_all_ossem_relationships.json

[
    {
        "relationship_id": "REL-2022-0001",
        "name": "User attempted to authenticate from Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Reid Gilman @reidgilman",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account authentication"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to authenticate from",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "4624",
                "name": "An account was successfully logged on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "4625",
                "name": "An account failed to log on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Account Lockout",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4648",
                "name": "A logon was attempted using explicit credentials.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceLogonEvents",
                "name": "DeviceLogonEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LogonSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0002",
        "name": "User created User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4720",
                "name": "A user account was created.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4741",
                "name": "A computer account was created.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Computer Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "UserAccountCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0003",
        "name": "User modified User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4738",
                "name": "A user account was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4781",
                "name": "The name of an account was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4742",
                "name": "A computer account was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Computer Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "UserAccountModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4742"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0004",
        "name": "User terminated Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process termination"
        },
        "behavior": {
            "source": "user",
            "relationship": "terminated",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "4689",
                "name": "A process has exited.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "Process Termination",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5",
                "name": "Process terminated.",
                "platform": "windows",
                "audit_category": "ProcessTerminate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "5",
                "name": "Process terminated.",
                "platform": "linux",
                "audit_category": "ProcessTerminate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4689",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-5-process-terminated"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0005",
        "name": "User modified",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": null
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "PasswordUpdated"
                    },
                    {
                        "eventType": "AwsConsoleSignin"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": [
            "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html"
        ],
        "notes": [
            "Potential contribution for ATT&CK - User Account / user account metadata"
        ]
    },
    {
        "relationship_id": "REL-2022-0006",
        "name": "User accessed Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process access"
        },
        "behavior": {
            "source": "user",
            "relationship": "accessed",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Kernel Object",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Process"
                    }
                ],
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "OpenProcessApiCall"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Process / process access",
            "Event 4663, this event generates only if object's SACL has required ACE to handle specific access right use."
        ]
    },
    {
        "relationship_id": "REL-2022-0007",
        "name": "Process connected from Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected from",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5156",
                "name": "The Windows Filtering Platform has permitted a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "InboundConnectionAccepted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0008",
        "name": "User retrieved information about Firewall",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall metadata"
        },
        "behavior": {
            "source": "user",
            "relationship": "retrieved information about",
            "target": "firewall"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeFirewall"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeFirewallPolicy"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0009",
        "name": "User locked User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "locked",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4740",
                "name": "A user account was locked out.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0046",
        "name": "User created logon from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "logon session",
            "data_component": "logon session creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created logon from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "4624",
                "name": "An account was successfully logged on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "4778",
                "name": "A session was reconnected to a Window Station.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Other Logon/Logoff Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceLogonEvents",
                "name": "DeviceLogonEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LogonSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0011",
        "name": "Application host started",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "application host",
            "relationship": "started",
            "target": null
        },
        "security_events": [
            {
                "event_id": "400",
                "name": "Engine state is changed from None to Available.",
                "platform": "windows",
                "channel": "Windows PowerShell",
                "log_source": "PowerShell",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Command / command context"
        ]
    },
    {
        "relationship_id": "REL-2022-0012",
        "name": "Process attempted connection to Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "attempted connection to",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionAttempt"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0048",
        "name": "Process accessed Registry",
        "contributors": [
            "Reid Gilman @reidgilman",
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key access"
        },
        "behavior": {
            "source": "process",
            "relationship": "accessed",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Key"
                    }
                ],
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Event 4663 includes the following caveat \\\"This event generates only if object\\u2019\\s SACL has required ACE to handle specific access right use.\\\""
        ]
    },
    {
        "relationship_id": "REL-2022-0014",
        "name": "User loaded Module",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "module",
            "data_component": "module load"
        },
        "behavior": {
            "source": "user",
            "relationship": "loaded",
            "target": "module"
        },
        "security_events": [
            {
                "event_id": "7",
                "name": "Image loaded.",
                "platform": "windows",
                "audit_category": "ImageLoad",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceImageLoadEvents",
                "name": "DeviceImageLoadEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ImageLoaded"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-7-image-loaded"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Module / module load"
        ]
    },
    {
        "relationship_id": "REL-2022-0015",
        "name": "User requested access to AD Object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "active directory",
            "data_component": "active directory object access"
        },
        "behavior": {
            "source": "user",
            "relationship": "requested access to",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "4661",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Access",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0016",
        "name": "User started Application host",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "started",
            "target": "application host"
        },
        "security_events": [
            {
                "event_id": "4103",
                "name": "Module logging.",
                "platform": "windows",
                "channel": "Microsoft-Windows-PowerShell/Operational",
                "log_source": "Microsoft-Windows-PowerShell",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Command / command execution"
        ]
    },
    {
        "relationship_id": "REL-2022-0017",
        "name": "Process connected to Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected to",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5156",
                "name": "The Windows Filtering Platform has permitted a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0102",
        "name": "Process deleted Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key deletion"
        },
        "behavior": {
            "source": "process",
            "relationship": "deleted",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "12",
                "name": "RegistryEvent (Object create and delete).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryValueDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryKeyDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "4657",
                "name": "A registry value was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ActionType": "Registry value deleted"
                    }
                ],
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4660",
                "name": "An object was deleted.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete"
        ],
        "notes": [
            "Event ID 4657 is logged for Creation, Modification and Deletion of registry key values. Use \"Operation Type=Registry value deleted\" to look for deletions."
