Adversary and Tool Profiles

Click a threat profile to view more details.

Log on to Trellix Insights.
Click and select Adversary and Tools. The list of threat actors (adversaries) and the tools and techniques used by these threat actors are displayed.

Select a threat profile and view the following details.

Item	Description
Description	View a brief description of the threat profile.
Labels	Profile labels (APT, Botnet, Rootkit, Ransomware, and more) help you to categorize your profiles and provide insights into the nature of a threat. Labels provide one or more categories of attack or threat actor.
Severity	View the severity of the threat profile: medium, or high.
Knowledge Base	View Knowledge Base articles that provide information about the threat profile.
Common Vulnerabilities and Exposures (CVE)	View the CVE IDs associated with the threat profile.
MITRE Tool	View the MITRE tools associated with the threat profile.
Tool	View the tools associated with the threat profile.
Coverage	View the minimum AMCore Content coverage needed to protect against the threat profile.
Last Detected	View the last detected time stamp of the threat profile in the organization.
Global Prevalence	View a list of countries and sectors with impacted devices and a color-coded map. Global prevalence is based on the number of detections in the last 7 days. Observed Countries Observed Sectors Reported Countries Reported Sectors
Related Campaigns	View the list of associated campaigns. Clicking a campaign takes you to the Campaigns → Overview page for that campaign. The Related via column displays adversaries or tools that link a campaign and a profile.
Threat Behavior	View the following information about MITRE techniques: MITRE Techniques Observed — View the list of MITRE techniques and MITRE attack IDs for the threat profile. Details — Details of the selected MITRE technique. Observables — View commands that led to sighting the corresponding technique. Other Information — View the threat profile metadata. Click to drill down for more details about the threat profile.
ATT&CK Matrix for Enterprise	Visualize your organization's detection coverage across your portfolio of Trellix products and analyze how active threats use specific techniques.
Infection Comparison	View an interactive infection comparison based on the number of devices affected in your organization, the selected business sector, selected country, and worldwide. A red dot indicates affected devices. Hover over the dot to see the number of infections compared to the total number of devices. The size of the dot indicates the proportion of infected devices to the total number of devices. Sector and country show the number of infections per million devices.
TrellixProducts detecting this threat globally	View the detection distribution for the campaign or IoC grouped by Trellix products: BY PRODUCTS — Distribution of detection of Trellix products. BY VERSIONS — Click a product in the ring to view the distribution of versions of a selected product. ENS SCANNERS — Distribution of ENS Scanners. For example, JCM, AVSCAN.
Analyzed Indicators	View all analyzed IoCs for which threat profile detection can occur. Indicators that are detected in the environment are highlighted in red. Copy to clipboard — Click the copy icon to copy the IoC values. This allows you to search the IoCs in other Trellix products. Export analyzed indicators — Click Export to export the list of analyzed indicators and threat profile details in STIX2 format.
Other Associated Indicators	View threat profile indicators that are informational only. Threat profile detections do not occur based on these IoCs. Copy to clipboard — Click the copy icon to copy the IoC values. This allows you to search the IoCs in other Trellix products. Export all indicators — Click Export to export the list of all indicators and campaign details in STIX2 format.
Other Links	View external links to sites that provide information about the threat profile.