kevmap

TechniquesT1583.002 › AN1994

AN1994 Analytic 1994

PRE · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.</p>
Detects
T1583.002 DNS Server
Part of
DET0862 Detection of DNS Server

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component