Skip to content

Latest commit

 

History

History
33 lines (14 loc) · 520 Bytes

Service-Modification.md

File metadata and controls

33 lines (14 loc) · 520 Bytes

Service Modification Use Cases

Grouped by Detection Method

MITRE ATT&CK Framework: Modify Existing Service (T1031)

  • Service modification can be used by an adversary to achieve persistence.

Aggregate Count

Blacklist Alert

Whitelist Alert

Levenshtein Score Alert

Rolling Whitelist Alert

  • Newly observed Source User

Shannon Entropy Score Alert

Threshold Alert

Log Source Examples

Possible False Positives