        ]
    },
    {
        "relationship_id": "REL-2022-0018",
        "name": "User executed Command",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "command",
            "data_component": "command execution"
        },
        "behavior": {
            "source": "user",
            "relationship": "executed",
            "target": "command"
        },
        "security_events": [
            {
                "event_id": "4688",
                "name": "A new process has been created.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "Process Creation",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "windows",
                "audit_category": "ProcessCreate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4103",
                "name": "Module logging.",
                "platform": "windows",
                "channel": "Microsoft-Windows-PowerShell/Operational",
                "log_source": "Microsoft-Windows-PowerShell",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceProcessEvents",
                "name": "DeviceProcessEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ProcessCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0019",
        "name": "User unlocked User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "unlocked",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4767",
                "name": "A user account was unlocked.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4767"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0020",
        "name": "Process deleted File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file deletion"
        },
        "behavior": {
            "source": "process",
            "relationship": "deleted",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "23",
                "name": "File Delete archived.",
                "platform": "windows",
                "audit_category": "FileDelete",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "23",
                "name": "File Delete archived.",
                "platform": "linux",
                "audit_category": "FileDelete",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "26",
                "name": "File Delete logged.",
                "platform": "windows",
                "audit_category": "FileDeleteDetected",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4660",
                "name": "An object was deleted.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-23-filedelete-file-delete-archived",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-26-filedeletedetected-file-delete-logged"
        ]
    },
    {
        "relationship_id": "REL-2022-0021",
        "name": "User stopped cloud service from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "stopped cloud service from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "StopLogging"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Cloud Service / cloud service stop - new component"
        ]
    },
    {
        "relationship_id": "REL-2022-0074",
        "name": "Device blocked connection from Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked connection from",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0024",
        "name": "User enabled User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "enabled",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4722",
                "name": "A user account was enabled.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "UserAccountModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0025",
        "name": "Firewall Rule added",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "firewall rule",
            "relationship": "modified",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4947",
                "name": "A change has been made to Windows Firewall exception list. A rule was modified.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "MPSSVC Rule-Level Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4947"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0026",
        "name": "User modified Cloud service",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "cloud service",
            "data_component": "cloud service modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "cloud service"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "UpdateTrail"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0027",
        "name": "User added firewall rule from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "added firewall rule from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "CreateRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall rule modification"
        ]
    },
    {
        "relationship_id": "REL-2022-0029",
        "name": "Process terminated",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process metadata"
        },
        "behavior": {
            "source": "process",
            "relationship": "terminated",
            "target": null
        },
        "security_events": [
            {
                "event_id": "5",
                "name": "Process terminated.",
                "platform": "windows",
                "audit_category": "ProcessTerminate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "5",
                "name": "Process terminated.",
                "platform": "linux",
                "audit_category": "ProcessTerminate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-5-process-terminated"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0030",
        "name": "User created Scheduled job",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "scheduled job",
            "data_component": "scheduled job creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "scheduled job"
        },
        "security_events": [
            {
                "event_id": "4698",
                "name": "A scheduled task was created.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Other Object Access Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ScheduledTaskCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0031",
        "name": "User modified cloud service from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "modified cloud service from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "UpdateTrail"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Cloud Service / cloud service modification"
        ]
    },
    {
        "relationship_id": "REL-2022-0032",
        "name": "User listed Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall enumeration"
        },
        "behavior": {
            "source": "user",
            "relationship": "listed",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ListRuleGroups"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0034",
        "name": "User deleted Scheduled job",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "scheduled job",
            "data_component": "scheduled job deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "scheduled job"
        },
        "security_events": [
            {
                "event_id": "4699",
                "name": "A scheduled task was deleted.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Other Object Access Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ScheduledTaskDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0035",
        "name": "Firewall disabled",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall disable"
        },
        "behavior": {
            "source": "firewall",
            "relationship": "disabled",
            "target": null
        },
        "security_events": [
            {
                "event_id": "5025",
                "name": "The Windows Firewall Service has been stopped.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Other System Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5034",
                "name": "The Windows Firewall Driver was stopped.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Other System Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5034"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0036",
        "name": "Process requested access to File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file access"
        },
        "behavior": {
            "source": "process",
            "relationship": "requested access to",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "File"
                    }
                ],
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0037",
        "name": "User created Group",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "group",
            "data_component": "group creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "group"
        },
        "security_events": [
            {
                "event_id": "4727",
                "name": "A security-enabled global group was created.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4731",
                "name": "A security-enabled local group was created.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4754",
                "name": "A security-enabled universal group was created.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0038",
        "name": "Process removed Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "process",
            "relationship": "removed",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "2006",
                "name": "A rule has been deleted in the Windows Defender Firewall exception list",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0040",
        "name": "User retrieved information about Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "retrieved information about",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall metadata"
        ]
    },
    {
        "relationship_id": "REL-2022-0041",
        "name": "User modified File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "4670",
                "name": "Permissions on an object were changed.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0042",
        "name": "User granted acess to User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "granted access to",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4717",
                "name": "System security access was granted to an account.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "Authentication Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4717"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0043",
        "name": "User created File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Ruben Bouman @rubinatorz",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "11",
                "name": "FileCreate.",
                "platform": "linux",
                "audit_category": "FileCreate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Event 4663 includes the following caveat \"This event generates only if object's SACL has required ACE to handle specific access right use\".",
            "Event ID 4663 logs attempts of accesses to objects. Look for file creations by searching for \"Accesses=WriteData\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0044",
        "name": "User enabled Drive",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "drive",
            "data_component": "drive modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "enabled",
            "target": "drive"
        },
        "security_events": [
            {
                "event_id": "6422",
                "name": "A device was enabled.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6422"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0045",
        "name": "User deleted Group",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "group",
            "data_component": "group deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "group"
        },
        "security_events": [
            {
                "event_id": "4730",
                "name": "A security-enabled global group was deleted.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4734",
                "name": "A security-enabled local group was deleted.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4758",
                "name": "A security-enabled universal group was deleted.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0059",
        "name": "User created logon from Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "logon session",
            "data_component": "logon session creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created logon from",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "4624",
                "name": "An account was successfully logged on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "DeviceLogonEvents",
                "name": "DeviceLogonEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LogonSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0047",
        "name": "User listed firewall rule from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "listed firewall rule from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ListRuleGroups"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall enumeration"
        ]
    },
    {
        "relationship_id": "REL-2022-0049",
        "name": "Firewall enabled",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall metadata"
        },
        "behavior": {
            "source": "firewall",
            "relationship": "enabled",
            "target": null
        },
        "security_events": [
            {
                "event_id": "5024",
                "name": "The Windows Firewall Service has started successfully.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Other System Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5024"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall enable"
        ]
    },
    {
        "relationship_id": "REL-2022-0058",
        "name": "Device permitted port bind on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "device",
            "relationship": "permitted port bind on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5158",
                "name": "The Windows Filtering Platform has permitted a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Network Traffic / network connection creation"
        ]
    },
    {
        "relationship_id": "REL-2022-0077",
        "name": "User accessed Registry",
        "contributors": [
            "Reid Gilman @reidgilman"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key access"
        },
        "behavior": {
            "source": "user",
            "relationship": "accessed",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Key"
                    }
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Event 4663 includes the following caveat \"This event generates only if object's SACL has required ACE to handle specific access right use\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0051",
        "name": "Process connected from Host",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected from",
            "target": "host"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "InboundConnectionAccepted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0053",
        "name": "User attempted to disable Drive",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "drive",
            "data_component": "drive modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to disable",
            "target": "drive"
        },
        "security_events": [
            {
                "event_id": "6419",
                "name": "A request was made to disable a device.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6419"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0090",
        "name": "Device permitted listener on Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "permitted listener on",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5154",
                "name": "The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0054",
        "name": "User attempted to access File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "attempted to access",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "4692",
                "name": "Backup of data protection master key was attempted.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "DPAPI Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4692"
        ],
        "notes": [
            "Potential contribution for ATT&CK - File / file access"
        ]
    },
    {
        "relationship_id": "REL-2022-0055",
        "name": "Application domain started",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "application domain",
            "relationship": "started",
            "target": null
        },
        "security_events": [
            {
                "event_id": "53504",
                "name": "Windows PowerShell has started an IPC listening thread on a process in AppDomain.",
                "platform": "windows",
                "channel": "Microsoft-Windows-PowerShell/Operational",
                "log_source": "Microsoft-Windows-PowerShell",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Command / command context"
        ]
    },
    {
        "relationship_id": "REL-2022-0056",
        "name": "Process attempted connection to Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "attempted connection to",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionAttempt"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0057",
        "name": "User connected to Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected to",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0084",
        "name": "Device blocked port bind on Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked port bind on",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "5159",
                "name": "The Windows Filtering Platform has blocked a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0187",
        "name": "Logon Process Trusted",
        "contributors": [
            "Hamza OUADIA @Cyb3rSn0rlax"
        ],
        "attack": null,
        "behavior": {
            "source": "logon process",
            "relationship": "trusted",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4611",
                "name": "A trusted logon process has been registered with the Local Security Authority.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security System Extension",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611",
            "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4611"
        ],
        "notes": [
            "This event indicates that a logon process has registered with the Local Security Authority (LSA).",
            "At the technical level, the event does not come from the registration of a trusted logon process, but from a confirmation that the process is a trusted logon process. If it is a trusted logon process, the event generates."
