auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5b8b466b-2c81-4fe7-946f-d677a74ae3db
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0066
external_id: DC0066
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Active Directory Object Modification
description: Changes to AD objects (e.g., users, groups, OUs) are logged as Event ID 5136 (Object Modification) or 5163 (Attribute Changes). Examples:

- User Account: Modifying attributes (e.g., group membership, enabling/disabling accounts).
- Group Membership: Adding/removing members.
- OU: Changing properties/permissions (e.g., delegation).
- Service Account: Modifying SPNs or other attributes.
- Object Attributes: Changes to passwords, logon hours, or control flags.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: azure:activity
channel: Update conditionalAccessPolicy
name: esxi:vpxa
channel: vim.SessionManager.login / vim.AccountManager.createUser
name: WinEventLog:Security
channel: EventCode=5163
name: WinEventLog:Security
channel: EventCode=4739
name: azure:signinlogs
channel: Add certificate credential, Update certificate credential
name: m365:dirsync
channel: Replication cookie changes involving Configuration partition with new server/nTDSDSA objects.
name: WinEventLog:Security
channel: EventCode=5136
name: WinEventLog:Security
channel: EventCode=4663, 4670, 4656
name: esxi:vpxd
channel: permission change operations on datastores or VMs
name: m365:unified
channel: Set-Mailbox, Set-AppPassword, Add-MailboxPermission
name: m365:unified
channel: Add app role assignment grant to user: Consent to application by privileged or unexpected accounts
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5c6de881-bc70-4070-855a-7a9631a407f7
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0071
external_id: DC0071
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:35.607Z
name: Active Directory Object Access
description: Object access refers to activities where AD objects (e.g., user accounts, groups, policies) are accessed or queried. Example: Windows Event ID 4661 logs object access attempts. Examples:

- Attribute Access: e.g., `userPassword`, `memberOf`, `securityDescriptor`.
- Group Enumeration: Enumerating critical group members (e.g., Domain Admins).
- User Attributes: Commonly accessed attributes like `samAccountName`, `lastLogonTimestamp`.
- Policy Access: Accessing GPOs to understand security settings.

*Data Collection Measures:*

- Audit Policies:
 - Enable "Audit Directory Service Access" under Advanced Audit Policies (Success and Failure).
 - Path: `Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object AccessEnable: Audit Directory Service Access` (Success and Failure).
 - Captured Events: IDs 4661, 4662.
- Event Forwarding: Use WEF to centralize logs for SIEM analysis.
- SIEM Integration: Collect and parse logs (e.g., 4661, 4662) using tools like Splunk or Azure Sentinel.
- Log Filtering:
- Focus on sensitive objects/attributes like:
 - `Domain Admins` group.
 - `userPassword`, `ntSecurityDescriptor`.
- Enable EDR Monitoring:
 - Detect processes accessing sensitive AD objects (e.g., samAccountName, securityDescriptor).
 - Log all attempts to enumerate critical groups (e.g., "Domain Admins").
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Security
channel: EventCode=4662
name: WinEventLog:Security
channel: EventCode=4661
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5f7c9def-0ddf-423b-b1f8-fb2ddeed0ce3
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0006
external_id: DC0006
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Web Credential Creation
description: Initial construction of new web credential material (ex: Windows EID 1200 or 4769)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:ADFS
channel: Token issuance events showing anomalous claims or issuers
name: AWS:CloudTrail
channel: AssumeRole, GetFederationToken API calls by unusual or new entities
name: azure:signinlogs
channel: SAML/OIDC tokens issued without corresponding MFA or password validation
name: m365:unified
channel: Session creation without MFA or login event
name: m365:oauth
channel: OAuth grants or tokens issued without expected user consent
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5fe82895-28e5-4aac-845e-dc886b63be2e
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0077
external_id: DC0077
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:37.615Z
name: Container Start
description: "Container Start" data component captures events related to the activation or invocation of a container within a containerized environment. This includes starting a previously stopped container, restarting an existing container, or initializing a container for runtime. Monitoring these activities is critical for identifying unauthorized or unexpected container activations, which may indicate potential adversarial activity or misconfigurations. Examples: 

- Docker Example: `docker start `, `docker restart `
- Kubernetes Example: Kubernetes automatically restarts containers as part of pod lifecycle management (e.g., due to health checks or configuration changes).
- Cloud-Native Example
 - AWS ECS: API Call: StartTask to activate a stopped ECS task.
 - Azure Container Instances: Command to restart a container group instance.
 - GCP Kubernetes Engine: Automatic restarts as part of node or pod management.

