Teramind Demo | Behavior Policies

Rule	Enabled	Type	Assigned	Severity
Copying Multiple Files to External Drive	ON	Activity rule	Overridden	100
Deleting Files from Shared Drive	OFF	Activity rule	Overridden	75
Accessing Payroll Folder	ON	Activity rule	Overridden	50
Renaming Files in Finance Share	OFF	Activity rule	Overridden	100
Creating Executable Files	ON	Activity rule		50
Write to USB Storage	ON	Activity rule		75

Rule	Enabled	Type	Assigned	Severity
Detect OpenClaw Agent Activity	ON	Activity rule	Overridden	50
Detect AI-Native Browser Usage	ON	Activity rule		100
Block File Upload to AI Chat	ON	Content rule		75
Pasting Source Code into AI Tools	ON	Content rule		100
Pasting text that contains PII	ON	Activity rule		75
Accessing Unapproved AI Platforms	ON	Activity rule		75
Detect Agentic Browser Sessions	ON	Activity rule		50
AI Generated Content in Outbound Email	ON	Content rule		75
Uploading Customer Data to AI Tools	ON	Content rule	Overridden	0
Detect Local LLM Applications	OFF	Activity rule	Overridden	100
Browser Extension - AI Assistants	OFF	Activity rule		0
Prompting with Credentials	ON	Activity rule	Overridden	75
Shadow AI - New Domain Detected	OFF	Activity rule		50

Rule	Enabled	Type	Assigned	Severity
Accessing Streaming Sites	ON	Activity rule	Overridden	75
Social Media During Work Hours	OFF	Activity rule		100
Online Shopping Sites	ON	Activity rule		0
Gaming Applications	ON	Activity rule		50

Rule	Enabled	Type	Assigned	Severity
TBG003 Copying Multiple Files to External Drive	ON	Activity rule		0
T1048.001 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	ON	Activity rule		100
T1048.003 Exfiltration Over Alternative Protocol	ON	Activity rule		50
T1052.001 Exfiltration over USB	ON	Activity rule		100
T1567.001 Exfiltration to Code Repository	ON	Activity rule		100
T1567.002 Exfiltration to Cloud Storage	ON	Activity rule	Overridden	75
T1029 Scheduled Transfer	ON	Activity rule		75
T1030 Data Transfer Size Limits	OFF	Activity rule		50

Rule	Enabled	Type	Assigned	Severity
Quantum - IcedID Initial Payload	ON	Activity rule		75
Quantum - Cobalt Strike Beacon	ON	Activity rule	Overridden	50
Quantum - WMI Lateral Execution	ON	Activity rule		0
Quantum - PsExec Deployment	ON	Activity rule		50
Quantum - Shadow Copy Deletion	ON	Activity rule		75
Quantum - Registry Run Key Persistence	ON	Activity rule		50
Quantum - RDP Session to Domain Controller	OFF	Activity rule	Overridden	50
Quantum - Mass File Encryption Pattern	ON	Activity rule		75
Quantum - .quantum Extension Write	ON	Activity rule		50
Quantum - Ransom Note Creation	ON	Activity rule	Overridden	50
Quantum - Defender Tamper Attempt	ON	Activity rule		75
Quantum - Suspicious dllhost Spawn	OFF	Activity rule		50
Quantum - SMB Admin Share Access	ON	Activity rule		100
Quantum - LSASS Memory Access	OFF	Activity rule		100
Quantum - Bitsadmin Download	ON	Activity rule		50
Quantum - Event Log Clearing	ON	Activity rule		100

	Rule	Enabled	Type	Assigned	Actions	Severity
	T1566.001 Phishing: Spearphishing Attachment	OFF	Activity rule	Overridden		100

