H3XA — Operational Evidence

Evidence stream

Filtered — X Mitre Data Component

109 objects

01Snapshot EnumerationThe process of listing or retrieving metadata about existing snapshots in a cloud environment. *Data Collection Measures:* - AWS CloudTrail - Logs API calls such as `DescribeSnapshots`, `ListSnapshots`, and `GetSnapshotAttributes`. - Azure …x-mitre-data-componentDC004702Domain Registration"Domain Name: Domain Registration" data component captures information about the assignment, ownership, and metadata of domain names. This information is often sourced from registries like WHOIS and includes details such as registrant names…x-mitre-data-componentDC010103Web Credential UsageAn attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)x-mitre-data-componentDC000704Cloud Storage EnumerationCloud Storage Enumeration involves retrieving a list of available cloud storage infrastructure, such as buckets, containers, or objects, within a cloud environment. This activity may be performed for legitimate administrative purposes or ma…x-mitre-data-componentDC001705Cluster MetadataContextual data about a cluster and activity around it such as name, namespace, age, or statusx-mitre-data-componentDC0120 06Scheduled Job ModificationChanges made to an existing scheduled job, including modifications to its execution parameters, command payload, or execution timing.x-mitre-data-componentDC0012 07Instance StartThe initiation or activation of a virtual machine instance within a cloud infrastructure. This action typically involves starting an existing instance that had been stopped or paused, allowing it to resume operation. Examples: - Google Clou…x-mitre-data-componentDC008008Driver Metadatato contextual data about a driver, including its attributes, functionality, and activity. This can involve details such as the driver's origin, integrity, cryptographic signature, issues reported during its use, and runtime behavior. Exampl…x-mitre-data-componentDC007409Network Share AccessOpening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)x-mitre-data-componentDC010210Scheduled Job CreationThe establishment of a task or job that will execute at a predefined time or based on specific triggers.x-mitre-data-componentDC0001 11Snapshot ModificationChanges made to a cloud snapshot's metadata, attributes, or control settings. These modifications may involve adjusting access permissions, changing retention policies, or altering encryption settings. *Data Collection Measures:* - AWS Clou…x-mitre-data-componentDC005812Process MetadataContextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.x-mitre-data-componentDC0034 13Windows Registry Key AccessThe action of opening a specific Windows Registry key, typically to read its associated value. This activity can be used for system configuration, application settings retrieval, and security policies.x-mitre-data-componentDC0050 14Volume EnumerationAn extracted list of available volumes within a cloud environment (ex: AWS describe-volumes)x-mitre-data-componentDC009515Cloud Service DisableThis data component refers to monitoring actions that deactivate or stop a cloud service in a cloud control plane. Examples include disabling essential logging services like AWS CloudTrail (`StopLogging` API call), Microsoft Azure Monitor L…x-mitre-data-componentDC009016File DeletionRefers to events where files are removed from a system or storage device. These events can indicate legitimate housekeeping activities or malicious actions such as attackers attempting to cover their tracks. Monitoring file deletions helps …x-mitre-data-componentDC004017Cloud Service ModificationCloud service modification refers to changes made to the configuration, settings, or data of a cloud service. These modifications can include administrative changes such as enabling or disabling features, altering permissions, or deleting c…x-mitre-data-componentDC006918Cloud Storage MetadataCloud Storage Metadata provides contextual information about cloud storage infrastructure and its associated activity. This data may include attributes such as storage name, size, owner, permissions, creation date, region, and activity meta…x-mitre-data-componentDC002719Container MetadataContextual data about a container and activity around it such as name, ID, image, or statusx-mitre-data-componentDC0122 20User Account CreationThe initial establishment of a new user, service, or machine account within an operating system, cloud environment, or identity management system.x-mitre-data-componentDC0014 21Volume CreationThe initial provisioning of block storage volumes in cloud or on-prem environments, typically used for data storage, backup, or workload scaling.x-mitre-data-componentDC0097 22Windows Registry Key ModificationChanges made to an existing registry key or its values. These modifications can include altering permissions, modifying stored data, or updating configuration settings. *Data Collection Measures:* - Windows Event Logs - Event ID 4657 - Regi…x-mitre-data-componentDC006323User Account DeletionThe removal of a user, service, or machine account from an operating system, cloud identity management system, or directory service.x-mitre-data-componentDC0009 24Process ModificationChanges made to a running process, such as writing data into memory, modifying execution behavior, or injecting code into an existing process. Adversaries frequently modify processes to execute malicious payloads, evade detection, or gain e…x-mitre-data-componentDC002025Volume