        ]
    },
    {
        "relationship_id": "REL-2022-0060",
        "name": "Process connected to Pipe",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "named pipe",
            "data_component": "named pipe metadata"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected to",
            "target": "pipe"
        },
        "security_events": [
            {
                "event_id": "18",
                "name": "PipeEvent (Pipe Connected).",
                "platform": "windows",
                "audit_category": "PipeEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Named Pipe / named pipe connection",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-18-pipeevent-pipe-connected"
        ]
    },
    {
        "relationship_id": "REL-2022-0186",
        "name": "User created Logon",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "logon session",
            "data_component": "logon session creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "logon"
        },
        "security_events": [
            {
                "event_id": "4624",
                "name": "An account was successfully logged on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "4778",
                "name": "A session was reconnected to a Window Station.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Other Logon/Logoff Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4964",
                "name": "Special groups have been assigned to a new logon.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Special Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceLogonEvents",
                "name": "DeviceLogonEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LogonSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0061",
        "name": "Sensor Health changed",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "sensor health",
            "data_component": "host status"
        },
        "behavior": {
            "source": "sensor health",
            "relationship": "changed",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4",
                "name": "Sysmon service state changed.",
                "platform": "windows",
                "audit_category": "ServiceStateChange",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "1100",
                "name": "The event logging service has shut down.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-Eventlog"
            },
            {
                "event_id": "1101",
                "name": "Audit events have been dropped by the transport.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-Eventlog"
            },
            {
                "event_id": "1102",
                "name": "The audit log was cleared.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-Eventlog"
            },
            {
                "event_id": "1104",
                "name": "The security Log is now full.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-Eventlog"
            },
            {
                "event_id": "6005",
                "name": "The Event log service was started.",
                "platform": "windows",
                "channel": "System",
                "log_source": "EventLog"
            },
            {
                "event_id": "6006",
                "name": "The Event log service was stopped.",
                "platform": "windows",
                "channel": "System",
                "log_source": "EventLog"
            },
            {
                "event_id": "4616",
                "name": "The system time was changed.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security State Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1104",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1105",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0062",
        "name": "User modified firewall rule from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "modified firewall rule from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "UpdateRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall rule modification"
        ]
    },
    {
        "relationship_id": "REL-2022-0063",
        "name": "User deleted AD Object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "active directory",
            "data_component": "active directory object deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "5141",
                "name": "A directory service object was deleted.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Changes",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0064",
        "name": "User disabled Drive",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "drive",
            "data_component": "drive modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "disabled",
            "target": "drive"
        },
        "security_events": [
            {
                "event_id": "6420",
                "name": "A device was disabled.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6420"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0065",
        "name": "User authenticated from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "authenticated from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ConsoleLogin"
                    },
                    {
                        "eventType": "AwsConsoleSignin"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": [
            "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html"
        ],
        "notes": [
            "Potential contribution for ATT&CK - User Account / user account authentication"
        ]
    },
    {
        "relationship_id": "REL-2022-0022",
        "name": "Device blocked listener on Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked listener on",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5155",
                "name": "The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0066",
        "name": "Process executed Script",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "script",
            "data_component": "script execution"
        },
        "behavior": {
            "source": "process",
            "relationship": "executed",
            "target": "script"
        },
        "security_events": [
            {
                "event_id": "4103",
                "name": "Module logging.",
                "platform": "windows",
                "channel": "Microsoft-Windows-PowerShell/Operational",
                "log_source": "Microsoft-Windows-PowerShell",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "4104",
                "name": "Script Block Logging.",
                "platform": "windows",
                "channel": "Microsoft-Windows-PowerShell/Operational",
                "log_source": "Microsoft-Windows-PowerShell",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ScriptContent"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "PowerShellCommand"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "AmsiScriptDetection"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": null
    },
    {
        "relationship_id": "REL-2022-0067",
        "name": "User attempted to enable Drive",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "drive",
            "data_component": "drive modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to enable",
            "target": "drive"
        },
        "security_events": [
            {
                "event_id": "6421",
                "name": "A request was made to enable a device.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6421"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0068",
        "name": "Process listened on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "listened on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5154",
                "name": "The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ListeningConnectionCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0033",
        "name": "Device blocked connection to Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "Device",
            "relationship": "blocked connection to",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "5031",
                "name": "The Windows Firewall Service blocked an application from accepting incoming connections on the network.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FirewallInboundConnectionToAppBlocked"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5031"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0069",
        "name": "User attempted to install Drive",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "drive",
            "data_component": "drive creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to install",
            "target": "drive"
        },
        "security_events": [
            {
                "event_id": "6423",
                "name": "The installation of this device is forbidden by system policy.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0149",
        "name": "Logon modified",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "logon session",
            "data_component": "logon session modification"
        },
        "behavior": {
            "source": "logon",
            "relationship": "modified",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4672",
                "name": "Special privileges assigned to new logon.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Special Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0072",
        "name": "Firewall Rule added",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "firewall rule",
            "relationship": "removed",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4948",
                "name": "A change has been made to Windows Firewall exception list. A rule was deleted.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "MPSSVC Rule-Level Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4948"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0073",
        "name": "Process searched LDAP",
        "contributors": [
            "Hamza OUADI @Cyb3rSn0rlax"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process metadata"
        },
        "behavior": {
            "source": "process",
            "relationship": "searched",
            "target": "ldap"
        },
        "security_events": [
            {
                "event_id": "30",
                "name": "EventID(30)",
                "platform": "windows",
                "log_source": "Microsoft-Windows-LDAP-Client/Debug"
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LdapSearch"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            null
        ],
        "notes": [
            "Host-based ETW provieder for LDAP search filter performed by a process. This event provides valuable data like PID, search filter and attributes."