Rule	Enabled	Type	Assigned	Severity
T1059.001 Command and Scripting Interpreter: PowerShell	ON	Activity rule		50
T1059.003 Windows Command Shell	OFF	Activity rule	Overridden	75
T1059.005 Visual Basic	ON	Activity rule		100
T1059.007 JavaScript	ON	Activity rule		100
T1047 Windows Management Instrumentation	ON	Activity rule		100
T1053.005 Scheduled Task	ON	Activity rule	Overridden	75
T1053.002 Scheduled Task/Job: At (Windows)	ON	Activity rule		100
T1204.002 User Execution: Malicious File	ON	Activity rule	Overridden	50
T1204.001 User Execution: Malicious Link	ON	Activity rule	Overridden	50
T1569.002 System Services: Service Execution	ON	Activity rule		75
T1059.006 Python	OFF	Activity rule		100
T1129 Shared Modules	ON	Activity rule		0
T1106 Native API	ON	Activity rule		50
T1559.001 Component Object Model	OFF	Activity rule		50
T1559.002 Dynamic Data Exchange	ON	Activity rule		100
T1072 Software Deployment Tools	OFF	Activity rule	Overridden	50

Rule	Enabled	Type	Assigned	Severity
Prevent RDP file transfers	ON	Activity rule		50
In Office Attendance	OFF	Activity rule		0
Sensitive Projects Leak	ON	Activity rule	Overridden	100
Block Malicious Application	ON	Activity rule	Overridden	50
Accessing Streaming Sites	ON	Activity rule	Overridden	50
Greater than 10MB Download from GDrive	OFF	Activity rule	Overridden	75
Running TOR browser	ON	Activity rule	Overridden	50
DLP - Credit Card Number	OFF	Content rule		100
Rename Downloaded File	ON	Activity rule	Overridden	75
Login Hours	OFF	Schedule rule		50
File Rule Ex	OFF	Content rule		50
Accessing sensitive folder	OFF	Activity rule		100
Workplace Toxicity	ON	Activity rule	Overridden	75
Downloading unrelated apps	OFF	Activity rule		50
Emailing PHI to External Email	ON	Content rule	Overridden	100
Unusual Access - Marketing Share Drive	ON	Activity rule	Overridden	75