ModificationChanges made to a cloud volume, including its settings and control data (ex: AWS modify-volume)x-mitre-data-componentDC009226Firewall Rule ModificationThe creation, deletion, or alteration of firewall rules to allow or block specific network traffic. Monitoring changes to these rules is critical for detecting misconfigurations, unauthorized access, or malicious attempts to bypass network …x-mitre-data-componentDC005127User Account ModificationChanges made to an existing user, service, or machine account, including alterations to attributes, permissions, roles, authentication methods, or group memberships.x-mitre-data-componentDC0010 28Passive DNS"Domain Name: Passive DNS" captures logged historical and real-time domain name system (DNS) data. This includes records of domain-to-IP address resolutions over time, enabling analysts to track the evolution of domain infrastructure, uncov…x-mitre-data-componentDC009629Firewall DisableThe deactivation, misconfiguration, or complete stoppage of firewall services, either on a host or in a cloud control plane. Such activity may involve turning off firewalls, modifying rules to disable protection, or deleting firewall-relate…x-mitre-data-componentDC004330Pod MetadataContextual data about a pod and activity around it such as name, ID, namespace, or statusx-mitre-data-componentDC0121 31Module LoadWhen a process or program dynamically attaches a shared library, module, or plugin into its memory space. This action is typically performed to extend the functionality of an application, access shared system resources, or interact with ker…x-mitre-data-componentDC001632Firewall EnumerationQuerying and extracting a list of available firewalls or their associated configurations and rules. This activity can occur across host systems and cloud control planes, providing insight into the state and configuration of firewalls that p…x-mitre-data-componentDC004433Firmware ModificationChanges made to firmware, which may include its settings, configurations, or underlying data. This can encompass alterations to the Master Boot Record (MBR), Volume Boot Record (VBR), or other firmware components critical to system boot and…x-mitre-data-componentDC000434Named Pipe MetadataContextual data about a named pipe on a system, including pipe name and creating process (ex: Sysmon EIDs 17-18) *Data Collection Measures:* - Windows: - Sysmon Event ID 17: Logs the creation of a named pipe. - Sysmon Event ID 18: Logs conn…x-mitre-data-componentDC004835User Account MetadataContextual data about an account, which may include a username, user ID, environmental data, etc.x-mitre-data-componentDC0013 36Instance CreationThe initial provisioning and construction of a virtual machine (VM) or compute instance within a cloud infrastructure environment. This activity involves defining and allocating resources such as CPU, memory, storage, and networking to spin…x-mitre-data-componentDC007637Image Metadatacontextual information associated with a virtual machine image, such as its name, resource group, status (active or inactive), type (custom or prebuilt), size, creation date, and permissions. This metadata is critical for understanding the …x-mitre-data-componentDC002838Cloud Service MetadataCloud service metadata refers to the contextual and descriptive information about cloud services, including their name, type, purpose, configuration, and activity around them. This metadata is essential for understanding the roles and funct…x-mitre-data-componentDC007039Image CreationInitial construction of a virtual machine image within a cloud environment. Virtual machine images are templates containing an operating system and installed applications, which can be deployed to create new virtual machines. Monitoring the…x-mitre-data-componentDC001540User Account AuthenticationAn attempt (successful and failed login attempts) by a user, service, or application to gain access to a network, system, or cloud-based resource. This typically involves credentials such as passwords, tokens, multi-factor authentication (M…x-mitre-data-componentDC000241Network Traffic FlowSummarized network packet data that captures session-level details such as source/destination IPs, ports, protocol types, timestamps, and data volume, without storing full packet payloads. This is commonly used for traffic analysis, anomaly…x-mitre-data-componentDC007842Container Creation"Container Creation" data component captures details about the initial construction of a container in a containerized environment. This includes events where a new container is instantiated, such as through Docker, Kubernetes, or other cont…x-mitre-data-componentDC007243Script ExecutionThe execution of a text file that contains code via the interpreter.x-mitre-data-componentDC0029 44Logon Session CreationThe successful establishment of a new user session following a successful authentication attempt. This typically signifies that a user has provided valid credentials or authentication tokens, and the system has initiated a session associate…x-mitre-data-componentDC006745Application Log ContentApplication Log Content refers to logs generated by applications or services, providing a record of their activity. These logs may include metrics, errors, performance data, and operational alerts from web, mail, or other applications. Thes…x-mitre-data-componentDC003846OS API ExecutionCalls made by a process to operating system-provided Application Programming Interfaces (APIs). These calls are essential for