Table 4 Data categories and representative artifacts used in compromise assessments, including system, user, application, network, security-solution, domain, and cloud sources. Abbreviations: DNS, domain name system; DLP, data loss prevention; MDM, mobile device management; IAM, identity and access management.
From: Proactive identification of cybersecurity compromises via the PROID compromise assessment framework
Type | Data |
|---|---|
System data and artifacts | â—Ź Endpoints System Logs â—Ź Application Logs â—Ź Running Processes â—Ź Processes threads creation/termination â—Ź Persistence and Autoruns Artifacts â—Ź Console and Shell Commands History â—Ź Memory & Disk Scanning Results â—Ź File System Metadata â—Ź Network share access â—Ź System Configurations |
User-related data and artifacts | ● User logons/logout ● User attributes change ● User interactions’ artifacts ● User privileges and access configurations ● User browsing activities ● User downloads artifacts ● User execution artifacts |
Application-related data and artifacts | â—Ź Application User Activities Logs â—Ź Application Security Configuration Audit Logs â—Ź Application Configuration â—Ź Email-Related artifacts |
Network traffic data | â—Ź Network traffic Full-Packet capture â—Ź Network Flow (NetFlow) â—Ź DNS queries |
Security solutions data | â—Ź Firewall logs â—Ź Web Application Firewall logs â—Ź Antivirus Logs â—Ź IPS & IDS logs â—Ź DLP logs â—Ź MDM logs |
Domain-related data | â—Ź User login/logout activities â—Ź Created and deleted user accounts â—Ź Created and deleted service accounts â—Ź User configuration changes â—Ź Endpoints configurations â—Ź Group Policy Objects configurations |
Cloud-related data | â—Ź Cloud resources audit logs â—Ź Identity and Access Management (IAM) logs â—Ź Container and Orchestration Management Logs â—Ź Virtual Network Traffic Logs |