Rule	Enabled	Type	Assigned	Severity
HIPAA - Uploading Customer Records to Cloud	ON	Content rule		100
SOX - Accessing Records Outside Business Hours	ON	Content rule	Overridden	0
FERPA - Copying Patient Records to USB	ON	Content rule	Overridden	0
PCI DSS - Storing Card Numbers in Files	ON	Activity rule		50
GLBA - Unencrypted File Transfer	OFF	Activity rule		75
FINRA - Printing Financial Statements	ON	Activity rule		0
GDPR - Emailing PHI to External Email	ON	Content rule		0
CCPA - Sharing Credentials over IM	ON	Activity rule		100
PCI DSS - Uploading Customer Records to Cloud	ON	Content rule		0
GLBA - Accessing Records Outside Business Hours	ON	Schedule rule	Overridden	50
FINRA - Copying Patient Records to USB	OFF	Content rule	Overridden	75
GDPR - Storing Card Numbers in Files	ON	Content rule	Overridden	50
CCPA - Unencrypted File Transfer	ON	Activity rule		75
HIPAA - Printing Financial Statements	ON	Activity rule		50
SOX - Emailing PHI to External Email	ON	Content rule		75
FERPA - Sharing Credentials over IM	ON	Activity rule	Overridden	50
GDPR - Uploading Customer Records to Cloud	ON	Content rule		100
CCPA - Accessing Records Outside Business Hours	ON	Content rule	Overridden	75
HIPAA - Copying Patient Records to USB	OFF	Activity rule		75
SOX - Storing Card Numbers in Files	ON	Activity rule		0
FERPA - Unencrypted File Transfer	ON	Activity rule	Overridden	0
PCI DSS - Printing Financial Statements	OFF	Activity rule	Overridden	50
GLBA - Emailing PHI to External Email	ON	Activity rule		100
FINRA - Sharing Credentials over IM	OFF	Activity rule		0
SOX - Uploading Customer Records to Cloud	OFF	Activity rule		75
FERPA - Accessing Records Outside Business Hours	ON	Content rule	Overridden	100
PCI DSS - Copying Patient Records to USB	ON	Activity rule	Overridden	100
GLBA - Storing Card Numbers in Files	OFF	Content rule		75
FINRA - Unencrypted File Transfer	ON	Activity rule	Overridden	0
GDPR - Printing Financial Statements	OFF	Activity rule		50
CCPA - Emailing PHI to External Email	ON	Activity rule	Overridden	0
HIPAA - Sharing Credentials over IM	ON	Activity rule	Overridden	75
GLBA - Uploading Customer Records to Cloud	ON	Activity rule		0
FINRA - Accessing Records Outside Business Hours	ON	Content rule		75
GDPR - Copying Patient Records to USB	ON	Content rule		100
CCPA - Storing Card Numbers in Files	ON	Content rule		75
HIPAA - Unencrypted File Transfer	ON	Activity rule		50
SOX - Printing Financial Statements	OFF	Activity rule		75
FERPA - Emailing PHI to External Email	ON	Activity rule		75
PCI DSS - Sharing Credentials over IM	ON	Activity rule	Overridden	100
CCPA - Uploading Customer Records to Cloud	OFF	Content rule		50
HIPAA - Accessing Records Outside Business Hours	ON	Schedule rule		75
SOX - Copying Patient Records to USB	ON	Content rule		100
FERPA - Storing Card Numbers in Files	ON	Activity rule		50
PCI DSS - Unencrypted File Transfer	ON	Activity rule		0
GLBA - Printing Financial Statements	ON	Activity rule		100
FINRA - Emailing PHI to External Email	ON	Content rule	Overridden	50
GDPR - Sharing Credentials over IM	ON	Activity rule		50
FERPA - Uploading Customer Records to Cloud	OFF	Content rule		100
PCI DSS - Accessing Records Outside Business Hours	ON	Content rule		75
GLBA - Copying Patient Records to USB	ON	Content rule	Overridden	50
FINRA - Storing Card Numbers in Files	ON	Content rule	Overridden	100
GDPR - Unencrypted File Transfer	ON	Activity rule		0
CCPA - Printing Financial Statements	OFF	Activity rule		75
HIPAA - Emailing PHI to External Email	OFF	Content rule	Overridden	100
SOX - Sharing Credentials over IM	ON	Activity rule		0
FINRA - Uploading Customer Records to Cloud	ON	Content rule		50
GDPR - Accessing Records Outside Business Hours	ON	Schedule rule		0
CCPA - Copying Patient Records to USB	ON	Content rule		50
HIPAA - Storing Card Numbers in Files	OFF	Content rule		75
SOX - Unencrypted File Transfer	ON	Activity rule		50
FERPA - Printing Financial Statements	ON	Activity rule		50

Rule	Enabled	Type	Assigned	Severity
T1547.001 Registry Run Keys / Startup Folder	ON	Activity rule		75
T1543.003 Create or Modify System Process: Windows Service	ON	Activity rule		50
T1053.005 Scheduled Task	ON	Activity rule		0
T1136.001 Create Account: Local Account	ON	Activity rule	Overridden	100
T1136.002 Create Account: Domain Account	ON	Activity rule		100
T1098 Account Manipulation	ON	Activity rule	Overridden	75
T1547.004 Winlogon Helper DLL	ON	Activity rule		75
T1547.005 Security Support Provider	ON	Activity rule	Overridden	50
T1547.009 Shortcut Modification	ON	Activity rule		50
T1547.010 Port Monitors	ON	Activity rule	Overridden	100
T1546.001 Change Default File Association	OFF	Activity rule		100
T1546.003 WMI Event Subscription	ON	Activity rule	Overridden	50
T1546.007 Netsh Helper DLL	OFF	Activity rule		75
T1546.008 Accessibility Features	ON	Activity rule		50
T1546.010 AppInit DLLs	ON	Activity rule		75
T1546.011 Application Shimming	ON	Activity rule	Overridden	0
T1546.012 Image File Execution Options Injection	OFF	Activity rule		100
T1546.013 PowerShell Profile	ON	Activity rule		0
T1546.015 Component Object Model Hijacking	ON	Activity rule		75
T1574.001 DLL Search Order Hijacking	OFF	Activity rule		50
T1574.002 DLL Side-Loading	ON	Activity rule		75
T1574.010 Services File Permissions Weakness	ON	Activity rule		0
T1137.001 Office Template Macros	ON	Activity rule		0
T1137.002 Office Test	OFF	Activity rule		0
T1137.006 Add-ins	ON	Activity rule		50
T1505.003 Web Shell	ON	Activity rule		50
T1505.004 IIS Components	ON	Activity rule	Overridden	100
T1197 BITS Jobs	ON	Activity rule		0
T1176 Browser Extensions	ON	Activity rule		50
T1554 Compromise Host Software Binary	OFF	Activity rule		50
T1078.003 Valid Accounts: Local Accounts	OFF	Activity rule		75
T1133 External Remote Services	ON	Activity rule		75
T1525 Implant Internal Image	ON	Activity rule	Overridden	0
Unsigned binary in startup folder	ON	Activity rule		75
Service binary path modified	ON	Activity rule		100
Scheduled task created from command line	ON	Activity rule		75
New local admin account created	ON	Activity rule		50
Autorun entry added outside change window	ON	Activity rule	Overridden	75
Sticky Keys binary replacement	ON	Activity rule		0
Logon script modified	ON	Activity rule	Overridden	75

