Financial-sector detection examples
Original fictional examples, not an official MITRE financial-sector profile or a list of techniques proven to affect a specific firm. Technique IDs describe behavior; they do not establish attribution or complete coverage.
Use synthetic events and explicitly authorized isolated exercises. No real trading, production disruption, credential collection or malware execution is needed for these tasks.
T1078 · Valid Accounts
Unexpected use of a privileged identity in a fictional brokerage support environment.
Required evidence: Identity sign-in, session and privilege-change records with aligned timestamps.
Validation and limits: Check approved maintenance and role changes before escalating. Validate the query on synthetic events; the presence of logs alone does not establish coverage.
Read the MITRE techniqueT1566 · Phishing
A fictional message attempts to redirect operations staff to a credential-capture page.
Required evidence: Approved email-security observations and user reports, without collecting real credentials.
Validation and limits: Use benign approved simulations, false-positive review and a clear reporting owner.
Read the MITRE techniqueT1059 · Command and Scripting Interpreter
An unexpected script starts on a fictional trading-support workstation.
Required evidence: Appropriately configured process and script execution telemetry plus approved-change context.
Validation and limits: Distinguish administrative automation from unauthorized execution; test with benign commands in an isolated authorized environment.
Read the MITRE techniqueT1486 · Data Encrypted for Impact
A fictional workload shows unusual file changes and becomes unusable.
Required evidence: Endpoint/file activity and recovery evidence appropriate to the environment.
Validation and limits: Use synthetic files in an isolated exercise. Do not run ransomware; validate alert delivery and response decisions, not only a dashboard label.
Read the MITRE techniqueBefore calling a technique covered
- Define the behavior and scope.
- Confirm required telemetry is actually available and trustworthy.
- Test detection logic with approved benign evidence.
- Review legitimate explanations and false positives.
- Verify alert delivery, analyst action and response ownership.
- Record the test date, gaps and next review.
Market manipulation surveillance under PFUTP is a separate discipline. An ATT&CK mapping does not classify an order pattern as unlawful.