        ]
    },
    {
        "relationship_id": "REL-2022-0075",
        "name": "User accessed File",
        "contributors": [
            "Reid Gilman @reidgilman",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file access"
        },
        "behavior": {
            "source": "user",
            "relationship": "accessed",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "File"
                    }
                ],
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Event 4663 includes the following caveat \"This event generates only if object's SACL has required ACE to handle specific access right use\".",
            "Event ID 4663 logs attempts of accesses to objects. Look for file access by searching for \"ObjectType=File\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0076",
        "name": "User modified Network share",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network share",
            "data_component": "network share modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "network share"
        },
        "security_events": [
            {
                "event_id": "5143",
                "name": "A network share object was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5143"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0078",
        "name": "User attempted to access Network Share",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network share",
            "data_component": "network share access"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to access",
            "target": "network share"
        },
        "security_events": [
            {
                "event_id": "5140",
                "name": "A network share object was accessed.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "5145",
                "name": "A network share object was checked to see whether client can be granted desired access.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Detailed File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceLogonEvents",
                "name": "DeviceLogonEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LogonSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Network Share / network share access"
        ]
    },
    {
        "relationship_id": "REL-2022-0079",
        "name": "Process attempted connection from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "attempted connection from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionRequest"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0080",
        "name": "User created Wmi object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "wmi",
            "data_component": "wmi creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "wmi object"
        },
        "security_events": [
            {
                "event_id": "19",
                "name": "WmiEvent (WmiEventFilter activity detected).",
                "platform": "windows",
                "audit_category": "WmiEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "20",
                "name": "WmiEvent (WmiEventConsumer activity detected).",
                "platform": "windows",
                "audit_category": "WmiEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "21",
                "name": "WmiEvent (WmiEventConsumerToFilter activity detected).",
                "platform": "windows",
                "audit_category": "WmiEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "WmiBindEventFilterToConsumer"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "5860",
                "name": "WMI temporary event created.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-WMI-Activity",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5861",
                "name": "WMI permanent event created.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-WMI-Activity",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5857",
                "name": "WMIProv provider started.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-WMI-Activity",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5858",
                "name": "WMI Query Error.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-WMI-Activity",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5859",
                "name": "WMI Event.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-WMI-Activity",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected",
            null
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0081",
        "name": "Firewall Rule added",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "firewall rule",
            "relationship": "added",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4946",
                "name": "A change has been made to Windows Firewall exception list. A rule was added.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "MPSSVC Rule-Level Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4946"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0082",
        "name": "User deleted Wmi object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "wmi",
            "data_component": "wmi deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "wmi object"
        },
        "security_events": [
            {
                "event_id": "19",
                "name": "WmiEvent (WmiEventFilter activity detected).",
                "platform": "windows",
                "audit_category": "WmiEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "20",
                "name": "WmiEvent (WmiEventConsumer activity detected).",
                "platform": "windows",
                "audit_category": "WmiEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "21",
                "name": "WmiEvent (WmiEventConsumerToFilter activity detected).",
                "platform": "windows",
                "audit_category": "WmiEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0083",
        "name": "User removed acess from User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "removed access from",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4718",
                "name": "System security access was removed from an account.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "Authentication Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4718"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0085",
        "name": "User accessed AD Object",
        "contributors": [
            "Reid Gilman @reidgilman",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "active directory",
            "data_component": "active directory object access"
        },
        "behavior": {
            "source": "user",
            "relationship": "accessed",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "4662",
                "name": "An operation was performed on an object.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Access",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4932",
                "name": "Synchronization of a replica of an Active Directory naming context has begun.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Replication",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4932"
        ],
        "notes": [
            "Events 4661 and 4662 require a SACL (https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists) to be for an object or they will not generate"
        ]
    },
    {
        "relationship_id": "REL-2022-0125",
        "name": "Process created Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "created",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "12",
                "name": "RegistryEvent (Object create and delete).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "filter_in": [
                    {
                        "EventType": "CreateKey"
                    }
                ],
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryValueSet"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryKeyCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "4657",
                "name": "A registry value was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete"
        ],
        "notes": [
            "Event ID 4657 is logged for Creation, Modification and Deletion of registry key values. Use \"Operation Type=New registry value created\" to look for creations."
        ]
    },
    {
        "relationship_id": "REL-2022-0086",
        "name": "Application attempted to authenticate User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account authentication"
        },
        "behavior": {
            "source": "application",
            "relationship": "attempted to authenticate",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ConsoleLogin"
                    },
                    {
                        "eventType": "AwsConsoleSignin"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": [
            "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html"
        ],
        "notes": [
            "Potential contribution for ATT&CK - User Account / user account authentication"
        ]
    },
    {
        "relationship_id": "REL-2022-0087",
        "name": "User stopped Cloud service",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "stopped",
            "target": "cloud service"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "StopLogging"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Cloud Service / cloud service stop - new component"
        ]
    },
    {
        "relationship_id": "REL-2022-0088",
        "name": "Process added Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "process",
            "relationship": "added",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "2004",
                "name": "A rule has been added to the Windows Defender Firewall exception list",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0089",
        "name": "User restored AD Object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "restored",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "5138",
                "name": "A directory service object was undeleted.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Changes",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5138"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Active Directory / active directory object deletion"
        ]
    },
    {
        "relationship_id": "REL-2022-0052",
        "name": "User attempted to authenticate to Device",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Reid Gilman @reidgilman"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "attempted to authenticate to",
            "target": "device"
        },
        "security_events": [
            {
                "event_id": "4624",
                "name": "An account was successfully logged on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "4625",
                "name": "An account failed to log on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Account Lockout",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4648",
                "name": "A logon was attempted using explicit credentials.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648"
        ],
        "notes": [
            "Potential contribution for ATT&CK - User Account / user account authentication"
        ]
    },
    {
        "relationship_id": "REL-2022-0028",
        "name": "Device blocked connection from Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked connection from",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FirewallInboundConnectionBlocked"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0091",
        "name": "Process attempted to listen on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "attempted to listen on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5155",
                "name": "The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0092",
        "name": "User requested access to File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file access"
        },
        "behavior": {
            "source": "user",
            "relationship": "requested access to",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "File"
                    }
                ]
            },
            {
                "event_id": "4661",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "SAM",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "SAM"
                    }
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661"
        ],
        "notes": [
            "Event 4656 generates only if object's SACL has required ACE to handle specific access right use."
        ]
    },
    {
        "relationship_id": "REL-2022-0093",
        "name": "Process created Pipe",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "named pipe",
            "data_component": "named pipe metadata"
        },
        "behavior": {
            "source": "process",
            "relationship": "created",
            "target": "pipe"
        },
        "security_events": [
            {
                "event_id": "17",
                "name": "PipeEvent (Pipe Created).",
                "platform": "windows",
                "audit_category": "PipeEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Detailed File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-17-pipeevent-pipe-created"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Named Pipe / named pipe creation",
            "Event ID 4656 logs handles to objects. Look for named pipe creation by searching for \"Accesses=CreatePipeInstance\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0094",
        "name": "Service stopped",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "service",
            "data_component": "service metadata"
        },
        "behavior": {
            "source": "service",
            "relationship": "stopped",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4",
                "name": "Sysmon service state changed.",
                "platform": "windows",
                "audit_category": "ServiceStateChange",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "6006",
                "name": "The Event log service was stopped.",
                "platform": "windows",
                "channel": "System",
                "log_source": "EventLog"
            }
        ],
        "references": [
            [
                "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-4-sysmon-service-state-changed"
            ]
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0095",
        "name": "Process modified Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "process",
            "relationship": "modified",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "2005",
                "name": "A rule has been modified in the Windows Defender Firewall exception list.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0096",
        "name": "Wmi object created",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": null,
        "behavior": {
            "source": "wmi object",
            "relationship": "created",
            "target": null
        },
        "security_events": [
            {
                "event_id": "5861",
                "name": "WMI permanent event created.",
                "platform": "windows",
                "log_source": "Microsoft-Windows-WMI-Activity",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "WmiBindEventFilterToConsumer"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - WMI / wmi metadata"
        ]
    },
    {
        "relationship_id": "REL-2022-0097",
        "name": "User created Service",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "service",
            "data_component": "service creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "service"
        },
        "security_events": [
            {
                "event_id": "4697",
                "name": "A service was installed in the system.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security System Extension",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "7045",
                "name": "A new service was installed in the system.",
                "platform": "windows",
                "channel": "System",
                "log_source": "Service Control Manager",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ServiceInstalled"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0098",
        "name": "User connected to Pipe",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "named pipe",
            "data_component": "named pipe metadata"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected to",
            "target": "pipe"
        },
        "security_events": [
            {
                "event_id": "18",
                "name": "PipeEvent (Pipe Connected).",
                "platform": "windows",
                "audit_category": "PipeEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-18-pipeevent-pipe-connected"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Named Pipe / named pipe creation"
        ]
    },
    {
        "relationship_id": "REL-2022-0099",
        "name": "Process requested access to AD Object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "process",
            "relationship": "requested access to",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "4661",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Access",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Active Directory / active directory object access"