Rule	Enabled	Type	Assigned	Severity
T1548.002 Abuse Elevation Control Mechanism: Bypass UAC	ON	Activity rule		0
T1548.001 Setuid and Setgid	ON	Activity rule		50
T1548.003 Sudo and Sudo Caching	OFF	Activity rule	Overridden	50
T1134.001 Token Impersonation/Theft	ON	Activity rule		50
T1134.002 Create Process with Token	ON	Activity rule		50
T1134.003 Make and Impersonate Token	ON	Activity rule	Overridden	75
T1055.001 Process Injection: DLL Injection	ON	Activity rule		0
T1055.002 PE Injection	ON	Activity rule		0
T1055.003 Thread Execution Hijacking	OFF	Activity rule		100
T1055.012 Process Hollowing	ON	Activity rule		100
T1053.005 Scheduled Task	OFF	Activity rule		100
T1543.003 Windows Service	ON	Activity rule		100
T1547.001 Registry Run Keys / Startup Folder	ON	Activity rule		75
T1574.001 DLL Search Order Hijacking	OFF	Activity rule		100
T1574.002 DLL Side-Loading	OFF	Activity rule		75
T1574.005 Executable Installer File Permissions Weakness	ON	Activity rule		0
T1574.010 Services File Permissions Weakness	OFF	Activity rule		100
T1546.008 Accessibility Features	ON	Activity rule		75
T1546.012 Image File Execution Options Injection	OFF	Activity rule		75
T1068 Exploitation for Privilege Escalation	ON	Activity rule		75
T1484.001 Group Policy Modification	ON	Activity rule		75
T1611 Escape to Host	ON	Activity rule	Overridden	75
T1078.003 Local Accounts	ON	Activity rule		75