interacting with system resources such as memory, files, and hardware, or for performing system-level tasks. Monit…x-mitre-data-componentDC002147Malware MetadataContextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration informationx-mitre-data-componentDC0003 48Container Enumeration"Container Enumeration" data component captures events and actions related to listing and identifying active or available containers within a containerized environment. This includes information about running, stopped, or configured contain…x-mitre-data-componentDC009149Active Directory Object DeletionObject deletion in AD (e.g., user accounts, groups, OUs) is logged as Event ID 5141. Examples: - User Account: Deleted user. - Group: Deleted security/distribution group. - Organizational Unit (OU): Loss of configurations or policies. - Ser…x-mitre-data-componentDC006850Social MediaEstablished, compromised, or otherwise acquired by adversaries to conduct reconnaissance, influence operations, social engineering, or other cyber threats. *Data Collection Measures:* - API Monitoring - Social media APIs (e.g., Twitter API,…x-mitre-data-componentDC005251Group EnumerationExtracting group lists from identity systems identifies permissions, roles, or configurations. Adversaries may exploit high-privilege groups or misconfigurations. Examples: - AWS CLI: `aws iam list-groups` - PowerShell: `Get-ADGroup -Filter…x-mitre-data-componentDC009952Group MetadataGroup metadata includes attributes like name, permissions, purpose, and associated user accounts or roles, which adversaries may exploit for privilege escalation. Examples: - Active Directory: `Get-ADGroup -Identity "Domain Admins" -Propert…x-mitre-data-componentDC010553Cloud Service EnumerationCloud service enumeration involves listing or querying available cloud services in a cloud control plane. This activity is often performed to identify resources such as virtual machines, storage buckets, compute clusters, or other services …x-mitre-data-componentDC008354Snapshot MetadataContextual data about a snapshot, which may include information such as ID, type, and statusx-mitre-data-componentDC0062 55Image DeletionRemoval of a virtual machine image in a cloud infrastructure (ex: Azure Compute Service Images DELETE) Examples: - Azure Compute Service Image Deletion - Example: Deleting a virtual machine image using Azure CLI: `az image delete --name MyI…x-mitre-data-componentDC002656Host StatusLogging, messaging, and other artifacts that highlight the health and operational state of host-based security sensors, such as Endpoint Detection and Response (EDR) agents, antivirus software, logging services, and system monitoring tools.…x-mitre-data-componentDC001857File ModificationChanges made to a file, including updates to its contents, metadata, access permissions, or attributes. These modifications may indicate legitimate activity (e.g., software updates) or unauthorized changes (e.g., tampering, ransomware, or a…x-mitre-data-componentDC006158Windows Registry Key CreationInitial construction of a new registry key within the Windows operating system.x-mitre-data-componentDC0056 59Scheduled Job MetadataContextual data about a scheduled job, which may include information such as name, timing, command(s), etc.x-mitre-data-componentDC0005 60Instance DeletionRemoval of a virtual machine (VM) or compute instance within a cloud infrastructure. This activity results in the termination and deletion of the allocated resources (e.g., CPU, memory, storage), making the instance unavailable for future u…x-mitre-data-componentDC008161Service MetadataContextual data about a service/daemon, which may include information such as name, service executable, start type, etc.x-mitre-data-componentDC0041 62Firewall MetadataContextual information about firewalls, including their configurations, policies, status, and other details such as names and associated rules. This metadata provides valuable insights into the operational state and configurations of firewa…x-mitre-data-componentDC005363Drive AccessRefers to the act of accessing a data storage device, such as a hard drive, SSD, USB, or network-mounted drive. This data component logs the opening or mounting of drives, capturing activities such as reading, writing, or executing files wi…x-mitre-data-componentDC005464Command ExecutionCommand Execution involves monitoring and capturing the execution of textual commands (including shell commands, cmdlets, and scripts) within an operating system or application. These commands may include arguments or parameters and are typ…x-mitre-data-componentDC006465Pod ModificationChanges made to a pod’s configuration or control data within a containerized cluster. This can include updating settings such as resource limits, environment variables, annotations, labels, or even the containers running within the pod. Pod…x-mitre-data-componentDC003066Service ModificationChanges made to an existing service or daemon, such as modifying the service name, start type, execution parameters, or security configurations.x-mitre-data-componentDC0065 67File Metadatacontextual information about a file, including attributes such as the file's name, size, type, content (e.g., signatures, headers, media), user/owner, permissions, timestamps, and other related properties. File metadata provides insights in…x-mitre-data-componentDC005968Process TerminationThe exit or termination of a running process on a system. This can occur due to normal operations, user-initiated commands, or