        ]
    },
    {
        "relationship_id": "REL-2022-0100",
        "name": "User requested AD Credential",
        "contributors": [
            "Reid Gilman @reidgilman"
        ],
        "attack": {
            "data_source": "active directory",
            "data_component": "active directory credential request"
        },
        "behavior": {
            "source": "user",
            "relationship": "requested",
            "target": "ad credential"
        },
        "security_events": [
            {
                "event_id": "4768",
                "name": "A Kerberos authentication ticket (TGT) was requested.",
                "platform": "windows",
                "audit_category": "Account Logon",
                "audit_sub_category": "Kerberos Authentication Service",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4769",
                "name": "A Kerberos service ticket was requested.",
                "platform": "windows",
                "audit_category": "Account Logon",
                "audit_sub_category": "Kerberos Service Ticket Operations",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769",
            "https://www.cyberark.com/resources/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer",
            "https://stealthbits.com/blog/how-to-detect-pass-the-hash-attacks/"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0101",
        "name": "User started Cloud service",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "started",
            "target": "cloud service"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "StartLogging"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Cloud Service / cloud service start - new component"
        ]
    },
    {
        "relationship_id": "REL-2022-0103",
        "name": "Process bound to Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "bound to",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5158",
                "name": "The Windows Filtering Platform has permitted a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ListeningConnectionCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0115",
        "name": "Device permitted listener on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "permitted listener on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5154",
                "name": "The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0106",
        "name": "User attempted to authenticate to Application",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account authentication"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to authenticate to",
            "target": "application"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ConsoleLogin"
                    },
                    {
                        "eventType": "AwsConsoleSignin"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null
    },
    {
        "relationship_id": "REL-2022-0107",
        "name": "User created Instance",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "instance",
            "data_component": "instance creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "instance"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "RunInstances"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0108",
        "name": "User connected from Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected from",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "InboundConnectionAccepted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0109",
        "name": "User disabled User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "disabled",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4725",
                "name": "A user account was disabled.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "UserAccountModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4725"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0110",
        "name": "User requested access to Service",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "service",
            "data_component": "service access"
        },
        "behavior": {
            "source": "user",
            "relationship": "requested access to",
            "target": "service"
        },
        "security_events": [
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Other Object Access Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0111",
        "name": "Process requested access to Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process access"
        },
        "behavior": {
            "source": "process",
            "relationship": "requested access to",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Kernel Object",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Process"
                    }
                ],
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "10",
                "name": "Process Access.",
                "platform": "windows",
                "audit_category": "ProcessAccess",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "OpenProcessApiCall"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-10-processaccess"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0112",
        "name": "Process attempted connection from Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "attempted connection from",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionRequest"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0113",
        "name": "Process connected to Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected to",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5156",
                "name": "The Windows Filtering Platform has permitted a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0172",
        "name": "User terminated Logon",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "logon session",
            "data_component": "logon session termination"
        },
        "behavior": {
            "source": "user",
            "relationship": "terminated",
            "target": "logon"
        },
        "security_events": [
            {
                "event_id": "4634",
                "name": "An account was logged off.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logoff",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4647",
                "name": "User initiated logoff.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logoff",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0039",
        "name": "Device permitted port bind on Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "device",
            "relationship": "permitted port bind on",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5158",
                "name": "The Windows Filtering Platform has permitted a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Network Traffic / network connection creation"
        ]
    },
    {
        "relationship_id": "REL-2022-0114",
        "name": "User installed Drive",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "drive",
            "data_component": "drive creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "installed",
            "target": "drive"
        },
        "security_events": [
            {
                "event_id": "6416",
                "name": "A new external device was recognized by the system.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "6424",
                "name": "The installation of this device was allowed, after having previously been forbidden by policy.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "PNP Activity",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6424"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0116",
        "name": "User removed firewall rule from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "removed firewall rule from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DeleteRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall rule modification"
        ]
    },
    {
        "relationship_id": "REL-2022-0117",
        "name": "User modified Instance",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "instance",
            "data_component": "instance modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "instance"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ModifyInstanceAttribute"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0118",
        "name": "User removed Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "removed",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DeleteRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "2006",
                "name": "A rule has been deleted in the Windows Defender Firewall exception list",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "2033",
                "name": "All rules have been deleted from the Windows Firewall configuration on this computer.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0159",
        "name": "Device blocked listener on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked listener on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5155",
                "name": "The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0119",
        "name": "User modified Schedule job",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "scheduled job",
            "data_component": "scheduled job modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "schedule job"
        },
        "security_events": [
            {
                "event_id": "4702",
                "name": "A scheduled task was updated.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Other Object Access Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ScheduledTaskUpdated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4702"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0121",
        "name": "Process accessed Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process access"
        },
        "behavior": {
            "source": "process",
            "relationship": "accessed",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "10",
                "name": "ProcessAccess",
                "platform": "windows",
                "audit_category": "ProcessAccess",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Kernel Object",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Process"
                    }
                ],
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "OpenProcessApiCall"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Event 4663, this event generates only if object SACL has required ACE to handle specific access right use."
        ]
    },
    {
        "relationship_id": "REL-2022-0122",
        "name": "User attempted to authenticate from Device",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account authentication"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to authenticate from",
            "target": "device"
        },
        "security_events": [
            {
                "event_id": "4776",
                "name": "The domain controller or local computer attempted to validate the credentials for an account.",
                "platform": "windows",
                "audit_category": "Account Logon",
                "audit_sub_category": "Credential Validation",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0126",
        "name": "Driver loaded",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "driver",
            "data_component": "driver load"
        },
        "behavior": {
            "source": "driver",
            "relationship": "loaded",
            "target": null
        },
        "security_events": [
            {
                "event_id": "6",
                "name": "Driver loaded.",
                "platform": "windows",
                "audit_category": "DriverLoad",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "DriverLoaded"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-6-driver-loaded"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0050",
        "name": "Logon Metadata",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "logon session",
            "data_component": "logon session metadata"
        },
        "behavior": {
            "source": "logon",
            "relationship": "metadata",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4703",
                "name": "A token right was adjusted.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "Authorization Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4673",
                "name": "A privileged service was called.",
                "platform": "windows",
                "audit_category": "Privilege Use",
                "audit_sub_category": "Sensitive Privilege Use",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4674",
                "name": "An operation was attempted on a privileged object.",
                "platform": "windows",
                "audit_category": "Privilege Use",
                "audit_sub_category": "Sensitive Privilege Use",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4610",
                "name": "An authentication package has been loaded by the Local Security Authority.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security System Extension",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4611",
                "name": "A trusted logon process has been registered with the Local Security Authority.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security System Extension",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4614",
                "name": "A notification package has been loaded by the Security Account Manager.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security System Extension",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4622",
                "name": "A security package has been loaded by the Local Security Authority.",
                "platform": "windows",
                "audit_category": "System",
                "audit_sub_category": "Security System Extension",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4674",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4610",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4614",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0173",
        "name": "Device blocked connection to Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked connection to",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FirewallOutboundConnectionBlocked"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0137",
        "name": "Device blocked connection to Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked connection to",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FirewallOutboundConnectionBlocked"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0128",
        "name": "Device blocked listener on Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked listener on",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "5155",
                "name": "The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0164",
        "name": "Device permitted listener on Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "permitted listener on",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "5154",
                "name": "The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0129",
        "name": "User created Pipe",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "named pipe",
            "data_component": "named pipe metadata"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "pipe"
        },
        "security_events": [
            {
                "event_id": "17",
                "name": "PipeEvent (Pipe Created).",
                "platform": "windows",
                "audit_category": "PipeEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "5145",
                "name": "A network share object was checked to see whether client can be granted desired access.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Detailed File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-17-pipeevent-pipe-created"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Named Pipe / named pipe creation",
            "Event ID 5145 logs accesses of network share objects. Look for named pipe by searching for \"Accesses=CreatePipeInstance\".",
            "Event ID 4656 logs handles to objects. Look for named pipe by searching for \"Accesses=CreatePipeInstance\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0130",
        "name": "User deleted Registry",
        "contributors": [
            "Ruben Bouman @rubinatorz",
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "12",
                "name": "RegistryEvent (Object create and delete).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryValueDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryKeyDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "4657",
                "name": "A registry value was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "OperationType": "Registry value deleted"
                    }
                ],
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4660",
                "name": "An object was deleted.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660"
        ],
        "notes": [
            "Event ID 4657 is logged for Creation, Modification and Deletion of registry key values. Use \"Operation Type=Registry value deleted\" to look for deletions."
