{
 "T0831": {
  "nguon": [
   "historian",
   "ics_protocol"
  ],
  "ve_khai": "substitutable",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t0831"
  ]
 },
 "T0836": {
  "nguon": [
   "historian"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T0843": {
  "nguon": [
   "ot"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T1003.001": {
  "nguon": [
   "edr",
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_access_lsass_dump",
   "proc_access_win_lsass_mimikatz",
   "sysmon_lsass_memory_dump",
   "t1003.001"
  ]
 },
 "T1003.003": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1003.003"
  ]
 },
 "T1003.006": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "win_dcsync_replication",
   "win_security_dcsync"
  ]
 },
 "T1018": {
  "nguon": [
   "process",
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "remote_system_discovery",
   "t1018"
  ]
 },
 "T1021.001": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "internal_rdp_lateral",
   "t1021.001"
  ]
 },
 "T1021.002": {
  "nguon": [
   "auth",
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "psexec_service_creation",
   "t1021.002",
   "win_smb_psexec_lateral"
  ]
 },
 "T1027": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_powershell_obfuscation"
  ]
 },
 "T1041": {
  "nguon": [
   "network"
  ],
  "ve_khai": "essential",
  "trang_thai": "not tested",
  "sigma": [
   "net_exfil_over_c2",
   "net_exfil_over_c2_large_upload"
  ]
 },
 "T1046": {
  "nguon": [
   "auth",
   "network"
  ],
  "ve_khai": "substitutable",
  "trang_thai": "not tested",
  "sigma": [
   "lin_ssh_invalid_protocol",
   "net_internal_port_scan"
  ]
 },
 "T1047": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_wmic_process_creation"
  ]
 },
 "T1048.003": {
  "nguon": [
   "dns"
  ],
  "ve_khai": "essential",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "dns_exfiltration_high_volume"
  ]
 },
 "T1053.005": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_schtasks_creation",
   "schtasks_creation_persistence"
  ]
 },
 "T1055.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "sysmon_createremotethread_loadlibrary"
  ]
 },
 "T1056.001": {
  "nguon": [
   "edr"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "keylogger_hook_behavior"
  ]
 },
 "T1059.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_iis_susp_child_powershell",
   "proc_creation_win_office_spawn_powershell",
   "proc_creation_win_powershell_encoded",
   "t1059.001"
  ]
 },
 "T1059.004": {
  "nguon": [
   "edr"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_lnx_shell_susp_rev_shells"
  ]
 },
 "T1059.005": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_office_susp_macro"
  ]
 },
 "T1068": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "win_byovd_vulnerable_driver_load"
  ]
 },
 "T1069.002": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "domain_group_recon"
  ]
 },
 "T1070.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_wevtutil_clear_logs",
   "t1070.001"
  ]
 },
 "T1071.001": {
  "nguon": [
   "network"
  ],
  "ve_khai": "essential",
  "trang_thai": "not tested",
  "sigma": [
   "net_beacon_ja3",
   "net_cobaltstrike_beacon_ja3",
   "net_meterpreter_ja3",
   "net_webshell_http_command",
   "t1071.001"
  ]
 },
 "T1071.004": {
  "nguon": [
   "dns"
  ],
  "ve_khai": "essential",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "dns_tunneling_high_entropy"
  ]
 },
 "T1074.001": {
  "nguon": [
   "[0 KHAI]",
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_staging_mass_copy"
  ]
 },
 "T1078": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "t1078",
   "win_auth_anomalous_valid_account",
   "win_security_susp_logon_after_spray"
  ]
 },
 "T1078.004": {
  "nguon": [
   "azuread",
   "cloud_audit",
   "cloudtrail"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "cloud_anomalous_console_login",
   "t1078.004"
  ]
 },
 "T1087.002": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "ldap_recon_sharphound"
  ]
 },
 "T1090": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1090"
  ]
 },
 "T1098": {
  "nguon": [
   "cloudtrail"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T1098.001": {
  "nguon": [
   "azuread",
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1098.001"
  ]
 },
 "T1098.005": {
  "nguon": [
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1098.005"
  ]
 },
 "T1105": {
  "nguon": [
   "network"
  ],
  "ve_khai": "essential",
  "trang_thai": "checked and observed",
  "sigma": [
   "net_tool_transfer_ingress",
   "proc_creation_lnx_susp_curl_download"
  ]
 },
 "T1110.001": {
  "nguon": [
   "active-response",
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "lin_auth_ssh_bruteforce",
   "win_auth_rdp_bruteforce"
  ]
 },
 "T1110.003": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "t1110.003",
   "win_security_password_spray"
  ]
 },
 "T1114.002": {
  "nguon": [
   "cloud_audit",
   "m365"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1114.002"
  ]
 },
 "T1133": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "t1133"
  ]
 },
 "T1134.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_potato_seimpersonate"
  ]
 },
 "T1190": {
  "nguon": [
   "network"
  ],
  "ve_khai": "essential",
  "trang_thai": "checked and observed",
  "sigma": [
   "t1190",
   "web_exchange_proxylogon",
   "web_exploit_public_app",
   "web_log4j_jndi_exploit"
