Skip to content

Abbreviations

In order to save space, we abbreviate levels, MITRE ATT&CK tactics, channels, providers, field names, etc...

You can turn off some of these abbreviations to see the original channel name, provider name, etc... with the -b, --disable-abbreviations option.

Level Abbreviations

In order to save space, we use the following abbrevations when displaying the alert level.

  • emer: emergency
  • crit: critical
  • high: high
  • med: medium
  • low: low
  • info: informational
  • undef: undefined

MITRE ATT&CK Tactics Abbreviations

In order to save space, we use the following abbreviations when displaying MITRE ATT&CK tactic tags. You can freely edit these abbreviations in the ./config/mitre_tactics.txt configuration file.

  • Recon : Reconnaissance
  • ResDev : Resource Development
  • InitAccess : Initial Access
  • Exec : Execution
  • Persis : Persistence
  • PrivEsc : Privilege Escalation
  • Stealth : Stealth (formerly Defense Evasion)
  • DefImpair : Defense Impairment
  • CredAccess : Credential Access
  • Disc : Discovery
  • LatMov : Lateral Movement
  • Collect : Collection
  • C2 : Command and Control
  • Exfil : Exfiltration
  • Impact : Impact

Channel Abbreviations

In order to save space, we use the following abbreviations when displaying Channel. You can freely edit these abbreviations in the ./rules/config/channel_abbreviations.txt configuration file.

  • App : Application
  • AppLocker : Microsoft-Windows-AppLocker/*
  • BitsCli : Microsoft-Windows-Bits-Client/Operational
  • CodeInteg : Microsoft-Windows-CodeIntegrity/Operational
  • Defender : Microsoft-Windows-Windows Defender/Operational
  • DHCP-Svr : Microsoft-Windows-DHCP-Server/Operational
  • DNS-Svr : DNS Server
  • DvrFmwk : Microsoft-Windows-DriverFrameworks-UserMode/Operational
  • Exchange : MSExchange Management
  • Firewall : Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
  • KeyMgtSvc : Key Management Service
  • LDAP-Cli : Microsoft-Windows-LDAP-Client/Debug
  • NTLM Microsoft-Windows-NTLM/Operational
  • OpenSSH : OpenSSH/Operational
  • PrintAdm : Microsoft-Windows-PrintService/Admin
  • PrintOp : Microsoft-Windows-PrintService/Operational
  • PwSh : Microsoft-Windows-PowerShell/Operational
  • PwShClassic : Windows PowerShell
  • RDP-Client : Microsoft-Windows-TerminalServices-RDPClient/Operational
  • Sec : Security
  • SecMitig : Microsoft-Windows-Security-Mitigations/*
  • SmbCliSec : Microsoft-Windows-SmbClient/Security
  • SvcBusCli : Microsoft-ServiceBus-Client
  • Sys : System
  • Sysmon : Microsoft-Windows-Sysmon/Operational
  • TaskSch : Microsoft-Windows-TaskScheduler/Operational
  • WinRM : Microsoft-Windows-WinRM/Operational
  • WMI : Microsoft-Windows-WMI-Activity/Operational

Other Abbreviations

The following abbreviations are used in rules in order to make the output as concise as possible:

  • Acct -> Account
  • Addr -> Address
  • Auth -> Authentication
  • Cli -> Client
  • Chan -> Channel
  • Cmd -> Command
  • Cnt -> Count
  • Comp -> Computer
  • Conn -> Connection/Connected
  • Creds -> Credentials
  • Crit -> Critical
  • Disconn -> Disconnection/Disconnected
  • Dir -> Directory
  • Drv -> Driver
  • Dst -> Destination
  • EID -> Event ID
  • Err -> Error
  • Exec -> Execution
  • FW -> Firewall
  • Grp -> Group
  • Img -> Image
  • Inj -> Injection
  • Krb -> Kerberos
  • LID -> Logon ID
  • Med -> Medium
  • Net -> Network
  • Obj -> Object
  • Op -> Operational/Operation
  • Proto -> Protocol
  • PW -> Password
  • Reconn -> Reconnection
  • Req -> Request
  • Rsp -> Response
  • Sess -> Session
  • Sig -> Signature
  • Susp -> Suspicious
  • Src -> Source
  • Svc -> Service
  • Svr -> Server
  • Temp -> Temporary
  • Term -> Termination/Terminated
  • Tkt -> Ticket
  • Tgt -> Target
  • Unkwn -> Unknown
  • Usr -> User
  • Perm -> Permament
  • Pkg -> Package
  • Priv -> Privilege
  • Proc -> Process
  • PID -> Process ID
  • PGUID -> Process GUID (Global Unique ID)
  • Ver -> Version