        ]
    },
    {
        "relationship_id": "REL-2022-0131",
        "name": "Process executed Command",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "command",
            "data_component": "command execution"
        },
        "behavior": {
            "source": "process",
            "relationship": "executed",
            "target": "command"
        },
        "security_events": [
            {
                "event_id": "4688",
                "name": "A new process has been created.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "Process Creation",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "windows",
                "audit_category": "ProcessCreate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "linux",
                "audit_category": "ProcessCreate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "4103",
                "name": "Module logging.",
                "platform": "windows",
                "channel": "Microsoft-Windows-PowerShell/Operational",
                "log_source": "Microsoft-Windows-PowerShell",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceProcessEvents",
                "name": "DeviceProcessEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ProcessCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation",
            null
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0133",
        "name": "User attempted to modify User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to modify",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4723",
                "name": "An attempt was made to change an account's password.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4724",
                "name": "An attempt was made to reset an account's password.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0134",
        "name": "User retrieved information about firewall from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "retrieved information about firewall from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeFirewall"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeFirewallPolicy"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall metadata"
        ]
    },
    {
        "relationship_id": "REL-2022-0135",
        "name": "User connected to Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected to",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0010",
        "name": "Device blocked port bind on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked port bind on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5159",
                "name": "The Windows Filtering Platform has blocked a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0136",
        "name": "User created AD Object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "active directory",
            "data_component": "active directory object creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "5137",
                "name": "A directory service object was created.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Changes",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0132",
        "name": "User attempted to log off from Device",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "attempted to log off from",
            "target": "device"
        },
        "security_events": [
            {
                "event_id": "4647",
                "name": "User initiated logoff.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logoff",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Logon Session / logon session termination"
        ]
    },
    {
        "relationship_id": "REL-2022-0139",
        "name": "Process accessed File",
        "contributors": [
            "Reid Gilman @reidgilman",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file access"
        },
        "behavior": {
            "source": "process",
            "relationship": "accessed",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663"
        ],
        "notes": [
            "Event 4663 includes the following caveat \"This event generates only if object's SACL has required ACE to handle specific access right use.\"",
            "Event ID 4663 logs attempts of accesses to objects. Look for file access by searching for \"ObjectType=File\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0140",
        "name": "User retrieved information about firewall rule from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "retrieved information about firewall rule from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall metadata"
        ]
    },
    {
        "relationship_id": "REL-2022-0141",
        "name": "Process connected to Host",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected to",
            "target": "host"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            [
                "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
            ]
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0143",
        "name": "Process modified Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process modification"
        },
        "behavior": {
            "source": "process",
            "relationship": "modified",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "8",
                "name": "CreateRemoteThread.",
                "platform": "windows",
                "audit_category": "CreateRemoteThread",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "CreateRemoteThreadApiCall"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0144",
        "name": "User deleted File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "23",
                "name": "File Delete archived.",
                "platform": "windows",
                "audit_category": "FileDelete",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "23",
                "name": "File Delete archived.",
                "platform": "linux",
                "audit_category": "FileDelete",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "26",
                "name": "File Delete logged.",
                "platform": "windows",
                "audit_category": "FileDeleteDetected",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4660",
                "name": "An object was deleted.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-23-filedelete-file-delete-archived",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-26-filedeletedetected-file-delete-logged"
        ],
        "notes": [
            "Event ID 4663 logs attempts of accesses to objects. Look for file creations by searching for \"Accesses=Delete\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0124",
        "name": "Device blocked port bind on Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked port bind on",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5159",
                "name": "The Windows Filtering Platform has blocked a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0146",
        "name": "User created Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "4688",
                "name": "A new process has been created.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "Process Creation",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "windows",
                "audit_category": "ProcessCreate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "linux",
                "audit_category": "ProcessCreate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceProcessEvents",
                "name": "DeviceProcessEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ProcessCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0147",
        "name": "User started cloud service from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "started cloud service from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "StartLogging"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Cloud Service / cloud service start - new component"
        ]
    },
    {
        "relationship_id": "REL-2022-0127",
        "name": "Firewall attempted to load Configuration",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall metadata"
        },
        "behavior": {
            "source": "firewall",
            "relationship": "attempted to load",
            "target": "configuration"
        },
        "security_events": [
            {
                "event_id": "2009",
                "name": "The Windows Firewall service failed to load Group Policy.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": []
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0148",
        "name": "User enabled Scheduled job",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "scheduled job",
            "data_component": "scheduled job modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "enabled",
            "target": "scheduled job"
        },
        "security_events": [
            {
                "event_id": "4700",
                "name": "A scheduled task was enabled.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Other Object Access Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ScheduledTaskModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4700"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0150",
        "name": "Process executed Api call",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "OS api execution"
        },
        "behavior": {
            "source": "process",
            "relationship": "executed",
            "target": "api call"
        },
        "security_events": [
            {
                "event_id": "8",
                "name": "CreateRemoteThread.",
                "platform": "windows",
                "audit_category": "CreateRemoteThread",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "CreateRemoteThreadApiCall"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0160",
        "name": "Device blocked connection from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "device",
            "relationship": "blocked connection from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5157",
                "name": "The Windows Filtering Platform has blocked a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FirewallInboundConnectionBlocked"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0138",
        "name": "User connected from Device",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected from",
            "target": "device"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "InboundConnectionAccepted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0151",
        "name": "Process executed Dns query",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": null,
        "behavior": {
            "source": "process",
            "relationship": "executed",
            "target": "dns query"
        },
        "security_events": [
            {
                "event_id": "22",
                "name": "DNSEvent (DNS query).",
                "platform": "windows",
                "audit_category": "DNSQuery",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "DnsQueryResponse"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-22-dnsevent-dns-query"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Network Traffic / network traffic content"
        ]
    },
    {
        "relationship_id": "REL-2022-0070",
        "name": "Process requested access to Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key access"
        },
        "behavior": {
            "source": "process",
            "relationship": "requested access to",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Key"
                    }
                ],
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0152",
        "name": "User modified Firewall",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall metadata"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "firewall"
        },
        "security_events": [
            {
                "event_id": "2002",
                "name": "A Windows Defender Firewall setting has changed.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "2003",
                "name": "A Windows Defender Firewall setting in the Private profile has changed.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Firewall / firewall modification (New data component and relationship)"
        ]
    },
    {
        "relationship_id": "REL-2022-0153",
        "name": "Process created Thread",
        "contributors": [
            "Reid Gilman @reidgilman",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "created",
            "target": "thread"
        },
        "security_events": [
            {
                "event_id": "8",
                "name": "CreateRemoteThread.",
                "platform": "windows",
                "audit_category": "CreateRemoteThread",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "CreateRemoteThreadApiCall"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0155",
        "name": "Process modified File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file modification"
        },
        "behavior": {
            "source": "process",
            "relationship": "modified",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": "2",
                "name": "A process changed a file creation time.",
                "platform": "windows",
                "audit_category": "FileCreateTime",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "11",
                "name": "FileCreate.",
                "platform": "windows",
                "audit_category": "FileCreate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4670",
                "name": "Permissions on an object were changed.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileRenamed"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-2-a-process-changed-a-file-creation-time",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-11-filecreate",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0105",
        "name": "User created Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "12",
                "name": "RegistryEvent (Object create and delete).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "filter_in": [
                    {
                        "EventType": "CreateKey"
                    }
                ],
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryValueSet"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryKeyCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "4657",
                "name": "A registry value was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "OperationType": "New registry value created"
                    }
                ],
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete"
        ],
        "notes": [
            "Event ID 4657 is logged for Creation, Modification and Deletion of registry key values. Use \"Operation Type=New registry value created\" to look for creations."
