Map IP Entity to SigninLogs
- TI Map IP Entity to SigninLogs
- TI Map IP Entity to VMConnection
- TI Map IP Entity to VMConnection
- TI Map IP Entity to W3CIISLog
- TI Map IP Entity to W3CIISLog
- TI Map IP entity to AWSCloudTrail
- TI Map IP entity to AppServiceHTTPLogs
- TI Map IP entity to Azure Key Vault logs
- TI Map IP entity to AzureFirewall
- TI Map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)
- TI Map IP entity to Cloud App Events
- TI Map IP entity to DNS Events (ASIM DNS schema)
- TI Map IP entity to GitHub_CL
- TI Map IP entity to Network Session Events (ASIM Network Session schema)
- TI Map IP entity to OfficeActivity
- TI Map IP entity to Web Session Events (ASIM Web Session schema)
- TI Map IP entity to Workday(ASimAuditEventLogs)
- TI Map URL Entity to AuditLogs
- TI Map URL Entity to AuditLogs
- TI Map URL Entity to DeviceNetworkEvents
- TI Map URL Entity to DeviceNetworkEvents
- TI Map URL Entity to EmailUrlInfo
- TI Map URL Entity to EmailUrlInfo
- TI Map URL Entity to OfficeActivity Data [Deprecated]
- TI Map URL Entity to PaloAlto Data
- TI Map URL Entity to PaloAlto Data
- TI Map URL Entity to SecurityAlert Data
- TI Map URL Entity to SecurityAlert Data
- TI Map URL Entity to Syslog Data
- TI Map URL Entity to Syslog Data
- TI Map URL Entity to UrlClickEvents
- TI Map URL Entity to UrlClickEvents
- TI Map URL entity to Cloud App Events
- TI Map URL entity to Web Session Events (ASIM Web Session schema)
- TI map Domain entity to Dns Events (ASIM DNS Schema)
- TI map Domain entity to DnsEvents
- TI map Domain entity to EmailEvents
- TI map Domain entity to EmailUrlInfo
- TI map Domain entity to PaloAlto
- TI map Domain entity to PaloAlto CommonSecurityLog
- TI map Domain entity to SecurityAlert
- TI map Domain entity to Syslog
- TI map Domain entity to Web Session Events (ASIM Web Session schema)
- TI map Email entity to AzureActivity
- TI map Email entity to EmailEvents
- TI map Email entity to OfficeActivity
- TI map Email entity to PaloAlto CommonSecurityLog
- TI map Email entity to SecurityAlert
- TI map Email entity to SecurityEvent
- TI map Email entity to SigninLogs
- TI map File Hash to CommonSecurityLog Event
- TI map File Hash to DeviceFileEvents Event
- TI map File Hash to Security Event
- TI map IP entity to AWSCloudTrail
- TI map IP entity to AppServiceHTTPLogs
- TI map IP entity to Azure Key Vault logs
- TI map IP entity to AzureFirewall
- TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)
- TI map IP entity to DNS Events (ASIM DNS schema)
- TI map IP entity to GitHub_CL
- TI map IP entity to LastPass data
- TI map IP entity to Network Session Events (ASIM Network Session schema)
- TI map IP entity to OfficeActivity
- TI map IP entity to Web Session Events (ASIM Web Session schema)
- TI map IP entity to Workday(ASimAuditEventLogs)
- Threat Connect TI map Domain entity to DnsEvents
- ThreatConnect TI Map URL Entity to OfficeActivity Data
- ThreatConnect TI map Email entity to OfficeActivity
- ThreatConnect TI map Email entity to SigninLogs
- ThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema)
- Ubiquiti - Connection to known malicious IP or C2
Events
No event-level rows: this source is tiered as a whole.