# DET0791 — Detection of User Execution ## Descrição Estratégia de detecção DET0791. Plataformas: ICS. ## Data Components Necessários | Data Component | Descrição | |---|---| | [[dc0032-process-creation\|DC0032 — Process Creation]] | Telemetria necessária | | [[dc0038-application-log-content\|DC0038 — Application Log Content]] | Telemetria necessária | | [[dc0055-file-access\|DC0055 — File Access]] | Telemetria necessária | | [[dc0064-command-execution\|DC0064 — Command Execution]] | Telemetria necessária | | [[dc0082-network-connection-creation\|DC0082 — Network Connection Creation]] | Telemetria necessária | | [[dc0085-network-traffic-content\|DC0085 — Network Traffic Content]] | Telemetria necessária | ## Analytics Relacionadas - [[an1923-analytic-1923|AN1923 (ICS)]] --- *Fonte: [MITRE ATT&CK — DET0791](https://attack.mitre.org/detectionstrategies/DET0791)*