        ]
    },
    {
        "relationship_id": "REL-2022-0156",
        "name": "User retrieved information about cloud service from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "cloud service",
            "data_component": "cloud service metadata"
        },
        "behavior": {
            "source": "user",
            "relationship": "retrieved information about cloud service from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetTrail"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetTrailStatus"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeTrails"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetEventSelectors"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetInsightSelectors"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Cloud Service / cloud service metadata"
        ]
    },
    {
        "relationship_id": "REL-2022-0023",
        "name": "Device permitted local bind on Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": null,
        "behavior": {
            "source": "device",
            "relationship": "permitted port bind on",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "5158",
                "name": "The Windows Filtering Platform has permitted a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158"
        ],
        "notes": [
            "Potential contribution for ATT&CK - Network Traffic / network connection creation"
        ]
    },
    {
        "relationship_id": "REL-2022-0158",
        "name": "User created instance from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "instance",
            "data_component": "instance creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created instance from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudTrail",
                "filter_in": [
                    {
                        "eventName": "RunInstances"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0013",
        "name": "User requested access to Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key access"
        },
        "behavior": {
            "source": "user",
            "relationship": "requested access to",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "4656",
                "name": "A handle to an object was requested.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "ObjectType": "Key"
                    }
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656"
        ],
        "note": null
    },
    {
        "relationship_id": "REL-2022-0161",
        "name": "User connected from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "InboundConnectionAccepted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0162",
        "name": "User modified AD Object",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "active directory",
            "data_component": "active directory object modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "ad object"
        },
        "security_events": [
            {
                "event_id": "5136",
                "name": "A directory service object was modified.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Changes",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "5139",
                "name": "A directory service object was moved.",
                "platform": "windows",
                "audit_category": "DS Access",
                "audit_sub_category": "Directory Service Changes",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4719",
                "name": "System audit policy was changed.",
                "platform": "windows",
                "audit_category": "Policy Change",
                "audit_sub_category": "Policy Change",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5139",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0163",
        "name": "User authenticated from Device",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account authentication"
        },
        "behavior": {
            "source": "user",
            "relationship": "authenticated from",
            "target": "device"
        },
        "security_events": [
            {
                "event_id": "4776",
                "name": "The domain controller or local computer attempted to validate the credentials for an account.",
                "platform": "windows",
                "audit_category": "Account Logon",
                "audit_sub_category": "Credential Validation",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0165",
        "name": "User enumerated Group",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "group",
            "data_component": "group enumeration"
        },
        "behavior": {
            "source": "user",
            "relationship": "enumerated",
            "target": "group"
        },
        "security_events": [
            {
                "event_id": "4798",
                "name": "A user's local group membership was enumerated.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4799",
                "name": "A security-enabled local group membership was enumerated.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0145",
        "name": "User modified Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "13",
                "name": "RegistryEvent (Value Set).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "14",
                "name": "RegistryEvent (Key and Value Rename).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4657",
                "name": "A registry value was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "OperationType": "Existing registry value modified"
                    }
                ],
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4670",
                "name": "Permissions on an object were changed.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryValueSet"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryKeySet"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-13-registryevent-value-set",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-14-registryevent-key-and-value-rename"
        ],
        "notes": [
            "Event ID 4657 is logged for Creation, Modification and Deletion of registry key values. Use \"Operation Type=Existing registry value modified\" to look for modifications."
        ]
    },
    {
        "relationship_id": "REL-2022-0166",
        "name": "Process connected from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "connected from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "5156",
                "name": "The Windows Filtering Platform has permitted a connection.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "InboundConnectionAccepted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0167",
        "name": "User disabled Scheduled job",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "scheduled job",
            "data_component": "scheduled job modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "disabled",
            "target": "scheduled job"
        },
        "security_events": [
            {
                "event_id": "4701",
                "name": "A scheduled task was disabled.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Other Object Access Events",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ScheduledTaskModified"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4701"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0168",
        "name": "User added Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "added",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "2004",
                "name": "A rule has been added to the Windows Defender Firewall exception list",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "CreateRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0104",
        "name": "User connected to Device",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "connected to",
            "target": "device"
        },
        "security_events": [
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "windows",
                "audit_category": "NetworkConnect",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "3",
                "name": "Network connection.",
                "platform": "linux",
                "audit_category": "NetworkConnect",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceNetworkEvents",
                "name": "DeviceNetworkEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ConnectionSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0169",
        "name": "User created Network Share",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network share",
            "data_component": "network share creation"
        },
        "behavior": {
            "source": "user",
            "relationship": "created",
            "target": "network share"
        },
        "security_events": [
            {
                "event_id": "5142",
                "name": "A network share object was added.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0071",
        "name": "Process modified Registry",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "windows registry",
            "data_component": "windows registry key modification"
        },
        "behavior": {
            "source": "process",
            "relationship": "modified",
            "target": "registry"
        },
        "security_events": [
            {
                "event_id": "13",
                "name": "RegistryEvent (Value Set).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "filter_in": [
                    {
                        "EventType": "SetValue"
                    }
                ],
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "14",
                "name": "RegistryEvent (Key and Value Rename).",
                "platform": "windows",
                "audit_category": "RegistryEvent",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "4657",
                "name": "A registry value was modified.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "filter_in": [
                    {
                        "OperationType": "Existing registry value modified"
                    }
                ],
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4670",
                "name": "Permissions on an object were changed.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Registry",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryValueSet"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "DeviceRegistryEvents",
                "name": "DeviceRegistryEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "RegistryKeyCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-13-registryevent-value-set",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-14-registryevent-key-and-value-rename",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670"
        ],
        "notes": [
            "Event ID 4657 is logged for Creation, Modification and Deletion of registry key values. Use \"Operation Type=Existing registry value modified\" to look for modifications."
