약어

공간을 절약하기 위해 레벨, MITRE ATT&CK 전술, 채널, 공급자, 필드 이름 등을 약어로 표시합니다...

-b, --disable-abbreviations 옵션을 사용하면 이러한 약어 중 일부를 끄고 원래의 채널 이름, 공급자 이름 등을 확인할 수 있습니다...

레벨 약어

공간을 절약하기 위해 경고 level을 표시할 때 다음 약어를 사용합니다.

• emer: emergency
• crit: critical
• high: high
• med: medium
• low: low
• info: informational
• undef: undefined

MITRE ATT&CK 전술 약어

공간을 절약하기 위해 MITRE ATT&CK 전술 태그를 표시할 때 다음 약어를 사용합니다. 이러한 약어는 ./config/mitre_tactics.txt 구성 파일에서 자유롭게 편집할 수 있습니다.

• Recon : Reconnaissance
• ResDev : Resource Development
• InitAccess : Initial Access
• Exec : Execution
• Persis : Persistence
• PrivEsc : Privilege Escalation
• Stealth : Stealth (formerly Defense Evasion)
• DefImpair : Defense Impairment
• CredAccess : Credential Access
• Disc : Discovery
• LatMov : Lateral Movement
• Collect : Collection
• C2 : Command and Control
• Exfil : Exfiltration
• Impact : Impact

채널 약어

공간을 절약하기 위해 채널을 표시할 때 다음 약어를 사용합니다. 이러한 약어는 ./rules/config/channel_abbreviations.txt 구성 파일에서 자유롭게 편집할 수 있습니다.

• App : Application
• AppLocker : Microsoft-Windows-AppLocker/*
• BitsCli : Microsoft-Windows-Bits-Client/Operational
• CodeInteg : Microsoft-Windows-CodeIntegrity/Operational
• Defender : Microsoft-Windows-Windows Defender/Operational
• DHCP-Svr : Microsoft-Windows-DHCP-Server/Operational
• DNS-Svr : DNS Server
• DvrFmwk : Microsoft-Windows-DriverFrameworks-UserMode/Operational
• Exchange : MSExchange Management
• Firewall : Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
• KeyMgtSvc : Key Management Service
• LDAP-Cli : Microsoft-Windows-LDAP-Client/Debug
• NTLM Microsoft-Windows-NTLM/Operational
• OpenSSH : OpenSSH/Operational
• PrintAdm : Microsoft-Windows-PrintService/Admin
• PrintOp : Microsoft-Windows-PrintService/Operational
• PwSh : Microsoft-Windows-PowerShell/Operational
• PwShClassic : Windows PowerShell
• RDP-Client : Microsoft-Windows-TerminalServices-RDPClient/Operational
• Sec : Security
• SecMitig : Microsoft-Windows-Security-Mitigations/*
• SmbCliSec : Microsoft-Windows-SmbClient/Security
• SvcBusCli : Microsoft-ServiceBus-Client
• Sys : System
• Sysmon : Microsoft-Windows-Sysmon/Operational
• TaskSch : Microsoft-Windows-TaskScheduler/Operational
• WinRM : Microsoft-Windows-WinRM/Operational
• WMI : Microsoft-Windows-WMI-Activity/Operational

기타 약어

출력을 최대한 간결하게 만들기 위해 규칙에서 다음 약어를 사용합니다:

• Acct -> Account
• Addr -> Address
• Auth -> Authentication
• Cli -> Client
• Chan -> Channel
• Cmd -> Command
• Cnt -> Count
• Comp -> Computer
• Conn -> Connection/Connected
• Creds -> Credentials
• Crit -> Critical
• Disconn -> Disconnection/Disconnected
• Dir -> Directory
• Drv -> Driver
• Dst -> Destination
• EID -> Event ID
• Err -> Error
• Exec -> Execution
• FW -> Firewall
• Grp -> Group
• Img -> Image
• Inj -> Injection
• Krb -> Kerberos
• LID -> Logon ID
• Med -> Medium
• Net -> Network
• Obj -> Object
• Op -> Operational/Operation
• Proto -> Protocol
• PW -> Password
• Reconn -> Reconnection
• Req -> Request
• Rsp -> Response
• Sess -> Session
• Sig -> Signature
• Susp -> Suspicious
• Src -> Source
• Svc -> Service
• Svr -> Server
• Temp -> Temporary
• Term -> Termination/Terminated
• Tkt -> Ticket
• Tgt -> Target
• Unkwn -> Unknown
• Usr -> User
• Perm -> Permament
• Pkg -> Package
• Priv -> Privilege
• Proc -> Process
• PID -> Process ID
• PGUID -> Process GUID (Global Unique ID)
• Ver -> Version