Rule	Enabled	Type	Assigned	Severity
T1070.001 Indicator Removal: Clear Windows Event Logs	ON	Activity rule		0
T1070.002 Clear Linux or Mac System Logs	ON	Activity rule		75
T1070.003 Clear Command History	ON	Activity rule		50
T1070.004 Indicator Removal on Host: File Deletion	OFF	Activity rule	Overridden	75
T1070.005 Network Share Connection Removal	ON	Activity rule	Overridden	100
T1070.006 Timestomp	ON	Activity rule	Overridden	0
T1070.007 Clear Network Connection History and Configurations	OFF	Activity rule		75
T1070.008 Clear Mailbox Data	ON	Activity rule	Overridden	100
T1070.009 Clear Persistence	OFF	Activity rule		75
T1027.001 Obfuscated Files or Information: Binary Padding	ON	Activity rule		50
T1027.002 Software Packing	OFF	Activity rule		75
T1027.003 Steganography	OFF	Activity rule		75
T1027.004 Compile After Delivery	ON	Activity rule	Overridden	100
T1027.005 Indicator Removal from Tools	ON	Activity rule		100
T1027.006 HTML Smuggling	ON	Activity rule		50
T1027.009 Embedded Payloads	OFF	Activity rule		75
T1027.010 Command Obfuscation	OFF	Activity rule		50
T1036.001 Masquerading: Invalid Code Signature	OFF	Activity rule		50
T1036.002 Right-to-Left Override	ON	Activity rule	Overridden	50
T1036.003 Rename System Utilities	ON	Activity rule	Overridden	75
T1036.004 Masquerade Task or Service	ON	Activity rule		100
T1036.005 Match Legitimate Name or Location	OFF	Activity rule		50
T1036.006 Space after Filename	ON	Activity rule		100
T1036.007 Double File Extension	OFF	Activity rule		50
T1218.001 System Binary Proxy Execution: Compiled HTML File	ON	Activity rule		0
T1218.002 Control Panel	ON	Activity rule		100
T1218.003 CMSTP	ON	Activity rule	Overridden	50
T1218.004 InstallUtil	ON	Activity rule		0
T1218.005 Mshta	ON	Activity rule		50
T1218.007 Msiexec	ON	Activity rule		0
T1218.008 Odbcconf	ON	Activity rule	Overridden	50
T1218.009 Regsvcs/Regasm	ON	Activity rule		75
T1218.010 Regsvr32	ON	Activity rule		50
T1218.011 Rundll32	ON	Activity rule		75
T1218.012 Verclsid	ON	Activity rule		100
T1218.013 Mavinject	OFF	Activity rule		75
T1218.014 MMC	ON	Activity rule	Overridden	75
T1562.001 Impair Defenses: Disable or Modify Tools	ON	Activity rule	Overridden	75
T1562.002 Disable Windows Event Logging	OFF	Activity rule		0
T1562.003 Impair Command History Logging	ON	Activity rule		75
T1562.004 Disable or Modify System Firewall	ON	Activity rule		75
T1562.006 Indicator Blocking	ON	Activity rule	Overridden	50
T1562.008 Disable or Modify Cloud Logs	ON	Activity rule	Overridden	0
T1562.009 Safe Mode Boot	ON	Activity rule	Overridden	100
T1562.010 Downgrade Attack	ON	Activity rule		75
T1055.001 Process Injection: DLL Injection	ON	Activity rule		50
T1055.002 PE Injection	ON	Activity rule		100
T1055.003 Thread Execution Hijacking	ON	Activity rule		50
T1055.004 Asynchronous Procedure Call	ON	Activity rule	Overridden	100
T1055.005 Thread Local Storage	OFF	Activity rule	Overridden	75
T1055.008 Ptrace System Calls	ON	Activity rule	Overridden	75
T1055.011 Extra Window Memory Injection	ON	Activity rule		50
T1055.012 Process Hollowing	OFF	Activity rule		75
T1497.001 Virtualization/Sandbox Evasion: System Checks	ON	Activity rule		50
T1497.002 User Activity Based Checks	OFF	Activity rule		50
T1497.003 Time Based Evasion	OFF	Activity rule	Overridden	50
T1134.001 Access Token Manipulation: Token Impersonation/Theft	ON	Activity rule		50
T1134.002 Create Process with Token	ON	Activity rule		75
T1134.003 Make and Impersonate Token	ON	Activity rule		50
T1134.004 Parent PID Spoofing	OFF	Activity rule	Overridden	75
T1134.005 SID-History Injection	ON	Activity rule	Overridden	50
T1112 Modify Registry	ON	Activity rule		50
T1202 Indirect Command Execution	ON	Activity rule		100
T1216 System Script Proxy Execution	ON	Activity rule		75
T1220 XSL Script Processing	OFF	Activity rule		0
T1207 Rogue Domain Controller	ON	Activity rule		75
T1014 Rootkit	OFF	Activity rule		50
T1006 Direct Volume Access	ON	Activity rule		75
T1480.001 Execution Guardrails: Environmental Keying	ON	Activity rule		50
T1535 Unused/Unsupported Cloud Regions	ON	Activity rule		75
T1550.001 Use Alternate Authentication Material: Application Access Token	ON	Activity rule		100
T1078.001 Valid Accounts: Default Accounts	ON	Activity rule		75
T1564.001 Hide Artifacts: Hidden Files and Directories	ON	Activity rule	Overridden	75
T1564.002 Hidden Users	ON	Activity rule		100
T1564.003 Hidden Window	ON	Activity rule		75
T1564.004 NTFS File Attributes	ON	Activity rule	Overridden	50
T1553.002 Subvert Trust Controls: Code Signing	ON	Activity rule	Overridden	50
T1553.004 Install Root Certificate	ON	Activity rule		75
T1553.005 Mark-of-the-Web Bypass	OFF	Activity rule		75
T1622 Debugger Evasion	ON	Activity rule		50
T1610 Deploy Container	ON	Activity rule		0
T1612 Build Image on Host	ON	Activity rule		75
T1601.001 Modify System Image: Patch System Image	OFF	Activity rule	Overridden	0
T1599.001 Network Boundary Bridging: Network Address Translation Traversal	OFF	Activity rule	Overridden	75
T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance	ON	Activity rule	Overridden	0
T1578.003 Delete Cloud Instance	OFF	Activity rule		50
T1542.001 Pre-OS Boot: System Firmware	ON	Activity rule		75
T1542.003 Bootkit	ON	Activity rule	Overridden	75
T1574.001 Hijack Execution Flow: DLL Search Order Hijacking	ON	Activity rule		50
T1574.002 DLL Side-Loading	OFF	Activity rule		75
T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild	ON	Activity rule		75
T1221 Template Injection	ON	Activity rule		0
T1140 Deobfuscate/Decode Files or Information	OFF	Activity rule		100
T1656 Impersonation	ON	Activity rule	Overridden	75
Detect renamed system utilities	ON	Activity rule		0
Block execution from %TEMP%	OFF	Activity rule		0
Script interpreter spawned by Office app	OFF	Activity rule	Overridden	75
Detect double file extensions	OFF	Activity rule	Overridden	0
Disabling Windows Defender via registry	ON	Activity rule		75
Certutil used to decode payload	ON	Activity rule		75
Rundll32 executing remote script	OFF	Activity rule	Overridden	100
Mshta launching web content	OFF	Activity rule		100
Base64 encoded PowerShell command	ON	Activity rule	Overridden	75
Hidden window process launch	OFF	Activity rule		0
Wevtutil clearing event logs	ON	Activity rule		50
Timestomp attempt on document files	OFF	Activity rule	Overridden	100
ADS stream write detected	OFF	Activity rule		50
Firewall rule added by non-admin	ON	Activity rule		75
Proxy settings modified by script	ON	Activity rule		50
Volume shadow copy deletion	ON	Activity rule		75
BITS job with remote payload	ON	Activity rule	Overridden	50
Security tool process terminated	ON	Activity rule		0