        ]
    },
    {
        "relationship_id": "REL-2022-0170",
        "name": "User attempted to authenticate from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Reid Gilman @reidgilman",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account authentication"
        },
        "behavior": {
            "source": "user",
            "relationship": "attempted to authenticate from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "4624",
                "name": "An account was successfully logged on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "4625",
                "name": "An account failed to log on.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Account Lockout",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4648",
                "name": "A logon was attempted using explicit credentials.",
                "platform": "windows",
                "audit_category": "Logon/Logoff",
                "audit_sub_category": "Logon",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceLogonEvents",
                "name": "DeviceLogonEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "LogonSuccess"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ConsoleLogin"
                    },
                    {
                        "eventType": "AwsConsoleSignin"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625",
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648",
            "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0171",
        "name": "User modified instance from Ip",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": null,
        "behavior": {
            "source": "user",
            "relationship": "modified instance from",
            "target": "ip"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "ModifyInstanceAttribute"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": [
            "Potential contribution for ATT&CK - Instance / instance modification"
        ]
    },
    {
        "relationship_id": "REL-2022-0174",
        "name": "User deleted Network share",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network share",
            "data_component": "network share deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "network share"
        },
        "security_events": [
            {
                "event_id": "5144",
                "name": "A network share object was deleted.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File Share",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5144"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0175",
        "name": "Process created Process",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "process",
            "data_component": "process creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "created",
            "target": "process"
        },
        "security_events": [
            {
                "event_id": "4688",
                "name": "A new process has been created.",
                "platform": "windows",
                "audit_category": "Detailed Tracking",
                "audit_sub_category": "Process Creation",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "2"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "windows",
                "audit_category": "ProcessCreate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "1",
                "name": "Process Creation.",
                "platform": "linux",
                "audit_category": "ProcessCreate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceProcessEvents",
                "name": "DeviceProcessEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ProcessCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0176",
        "name": "User deleted User",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "user account",
            "data_component": "user account deletion"
        },
        "behavior": {
            "source": "user",
            "relationship": "deleted",
            "target": "user"
        },
        "security_events": [
            {
                "event_id": "4726",
                "name": "A user account was deleted.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "User Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4743",
                "name": "A computer account was deleted.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Computer Account Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "DeviceEvents",
                "name": "DeviceEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "UserAccountDeleted"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0178",
        "name": "Process loaded Module",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong"
        ],
        "attack": {
            "data_source": "module",
            "data_component": "module load"
        },
        "behavior": {
            "source": "process",
            "relationship": "loaded",
            "target": "module"
        },
        "security_events": [
            {
                "event_id": "7",
                "name": "Image loaded.",
                "platform": "windows",
                "audit_category": "ImageLoad",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "DeviceImageLoadEvents",
                "name": "DeviceImageLoadEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "ImageLoaded"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-7-image-loaded"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0179",
        "name": "User modified Firewall rule",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall rule modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "firewall rule"
        },
        "security_events": [
            {
                "event_id": "2005",
                "name": "A rule has been modified in the Windows Defender Firewall exception list.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "UpdateRuleGroup"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0180",
        "name": "Process modified Firewall",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "firewall",
            "data_component": "firewall metadata"
        },
        "behavior": {
            "source": "process",
            "relationship": "modified",
            "target": "firewall"
        },
        "security_events": [
            {
                "event_id": "2002",
                "name": "A Windows Defender Firewall setting has changed.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "2003",
                "name": "A Windows Defender Firewall setting in the Private profile has changed.",
                "platform": "windows",
                "channel": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
                "log_source": "Microsoft-Windows-Windows Firewall With Advanced Security",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0181",
        "name": "Process created File",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g",
            "Olaf Hartong @olafhartong",
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "file",
            "data_component": "file creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "created",
            "target": "file"
        },
        "security_events": [
            {
                "event_id": 11,
                "name": "FileCreate",
                "platform": "windows",
                "audit_category": "FileCreate",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": 11,
                "name": "FileCreate",
                "platform": "linux",
                "audit_category": "FileCreate",
                "log_source": "sysmon",
                "event_version": [
                    "4.81"
                ]
            },
            {
                "event_id": "DeviceFileEvents",
                "name": "DeviceFileEvents",
                "platform": "windows",
                "log_source": "Microsoft Defender for Endpoint",
                "filter_in": [
                    {
                        "ActionType": "FileCreated"
                    }
                ],
                "event_version": [
                    "0",
                    "1"
                ]
            },
            {
                "event_id": "4663",
                "name": "An attempt was made to access an object.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "File System",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "1"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-11-filecreate"
        ],
        "notes": [
            "Event ID 4663 logs attempts of accesses to objects. Look for file creations by searching for \"Accesses=WriteData\"."
        ]
    },
    {
        "relationship_id": "REL-2022-0182",
        "name": "User retrieved information about Cloud service",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH"
        ],
        "attack": {
            "data_source": "cloud service",
            "data_component": "cloud service metadata"
        },
        "behavior": {
            "source": "user",
            "relationship": "retrieved information about",
            "target": "cloud service"
        },
        "security_events": [
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetTrail"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetTrailStatus"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "DescribeTrails"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetEventSelectors"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            },
            {
                "event_id": "cloudtrail",
                "name": "cloudtrail",
                "platform": "aws",
                "log_source": "cloudtrail",
                "filter_in": [
                    {
                        "eventName": "GetInsightSelectors"
                    },
                    {
                        "eventType": "AwsApiCall"
                    }
                ],
                "event_version": [
                    "1.05"
                ]
            }
        ],
        "references": null,
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0183",
        "name": "Process attempted to bind on Port",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "network traffic",
            "data_component": "network connection creation"
        },
        "behavior": {
            "source": "process",
            "relationship": "attempted to bind on",
            "target": "port"
        },
        "security_events": [
            {
                "event_id": "5159",
                "name": "The Windows Filtering Platform has blocked a bind to a local port.",
                "platform": "windows",
                "audit_category": "Object Access",
                "audit_sub_category": "Filtering Platform Connection",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0184",
        "name": "Service started",
        "contributors": [
            "Jose Rodriguez @Cyb3rPandaH",
            "Roberto Rodriguez @Cyb3rWard0g"
        ],
        "attack": {
            "data_source": "service",
            "data_component": "service metadata"
        },
        "behavior": {
            "source": "service",
            "relationship": "started",
            "target": null
        },
        "security_events": [
            {
                "event_id": "4",
                "name": "Sysmon service state changed.",
                "platform": "windows",
                "audit_category": "ServiceStateChange",
                "channel": "Microsoft-Windows-Sysmon/Operational",
                "log_source": "Microsoft-Windows-Sysmon",
                "event_version": [
                    "4.32"
                ]
            },
            {
                "event_id": "6005",
                "name": "The Event log service was started.",
                "platform": "windows",
                "channel": "System",
                "log_source": "EventLog"
            }
        ],
        "references": [
            "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-4-sysmon-service-state-changed"
        ],
        "notes": null
    },
    {
        "relationship_id": "REL-2022-0185",
        "name": "User modified Group",
        "contributors": [
            "Ruben Bouman @rubinatorz"
        ],
        "attack": {
            "data_source": "group",
            "data_component": "group modification"
        },
        "behavior": {
            "source": "user",
            "relationship": "modified",
            "target": "group"
        },
        "security_events": [
            {
                "event_id": "4728",
                "name": "A member was added to a security-enabled global group.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4729",
                "name": "A member was removed from a security-enabled global group.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4732",
                "name": "A member was added to a security-enabled local group.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4733",
                "name": "A member was removed from a security-enabled local group.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4735",
                "name": "A security-enabled local group was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4737",
                "name": "A security-enabled global group was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4755",
                "name": "A security-enabled universal group was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4756",
                "name": "A member was added to a security-enabled universal group.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4757",
                "name": "A member was removed from a security-enabled universal group.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            },
            {
                "event_id": "4764",
                "name": "A groups type was changed.",
                "platform": "windows",
                "audit_category": "Account Management",
                "audit_sub_category": "Security Group Management",
                "channel": "Security",
                "log_source": "Microsoft-Windows-Security-Auditing",
                "event_version": [
                    "0"
                ]
            }
        ],
        "references": [
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735",
            "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4764"
        ],
        "notes": null
    }
]