malicious actions such as process termination by malware to disable security controls.x-mitre-data-componentDC0033 69Container Start"Container Start" data component captures events related to the activation or invocation of a container within a containerized environment. This includes starting a previously stopped container, restarting an existing container, or initiali…x-mitre-data-componentDC007770Web Credential CreationInitial construction of new web credential material (ex: Windows EID 1200 or 4769)x-mitre-data-componentDC000671Active Directory Object AccessObject access refers to activities where AD objects (e.g., user accounts, groups, policies) are accessed or queried. Example: Windows Event ID 4661 logs object access attempts. Examples: - Attribute Access: e.g., `userPassword`, `memberOf`,…x-mitre-data-componentDC007172Active Directory Object ModificationChanges to AD objects (e.g., users, groups, OUs) are logged as Event ID 5136 (Object Modification) or 5163 (Attribute Changes). Examples: - User Account: Modifying attributes (e.g., group membership, enabling/disabling accounts). - Group Me…x-mitre-data-componentDC006673Cloud Storage CreationCloud Storage Creation refers to the initial creation of a new cloud storage resource, such as buckets, containers, or directories, within a cloud environment. This action is critical to track as it might indicate the legitimate provisionin…x-mitre-data-componentDC002474Cloud Storage AccessCloud storage access refers to the retrieval or interaction with data stored in cloud infrastructure. This data component includes activities such as reading, downloading, or accessing files and objects within cloud storage systems. Common …x-mitre-data-componentDC002575Service CreationThe registration of a new service or daemon on an operating system. *Data Collection Measures:* - Windows Event Logs - Event ID 4697 - Captures the creation of a new Windows service. - Event ID 7045 - Captures services installed by administ…x-mitre-data-componentDC006076Pod CreationThe initial deployment or instantiation of a new pod in a containerized environment. This includes creating a pod manually, through orchestration tools (Kubernetes), or via Infrastructure-as-Code (IaC) configurations. A Pod is the smallest …x-mitre-data-componentDC001977Drive ModificationThe alteration of a drive letter, mount point, or other attributes of a data storage device, which could involve reassignment, renaming, permissions changes, or other modifications. Examples: - Drive Letter Reassignment: A USB drive previou…x-mitre-data-componentDC004678Cloud Storage DeletionCloud Storage Deletion refers to the removal or destruction of cloud storage infrastructure, such as buckets, containers, or directories, within a cloud environment. Monitoring this activity is critical to detecting potential unauthorized o…x-mitre-data-componentDC002279Instance MetadataContextual data about an instance and activity around it such as name, type, or statusx-mitre-data-componentDC0086 80Instance ModificationChanges made to a virtual machine (VM) or compute instance, including alterations to its configuration, metadata, attached policies, or operational state. Such modifications can include updating metadata, attaching or detaching resource pol…x-mitre-data-componentDC007381Cloud Storage ModificationCloud Storage Modification involves tracking changes made to cloud storage infrastructure, including updates to settings, permissions, or stored data. Examples include modifying object access control lists (ACLs), uploading new objects, or …x-mitre-data-componentDC002382Snapshot CreationThe process of taking a point-in-time copy of a cloud storage volume (files, settings, configurations, etc.), virtual machine (VM), or database that can be created and deployed in cloud environments.x-mitre-data-componentDC0057 83Drive CreationThe activity of assigning a new drive letter or creating a mount point for a data storage device, such as a USB, network share, or external hard drive, enabling access to its content on a host system. Examples: - USB Drive Insertion: A USB …x-mitre-data-componentDC004284Process CreationRefers to the event in which a new process (executable) is initialized by an operating system. This can involve parent-child process relationships, process arguments, and environmental variables. Monitoring process creation is crucial for d…x-mitre-data-componentDC003285Volume DeletionThe removal of a cloud-based or on-premise block storage volume. This action permanently deletes the allocated storage and may result in data loss if not backed up. *Data Collection Measures:* - Cloud Logging & APIs - AWS CloudTrail Logs - …x-mitre-data-componentDC009886Logon Session MetadataContextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within itx-mitre-data-componentDC0088 87Network Traffic ContentThe full packet capture (PCAP) or session data that logs both protocol headers and payload content. This allows analysts to inspect command and control (C2) traffic, exfiltration, and other suspicious activity within network communications.