Rule	Enabled	Type	Assigned	Severity
T1110.001 Brute Force: Password Guessing	OFF	Activity rule		0
T1110.002 Password Cracking	OFF	Activity rule		0
T1110.003 Password Spraying	ON	Activity rule	Overridden	50
T1110.004 Credential Stuffing	ON	Activity rule		50
T1003.001 OS Credential Dumping: LSASS Memory	ON	Activity rule		100
T1003.002 Security Account Manager	ON	Activity rule		0
T1003.003 NTDS	ON	Activity rule		50
T1003.004 LSA Secrets	ON	Activity rule		75
T1003.005 Cached Domain Credentials	ON	Activity rule		0
T1003.006 DCSync	OFF	Activity rule	Overridden	100
T1552.001 Credentials In Files	OFF	Activity rule		75
T1552.002 Credentials in Registry	OFF	Activity rule	Overridden	75
T1552.004 Private Keys	ON	Activity rule		75
T1552.006 Group Policy Preferences	OFF	Activity rule	Overridden	50
T1555.003 Credentials from Web Browsers	OFF	Activity rule	Overridden	50
T1555.004 Windows Credential Manager	OFF	Activity rule	Overridden	75
T1555.005 Password Managers	ON	Activity rule		50
T1556.002 Password Filter DLL	OFF	Activity rule		0
T1558.001 Golden Ticket	OFF	Activity rule	Overridden	50
T1558.002 Silver Ticket	ON	Activity rule	Overridden	50
T1558.003 Kerberoasting	ON	Activity rule	Overridden	50
T1558.004 AS-REP Roasting	ON	Activity rule		50
T1539 Steal Web Session Cookie	ON	Activity rule		50
T1528 Steal Application Access Token	ON	Activity rule		50
T1649 Steal or Forge Authentication Certificates	ON	Activity rule		75
T1040 Network Sniffing	ON	Activity rule	Overridden	75
T1056.001 Input Capture: Keylogging	ON	Activity rule		75
T1187 Forced Authentication	OFF	Activity rule	Overridden	75
T1606.001 Forge Web Credentials: Web Cookies	ON	Activity rule		100
T1606.002 SAML Tokens	ON	Activity rule	Overridden	50
T1621 Multi-Factor Authentication Request Generation	ON	Activity rule		50
T1111 Multi-Factor Authentication Interception	ON	Activity rule	Overridden	50
T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay	ON	Activity rule		100
T1212 Exploitation for Credential Access	ON	Activity rule	Overridden	50
Password typed into plaintext document	OFF	Activity rule	Overridden	75