This data component can be collected through the following measures:

- Docker Audit Logging: Enable Docker logging to capture start and restart events. Use tools like auditd to monitor terminal activity involving container lifecycle commands.
- Kubernetes Audit Logs: Enable Kubernetes API server audit logging.
- Cloud Provider Logs
 - AWS CloudTrail: Capture StartTask or related API calls for ECS.
 - Azure Monitor: Track activity in container groups that indicate start or restart events.
 - GCP Cloud Logging: Record logs related to pod restarts or scaling events in Kubernetes Engine.
- SIEM Integration: Collect logs from Docker, Kubernetes, and cloud services to correlate container start events.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: docker:events
channel: exec_create: docker exec events targeting running containers from non-CI sources
name: kubernetes:events
channel: start: ContainerStarted or Pulling image → Started container
name: containerd:runtime
channel: CRI CreateContainer/StartContainer with privileged=true OR added capabilities OR host* namespaces
name: docker:events
channel: start
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0033
external_id: DC0033
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Process Termination
description: The exit or termination of a running process on a system. This can occur due to normal operations, user-initiated commands, or malicious actions such as process termination by malware to disable security controls.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
mobile-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Process
channel: None
name: WinEventLog:Sysmon
channel: EventCode=5
name: linux:syslog
channel: Unexpected termination of daemons or critical services not aligned with admin change tickets
name: macos:osquery
channel: process_termination: Unexpected termination of processes tied to vulnerable or high-value services
name: esxi:hostd
channel: Log entries indicating VM powered off or forcibly terminated
name: macos:unifiedlog
channel: Terminal process killed (killall Terminal) immediately after sudoers modification
name: auditd:SYSCALL
channel: exit_group
name: macos:unifiedlog
channel: process.*exit.*code
name: linux:osquery
channel: unexpected termination of syslog or rsyslog processes
name: auditd:SYSCALL
channel: Process segfault or abnormal termination after invoking vulnerable syscall sequence
name: auditd:SYSCALL
channel: kill syscalls targeting logging/security processes
name: macos:unifiedlog
channel: Termination of syspolicyd or XProtect processes
name: docker:runtime
channel: Termination of monitoring sidecar or security container
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--66531bc6-a509-4868-8314-4d599e91d222
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0065
external_id: DC0065
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Service Modification
description: Changes made to an existing service or daemon, such as modifying the service name, start type, execution parameters, or security configurations.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Service
channel: None
name: WinEventLog:Microsoft-IIS-Configuration
channel: Module or ISAPI filter registration events
name: WinEventLog:System
channel: EventCode=7040
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--672b2ebd-4310-4efe-bf03-7ab005298a74
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0030
external_id: DC0030
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Pod Modification
description: Changes made to a pod’s configuration or control data within a containerized cluster. This can include updating settings such as resource limits, environment variables, annotations, labels, or even the containers running within the pod. Pod modifications are often executed using commands like kubectl set, kubectl patch, or kubectl edit.

*Data Collection Measures:* 

- Kubernetes API Server Audit Logs:
 - Capture all API calls related to pod modification, such as PATCH, PUT, or UPDATE methods on v1/pods.
- Runtime Security Tools:
 - Tools like Falco, Sysdig, and Kube-bench can monitor pod modifications at runtime and alert on policy violations.
- Container Orchestration Logs:
 - Monitor events logged by Kubernetes itself (e.g., `kubectl logs -n kube-system kube-controller-manager`).
- SIEM and EDR Solutions:
 - Use SIEM platforms (e.g., Splunk) to aggregate API server logs and detect patterns of unauthorized or suspicious pod modifications.
 - Endpoint Detection and Response (EDR) tools configured with container visibility can monitor commands like `kubectl` set or `kubectl patch`.
- Host-Based Monitoring:
 - Collect and analyze logs for processes executing `kubectl` commands or interacting with Kubernetes configuration files (e.g., `.kube/config`).
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--73ff2dcc-24b1-4368-b9dc-706dd9e68354
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0054
external_id: DC0054
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Drive Access
description: Refers to the act of accessing a data storage device, such as a hard drive, SSD, USB, or network-mounted drive. This data component logs the opening or mounting of drives, capturing activities such as reading, writing, or executing files within an assigned drive letter (e.g., `C:\`, `/mnt/drive`) or mount point. Examples: 

- Removable Drive Insertion: A USB drive is inserted, assigned the letter `F:\`, and files are accessed.
- Network Drive Mounting: A network share `\\server\share` is mapped to the drive `Z:\`.
- External Hard Drive Access: An external drive is connected, mounted at `/mnt/backup`, and accessed for copying files.
- System Volume Access: The system volume `C:\` is accessed for modifications to critical files.
- Cloud-Synced Drives: Cloud storage drives like OneDrive or Google Drive are accessed via local mounts.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Sysmon
channel: EventCode=9
name: auditd:SYSCALL
channel: open/write syscalls on /dev/sd* or /dev/nvme*
name: auditd:SYSCALL
channel: write syscalls to /dev/sd* targeting offset 0
name: auditd:SYSCALL
channel: open/write syscalls to block devices (/dev/sd*, /dev/nvme*)
name: linux:syslog
channel: mount/umount or file copy logs
name: fs:fsusage
channel: open/read/mount operations
name: linux:osquery
channel: hardware_events
name: macos:osquery
channel: usb_devices
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--746f095a-f84c-4ccc-90a5-c7caa5c100a2
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0053
external_id: DC0053
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Firewall Metadata
description: Contextual information about firewalls, including their configurations, policies, status, and other details such as names and associated rules. This metadata provides valuable insights into the operational state and configurations of firewalls, both in cloud control planes and host systems. Examples: 

- Firewall Name and Configuration: The name, type, and purpose of a firewall such as "Azure Firewall - Production Environment."
- Policy Details: Capturing firewall policy details, such as "Allow inbound TCP 443 to web servers."
- Firewall Status: Status indicators like "Active," "Disabled," or "Pending Updates."
- Audit Log Metadata: Log entries showing administrative changes, such as "Policy modified by admin@domain.com."
- Rules Associated with Firewalls: Rules specifying source/destination IP ranges, protocols, and ports.
- Tagging Information: Tags like "Environment: Production" or "Owner: NetworkOps."