…x-mitre-data-componentDC008588Driver LoadThe process of attaching a driver, which is a software component that allows the operating system and applications to interact with hardware devices, to either user-mode or kernel-mode of a system. This can include benign actions (e.g., har…x-mitre-data-componentDC007989Active DNS"Domain Name: Active DNS" data component captures queried DNS registry data that highlights current domain-to-IP address resolutions. This data includes both direct queries to DNS servers and records that provide mappings between domain nam…x-mitre-data-componentDC010390File CreationA new file is created on a system or network storage. This action often signifies an operation such as saving a document, writing data, or deploying a file. Logging these events helps identify legitimate or potentially malicious file creati…x-mitre-data-componentDC003991Instance EnumerationThe process of retrieving or querying a list of virtual machine instances or compute instances within a cloud infrastructure. This activity provides a view of all available or running instances, typically including their associated metadata…x-mitre-data-componentDC007592Kernel Module LoadThe process of loading a kernel module into the operating system kernel. Kernel modules are object files that extend the kernel’s functionality, such as adding support for device drivers, new filesystems, or additional system calls. This ac…x-mitre-data-componentDC003193File AccessTo events where a file is opened or accessed, making its contents available to the requester. This includes reading, executing, or interacting with files by authorized or unauthorized entities. Examples include logging file access events (e…x-mitre-data-componentDC005594Certificate RegistrationCertificate Registration refers to the collection and analysis of information about digital certificates, including current, revoked, and expired certificates. Sources such as Certificate Transparency logs and other public resources provide…x-mitre-data-componentDC009395Active Directory Object CreationCreating new objects in AD, such as user accounts, groups, organizational units (OUs), or trust relationships. Logged as Event ID 5137. Examples: - User Account Creation: New user account. - Group Creation: New security/distribution group. …x-mitre-data-componentDC008796Process AccessRefers to an event where one process attempts to open another process, typically to inspect or manipulate its memory, access handles, or modify execution flow. Monitoring these access attempts can provide valuable insight into both benign a…x-mitre-data-componentDC003597Network Connection CreationThe initial establishment of a network session, where a system or process initiates a connection to a local or remote endpoint. This typically involves capturing socket information (source/destination IP, ports, protocol) and tracking sessi…x-mitre-data-componentDC008298Snapshot DeletionThe removal of a point-in-time backup of a cloud storage volume, virtual machine (VM), or database. *Data Collection Measures:* - AWS CloudTrail - Logs `DeleteSnapshot` API calls in EC2, RDS, and EBS services. - Azure Monitor Logs - Tracks …x-mitre-data-componentDC004999Malware ContentCode, strings, signatures, and other identifying characteristics of a malicious payload stored within a malware repository. It includes both static (file-based) and dynamic (behavioral or execution-based) components that can be analyzed for…x-mitre-data-componentDC0011100Instance StopThe deactivation or shutdown of a virtual machine instance within a cloud infrastructure. This action typically involves stopping a running instance, which halts its operation and releases certain associated resources, such as CPU and memor…x-mitre-data-componentDC0089101Windows Registry Key DeletionThe removal of a registry key within the Windows operating system. *Data Collection Measures:* - Windows Event Logs - Event ID 4658 - Registry Key Handle Closed: Captures when a handle to a registry key is closed, which may indicate deletio…x-mitre-data-componentDC0045102Response MetadataContextual information about an Internet-facing resource collected during a scan, including details such as open ports, running services, protocols, and versions. This metadata is typically derived from interpreting scan results and helps b…x-mitre-data-componentDC0106103Volume MetadataContextual data about a cloud volume and activity around it, such as id, type, state, and sizex-mitre-data-componentDC0100 104Response ContentCaptured network traffic that provides details about responses received during an internet scan. This data includes both protocol header values (e.g., HTTP status codes, IP headers, or DNS response codes) and response body content (e.g., HT…x-mitre-data-componentDC0104105Pod EnumerationExtracting a list of running or existing pods within a containerized cluster environment. Pods are the smallest deployable units in a Kubernetes cluster and typically represent an application or workload. Enumeration of pods provides insigh…x-mitre-data-componentDC0037106Image ModificationChanges made to a virtual machine image, including setting and/or control data (ex: Azure Compute Service Images PATCH)x-mitre-data-componentDC0036107Group ModificationChanges made to a group, such as membership, name, or permissions (ex: Windows EID 4728 or 4732, AWS IAM UpdateGroup). Examples: - Active Directory: - Event ID 4728: Member added to a global group. - Event ID 4732: Member added to a local g…x-mitre-data-componentDC0094108WMI CreationInitial construction of a WMI object, such as a filter, consumer, subscription, binding, or providers.x-mitre-data-componentDC0008 109Active Directory Credential RequestRequests for authentication credentials via Kerberos or other methods like NTLM and LDAP queries. Examples: - Kerberos TGT and Service Tickets (Event IDs 4768, 4769) - NTLM Authentication Events - LDAP Bind Requests.x-mitre-data-componentDC0084