  ]
 },
 "T1204.002": {
  "nguon": [
   "[0 KHAI]",
   "mail"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_event_win_office_maldoc_open"
  ]
 },
 "T1207": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "win_rogue_dc_dcshadow"
  ]
 },
 "T1213": {
  "nguon": [
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "cloud_info_repo_bulk_download"
  ]
 },
 "T1219": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_remote_access_tool"
  ]
 },
 "T1482": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "domain_trust_discovery"
  ]
 },
 "T1484.001": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "win_gpo_modification"
  ]
 },
 "T1485": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_mass_overwrite_delete",
   "t1485"
  ]
 },
 "T1486": {
  "nguon": [
   "edr"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_mass_encryption",
   "t1486"
  ]
 },
 "T1489": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "service_stop_backup",
   "service_stop_critical",
   "t1489"
  ]
 },
 "T1490": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1490"
  ]
 },
 "T1491.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_mod_webroot_index"
  ]
 },
 "T1496": {
  "nguon": [
   "network"
  ],
  "ve_khai": "essential",
  "trang_thai": "checked and observed",
  "sigma": [
   "net_stratum_mining_pool"
  ]
 },
 "T1505.003": {
  "nguon": [
   "edr",
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_event_win_exchange_webshell_drop",
   "web_shell_drop_iis",
   "webshell_drop_child_shell"
  ]
 },
 "T1528": {
  "nguon": [
   "azuread",
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1528"
  ]
 },
 "T1529": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "t1529"
  ]
 },
 "T1530": {
  "nguon": [
   "cloud_audit",
   "cloudtrail"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "cloud_storage_mass_object_access"
  ]
 },
 "T1539": {
  "nguon": [
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "cloud_stolen_session_cookie",
   "t1539"
  ]
 },
 "T1543.003": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "win_new_service_creation"
  ]
 },
 "T1546.003": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "sysmon_wmi_event_subscription"
  ]
 },
 "T1547.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "reg_persistence_run_key",
   "registry_run_key_persistence"
  ]
 },
 "T1548.002": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_uac_bypass_fodhelper",
   "registry_uac_bypass_fodhelper"
  ]
 },
 "T1550.002": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "pass_the_hash_ntlm"
  ]
 },
 "T1550.003": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "pass_the_ticket_kerberos"
  ]
 },
 "T1552.004": {
  "nguon": [
   "process"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "t1552.004"
  ]
 },
 "T1558.001": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": []
 },
 "T1558.003": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "win_kerberoasting_tgs",
   "win_security_kerberoasting_4769"
  ]
 },
 "T1558.004": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "win_security_asreproast_4768"
  ]
 },
 "T1560.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_7z_rar_password_archive"
  ]
 },
 "T1561.002": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "raw_disk_write_mbr",
   "t1561.002"
  ]
 },
 "T1562.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "proc_creation_win_powershell_set_mppreference",
   "t1562.001",
   "win_security_tool_tampering"
  ]
 },
 "T1564.008": {
  "nguon": [
   "m365"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T1565.001": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "db_stored_data_tamper"
  ]
 },
 "T1566.001": {
  "nguon": [
   "mail"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "mail_phishing_link",
   "t1566.001"
  ]
 },
 "T1566.002": {
  "nguon": [
   "m365",
   "proxy"
  ],
  "ve_khai": "substitutable",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "phish_credential_harvest_url"
  ]
 },
 "T1567.002": {
  "nguon": [
   "cloudtrail",
   "network"
  ],
  "ve_khai": "substitutable",
  "trang_thai": "not tested",
  "sigma": [
   "net_exfil_cloud_rclone",
   "net_exfil_cloud_storage",
   "t1567.002"
  ]
 },
 "T1570": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "lateral_tool_transfer_smb"
  ]
 },
 "T1573.002": {
  "nguon": [
   "network"
  ],
  "ve_khai": "essential",
  "trang_thai": "not tested",
  "sigma": [
   "net_malleable_c2_profile"
  ]
 },
 "T1574.009": {
  "nguon": [
   "sysmon"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "file_event_win_unquoted_service_path",
   "proc_creation_win_wmic_service_discovery"
  ]
 },
 "T1606.002": {
  "nguon": [
   "auth"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not tested",
  "sigma": [
   "t1606.002"
  ]
 },
 "T1610": {
  "nguon": [
   "kubernetes"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T1611": {
  "nguon": [
   "falco"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T1613": {
  "nguon": [
   "kubernetes"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": []
 },
 "T1621": {
  "nguon": [
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "cloud_mfa_push_fatigue",
   "t1621"
  ]
 },
 "T1648": {
  "nguon": [
   "cloud_audit"
  ],
  "ve_khai": "complementary",
  "trang_thai": "not observable with this sensor set",
  "sigma": [
   "cloud_serverless_malicious_function"
  ]
 }
}