F00019 "Activity resurgence detection (alarm when dormant accounts become activated)"

Tactic stage: TA15

Summary:

Detects techniques:

T0011 Compromise legitimate accounts

DISARM Frameworks provided CC-by-SA by the DISARM Foundation