Tenable Identity Exposure
Search Tenable Identity Exposure rules.
Telemetry Evidence
These values show how indexed rules identify Tenable Identity Exposure telemetry.Kusto
afad_parser
Detection Rules
Kusto #
- Tenable.ad Active Directory attacks pathways source low: 'Searches for triggered Indicators of Exposures related to Active Directory attacks pathways.'
T1110 - Tenable.ad DCShadow source high: 'Searches for DCShadow attacks.'
T1207 - Tenable.ad DCSync source high: 'Searches for DCSync attacks.'
T1003,T1003.006 - Tenable.ad Golden Ticket source high: 'Searches for Golden Ticket attacks.'
T1558,T1558.001 - Tenable.ad Indicators of Attack source low: 'Searches for triggered Indicators of Attack.'
T1110 - Tenable.ad Indicators of Exposures source low: 'Searches for triggered Indicators of Exposures.'
T1110 - Tenable.ad LSASS Memory source high: 'Searches for OS Credentials dumping attacks.'
T1003,T1003.001 - Tenable.ad Password Guessing source high: 'Searches for bruteforce Password Guessing attacks.'
T1110 - Tenable.ad Password issues source low: 'Searches for triggered Indicators of Exposures related to password issues.'
T1110 - Tenable.ad Password Spraying source high: 'Searches for Password spraying attacks.'
T1110,T1110.003
Show 14 more
- Tenable.ad privileged accounts issues source low: 'Searches for triggered Indicators of Exposures related to privileged accounts issues.'
T1110 - Tenable.ad user accounts issues source low: 'Searches for triggered Indicators of Exposures related to user accounts issues.'
T1110 - TIE Active Directory attacks pathways source low: 'Searches for triggered Indicators of Exposures related to Active Directory attacks pathways.'
T1110 - TIE DCShadow source high: 'Searches for DCShadow attacks.'
T1207 - TIE DCSync source high: 'Searches for DCSync attacks.'
T1003,T1003.006 - TIE Golden Ticket source high: 'Searches for Golden Ticket attacks.'
T1558,T1558.001 - TIE Indicators of Attack source low: 'Searches for triggered Indicators of Attack.'
T1110 - TIE Indicators of Exposures source low: 'Searches for triggered Indicators of Exposures.'
T1110 - TIE LSASS Memory source high: 'Searches for OS Credentials dumping attacks.'
T1003,T1003.001 - TIE Password Guessing source high: 'Searches for bruteforce Password Guessing attacks.'
T1110 - TIE Password issues source low: 'Searches for triggered Indicators of Exposures related to password issues.'
T1110 - TIE Password Spraying source high: 'Searches for Password spraying attacks.'
T1110,T1110.003 - TIE privileged accounts issues source low: 'Searches for triggered Indicators of Exposures related to privileged accounts issues.'
T1110 - TIE user accounts issues source low: 'Searches for triggered Indicators of Exposures related to user accounts issues.'
T1110