Default Profile - MITRE ATT&CK Profile

The MITRE ATT&CK Profile contains 39 MITRE ATT&CK rules and can be added to intents. It is not editable by the user but it can be cloned. The cloned profile is editable. MITRE ATT&CK Profile includes the following rules:

1. Suspicious MS Office behavior

2. T1015 - Accessibility features 1

3. T1015 - Accessibility features 2

4. T1085 - rundll32

5. T1118 - InstallUtil

6. T1121 - Regsvcs/Regasm

7. T1127 - Trusted Developer Utilities - msbuild.exe

8. T1127 - Trusted Developer Utilities - rcsi.exe

9. T1127 - Trusted Developer Utilities - tracker.exe

10. T1128 - Netsh Helper Dll

11. T1136 - Create Account

12. T1138 - Application Shimming

13. T1180 - Screensaver

14. T1191 - CMSTP

15. T1202 - Indirect Command Execution - forfiles.exe

16. T1202 - Indirect Command Execution - pcalua.exe

17. T1216 - Signed Script Proxy Execution - pubprn.vbs

18. T1218 - Signed Binary Proxy Execution - msiexec.exe

19. T1218 - Signed Binary Proxy Execution - odbcconf.exe

20. T1218 - Signed Binary Proxy Execution - Register-CimProvider

21. T1220 - XSL Script Processing - msxsl.exe

22. T1220 - XSL Script Processing - wmic

23. T1223 - Compiled HTML Files

24. T1003 - Credential Dumping - Lsass

25. T1140 - Deobfuscate/Decode Files or Information

26. T1076 - Remote Desktop Protocol

27. T1197 - BITS Jobs - Powershell

28. T1170 - MSHTA

29. T1158 - Hidden Files and Directories

30. T1114 - Email Collection

31. T1070 - Indicator Removal on Host - Event Log

32. T1070 - Indicator Removal on Host - USN

33. T1053 - Scheduled Task

34. T1003 - Credential Dumping - Vaultcmd

35. T1003 - Credential Dumping - Registry

36. T1201 - Password Policy Discovery 1

37. T1081 - Credentials in Files - Linux

38. T1081 - Credentials in Files - Windows

39. T1089 - Disabling Security Tools