[Rule Tuning] Rule Tunings to add T1078 technique and subtechniques

[imays11]

Link to rule

Rare User Logon - add sub-techniques

Unusual Windows Username - add sub-techniques

Spike in Successful Logon Events from a Source IP - add technique and sub-techniques

Description

The Mitre Eval Score Analysis - 2022 [ Refer ] identified the following:

• Valid Accounts (T1078)
• Valid Accounts: Domain Accounts (T1078.002)
• Valid Accounts: Local Accounts (T1078.003)

...to be added to the above rules to reflect the techniques above

Example Data

N/A