This data component can be collected through the following measures:

Cloud Control Plane

- Azure: Use Azure Activity Logs and Network Watcher to collect metadata for Azure Firewall.
 - Example: `az network firewall show --name `
- AWS: Use AWS CloudTrail and describe commands: `aws ec2 describe-security-groups`
- Google Cloud: Use gcloud commands to extract metadata: `gcloud compute firewall-rules list --format=json`

Host-Based Firewalls

- Windows: Use PowerShell to gather metadata: `Get-NetFirewallRule -PolicyStore PersistentStore`
- Linux: Query iptables or nftables rulesets: `iptables -S`
- macOS: Use pfctl to extract metadata: `sudo pfctl -sr`

SIEM Integration

- Collect logs from cloud platforms, host systems, and network appliances.

API Monitoring

- Monitor API calls for metadata requests. Example (AWS): `Capture DescribeSecurityGroups or DescribeNetworkAcls` calls via CloudTrail.

Endpoint Detection and Response (EDR)

- Use EDR solutions to monitor firewall management tools for configuration changes or queries.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--74fa567d-bc90-425c-8a41-3c703abb221c
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0041
external_id: DC0041
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Service Metadata
description: Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Service
channel: None
name: WinEventLog:Sysmon
channel: EventCode=4
name: linux:syslog
channel: service stopped messages
name: macos:unifiedlog
channel: launchctl disable or bootout calls
name: esxi:hostd
channel: Stop VM or disable service events via vim-cmd
name: linux:syslog
channel: auditd service stopped or disabled
name: macos:osquery
channel: launchd
name: linux:osquery
channel: scheduled/real-time
name: macos:unifiedlog
channel: subsystem=com.apple.launchservices
name: esxi:hostd
channel: registers services with legitimate-sounding names
name: WinEventLog:System
channel: EventCode=7035
name: linux:syslog
channel: Service restart with modified executable path
name: macos:unifiedlog
channel: Observed loading of new LaunchAgent or LaunchDaemon plist
name: kubernetes:audit
channel: seccomp or AppArmor profile changes
name: WinEventLog:System
channel: Service stopped or RecoveryDisabled set via REAgentC
name: esxi:hostd
channel: Service events
name: WinEventLog:WinRM
channel: EventCode=6
name: auditd:CONFIG_CHANGE
channel: delete: Modification of systemd unit files or config for security agents
name: macos:unifiedlog
channel: Modification of system configuration profiles affecting security tools
name: kubernetes:audit
channel: kubectl delete or patch of security pods/admission controllers
name: networkdevice:config
channel: write: Startup configuration changes disabling security checks
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--7561ed50-16cb-4826-82c7-c1ddca61785e
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0081
external_id: DC0081
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Instance Deletion
description: Removal of a virtual machine (VM) or compute instance within a cloud infrastructure. This activity results in the termination and deletion of the allocated resources (e.g., CPU, memory, storage), making the instance unavailable for future use. Examples:

- AWS: instance deletion involves the `TerminateInstances` API call, which is recorded in CloudTrail logs.
- Azure: VM deletion can be monitored via Azure Activity Logs, showing the `Microsoft.Compute/virtualMachines/delete` operation.
- GCP: instance deletion is logged as an instance.delete operation within GCP Audit Logs.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: azure:activity
channel: MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE
name: gcp:audit
channel: compute.instances.delete
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--7b375092-3a61-448d-900a-77c9a4bde4dc
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0005
external_id: DC0005
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Scheduled Job Metadata
description: Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Scheduled Job
channel: None
name: linux:cron
channel: cron activity
name: fs:fileevents
channel: /Library/LaunchDaemons/*.plist, ~/Library/LaunchAgents/*.plist
name: WinEventLog:TaskScheduler
channel: Task registration/execution shortly after a time discovery event
name: macos:unifiedlog
channel: New/modified launchd plist (persistence/scheduling) within TimeWindow after time query
name: esxi:syslog
channel: /var/log/vpxa.log task invocations tied to time configuration
name: WinEventLog:System
channel: EventCode=106, 200
name: macos:launchd
channel: launchd.plist and logs
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--7f70fae7-a68d-4730-a83a-f260b9606129
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0056
external_id: DC0056
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Windows Registry Key Creation
description: Initial construction of a new registry key within the Windows operating system. 
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: WinEventLog:Sysmon
channel: EventCode=12