Rule	Enabled	Type	Assigned	Severity
T1007 System Service Discovery	ON	Activity rule	Overridden	75
T1010 Application Window Discovery	ON	Activity rule		0
T1012 Query Registry	ON	Activity rule	Overridden	0
T1016 System Network Configuration Discovery	ON	Activity rule		75
T1016.001 Internet Connection Discovery	OFF	Activity rule		50
T1018 Remote System Discovery	ON	Activity rule		75
T1033 System Owner/User Discovery	OFF	Activity rule		75
T1046 Network Service Discovery	ON	Activity rule		75
T1049 System Network Connections Discovery	ON	Activity rule	Overridden	75
T1057 Process Discovery	ON	Activity rule	Overridden	50
T1069.001 Permission Groups Discovery: Local Groups	ON	Activity rule		75
T1069.002 Domain Groups	OFF	Activity rule		50
T1082 System Information Discovery	ON	Activity rule		75
T1083 File and Directory Discovery	OFF	Activity rule		50
T1087.001 Account Discovery: Local Account	OFF	Activity rule		75
T1087.002 Domain Account	OFF	Activity rule		50
T1120 Peripheral Device Discovery	ON	Activity rule		75
T1124 System Time Discovery	ON	Activity rule		50
T1135 Network Share Discovery	ON	Activity rule		50
T1201 Password Policy Discovery	OFF	Activity rule		50
T1217 Browser Information Discovery	ON	Activity rule		75
T1482 Domain Trust Discovery	ON	Activity rule		0
T1518 Software Discovery	ON	Activity rule		100
T1518.001 Security Software Discovery	ON	Activity rule		75
T1614.001 System Language Discovery	ON	Activity rule	Overridden	75
T1615 Group Policy Discovery	ON	Activity rule		0
T1622 Debugger Evasion	ON	Activity rule	Overridden	100
T1497.001 Virtualization/Sandbox Evasion: System Checks	ON	Activity rule		75
T1580 Cloud Infrastructure Discovery	ON	Activity rule	Overridden	75
T1526 Cloud Service Discovery	ON	Activity rule		75
T1538 Cloud Service Dashboard	OFF	Activity rule	Overridden	75
T1613 Container and Resource Discovery	ON	Activity rule		100
T1652 Device Driver Discovery	ON	Activity rule		75
nmap scan from workstation	ON	Activity rule		100
Mass ping sweep detected	ON	Activity rule	Overridden	75

Rule	Enabled	Type	Assigned	Severity
T1021.001 Remote Services: Remote Desktop Protocol	OFF	Activity rule	Overridden	0
T1021.002 SMB/Windows Admin Shares	ON	Activity rule		75
T1021.003 Distributed Component Object Model	OFF	Activity rule		75
T1021.004 SSH	ON	Activity rule		50
T1021.005 VNC	ON	Activity rule		0
T1021.006 Windows Remote Management	ON	Activity rule	Overridden	50
T1550.002 Pass the Hash	OFF	Activity rule	Overridden	75
T1550.003 Pass the Ticket	OFF	Activity rule		75
T1534 Internal Spearphishing	ON	Activity rule	Overridden	50
T1570 Lateral Tool Transfer	OFF	Activity rule		0
T1563.001 SSH Hijacking	ON	Activity rule	Overridden	50
T1563.002 RDP Hijacking	ON	Activity rule	Overridden	100
T1080 Taint Shared Content	ON	Content rule		75
T1091 Replication Through Removable Media	ON	Activity rule		75
T1072 Software Deployment Tools	ON	Activity rule		50
T1210 Exploitation of Remote Services	ON	Activity rule		0

