Correlation rule error

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

12 Hours

Required Data

• Requires:
  • Health Monitoring Data

Detection Modules

Detector Tags

ATT&CK Tactic

• Lateral Movement (TA0008)
• Execution (TA0002)

ATT&CK Technique

• Remote Services (T1021)
• System Services: Service Execution (T1569.002)

Severity

Medium