F00020 "Detect anomalous activity"

Tactic stage: TA15

Summary:

Detects techniques:

T0011 Compromise legitimate accounts

DISARM Frameworks provided CC-by-SA by the DISARM Foundation