Rule	Enabled	Type	Assigned	Severity
T1005 Data from Local System	ON	Activity rule	Overridden	75
T1039 Data from Network Shared Drive	ON	Activity rule	Overridden	50
T1025 Data from Removable Media	ON	Activity rule		50
T1074.001 Data Staged: Local Data Staging	ON	Activity rule	Overridden	75
T1074.002 Remote Data Staging	OFF	Activity rule		0
T1113 Screen Capture	ON	Activity rule	Overridden	50
T1115 Clipboard Data	ON	Activity rule	Overridden	75
T1123 Audio Capture	ON	Activity rule		100
T1125 Video Capture	ON	Activity rule		100
T1056.001 Input Capture: Keylogging	ON	Activity rule		75
T1056.002 GUI Input Capture	OFF	Activity rule	Overridden	75
T1114.001 Email Collection: Local Email Collection	ON	Activity rule		75
T1114.002 Remote Email Collection	ON	Activity rule	Overridden	75
T1119 Automated Collection	ON	Activity rule		50
T1530 Data from Cloud Storage	OFF	Activity rule		50
T1213.002 Data from Information Repositories: Sharepoint	ON	Activity rule		100
T1560.001 Archive Collected Data: Archive via Utility	ON	Activity rule		50
T1185 Browser Session Hijacking	ON	Activity rule		75
T1602.002 Network Device Configuration Dump	ON	Activity rule		75

Rule	Enabled	Type	Assigned	Severity
test	ON	Activity rule	Overridden	0
Test 1	ON	Activity rule	Overridden	50
test rule	ON	Activity rule		50
New Rule	ON	Activity rule		100
New Rule (1)	ON	Activity rule		50
Copy of Login Hours	ON	Schedule rule		50
Copy of Accessing Streaming Sites	ON	Activity rule		75
Sample - Web Filtering	ON	Activity rule		50
Sample - USB Block	ON	Activity rule		75
Sample - Print Audit	ON	Activity rule	Overridden	75
MG Test Rule	OFF	Activity rule	Overridden	75
Oleg test	ON	Activity rule		0
demo rule do not enable	ON	Activity rule	Overridden	75
Rule for training video	ON	Activity rule		50
Webinar example rule	ON	Activity rule		75
QA - trigger warn action	ON	Activity rule	Overridden	0
QA - trigger block action	OFF	Activity rule		50
QA - schedule window	ON	Schedule rule		0
Detect renamed system utilities	OFF	Activity rule	Overridden	50
Block execution from %TEMP%	ON	Activity rule		75
Suspicious archive creation in user profile	OFF	Activity rule		50
Unusual parent-child process pair	OFF	Activity rule	Overridden	100
Scheduled task created from command line	OFF	Activity rule		75
Host file modification	ON	Activity rule		75
DLL loaded from user-writable path	ON	Activity rule		75
Clipboard paste into remote session	ON	Activity rule		100
Large upload to personal cloud drive	ON	Activity rule		50
Printing after hours	ON	Schedule rule		0
Idle longer than 30 minutes	OFF	Activity rule		50
Renaming invoice documents	ON	Activity rule		75
Test123	ON	Activity rule	Overridden	75

Name		Action	Trigger
May Linchangco		Block	Transfer Project A.zip
Roman Melnychuk		Warn	Paste credit card number

Name		Action	Trigger
May Linchangco		Block	Transfer Project A.zip
Roman Melnychuk		Warn	Paste credit card number

Name		Action	Trigger
May Linchangco		Block	Transfer Project A.zip
Roman Melnychuk		Warn	Paste credit card number