| Compromised Credentials | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
authentication-successful
↳s-azure-authentication
database-query
↳azure-event-hub-sql-security-event
↳cef-microsoft-database-query
failed-app-login
↳cef-azure-failed-app-login
↳s-azure-app-login
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-failed-app-login
file-delete
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
file-read
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-file-read-1
↳azure-file-read
↳azure-file-read-3
↳azure-file-read-2
↳azure-event-hub-file-read
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
network-alert
↳microsoft-network-alert
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
security-alert
↳cef-azure-event-hub-security
| T1003 - OS Credential Dumping
T1003.001 - T1003.001
T1003.002 - T1003.002
T1003.003 - T1003.003
T1003.005 - T1003.005
T1016 - System Network Configuration Discovery
T1021 - Remote Services
T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
T1040 - Network Sniffing
T1078 - Valid Accounts
T1078.002 - T1078.002
T1078.003 - Valid Accounts: Local Accounts
T1083 - File and Directory Discovery
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
T1213 - Data from Information Repositories
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1550 - Use Alternate Authentication Material
T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1555 - Credentials from Password Stores
T1558 - Steal or Forge Kerberos Tickets
TA0002 - TA0002
| |
| Data Access | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
database-query
↳azure-event-hub-sql-security-event
↳cef-microsoft-database-query
failed-app-login
↳cef-azure-failed-app-login
↳s-azure-app-login
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-failed-app-login
file-delete
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
file-read
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-file-read-1
↳azure-file-read
↳azure-file-read-3
↳azure-file-read-2
↳azure-event-hub-file-read
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
| T1003 - OS Credential Dumping
T1078 - Valid Accounts
T1083 - File and Directory Discovery
T1213 - Data from Information Repositories
| |
| Data Exfiltration | file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
| T1003 - OS Credential Dumping
T1040 - Network Sniffing
T1041 - Exfiltration Over C2 Channel
T1048 - Exfiltration Over Alternative Protocol
T1059 - Command and Scripting Interperter
T1071.001 - Application Layer Protocol: Web Protocols
T1071.002 - Application Layer Protocol: File Transfer Protocols
T1071.004 - Application Layer Protocol: DNS
T1552.001 - T1552.001
T1560 - Archive Collected Data
T1572 - Protocol Tunneling
TA0002 - TA0002
| |
| Data Leak | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
usb-insert
↳azure-event-hub-usb-insert
| T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB
T1091 - Replication Through Removable Media
T1114.001 - T1114.001
T1114.003 - Email Collection: Email Forwarding Rule
| |
| Lateral Movement | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-activity-failed
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
authentication-failed
↳s-azure-authentication
authentication-successful
↳s-azure-authentication
failed-app-login
↳cef-azure-failed-app-login
↳s-azure-app-login
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-failed-app-login
network-connection-failed
↳azure-event-hub-network-security-group-event
↳azure-event-hub-network-security-group-rule-counter
↳azure-event-hub-network-connection
↳azure-event-hub-application-gateway-firewall-log
network-connection-successful
↳microsoft-azure-network-connection-successful
↳azure-event-hub-network-security-group-event
↳azure-network-connection-success
↳azure-event-hub-network-security-group-rule-counter
↳azure-event-hub-network-connection
↳azure-event-hub-application-gateway-firewall-log
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
security-alert
↳cef-azure-event-hub-security
| T1018 - Remote System Discovery
T1021 - Remote Services
T1021.001 - Remote Services: Remote Desktop Protocol
T1021.003 - T1021.003
T1021.006 - T1021.006
T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
T1047 - Windows Management Instrumentation
T1059.001 - Command and Scripting Interperter: PowerShell
T1071 - Application Layer Protocol
T1078 - Valid Accounts
T1090 - Proxy
T1090.003 - Proxy: Multi-hop Proxy
T1190 - Exploit Public Fasing Application
T1210 - Exploitation of Remote Services
T1219 - Remote Access Software
T1550 - Use Alternate Authentication Material
T1550.002 - Use Alternate Authentication Material: Pass the Hash
T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1558 - Steal or Forge Kerberos Tickets
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1563.002 - T1563.002
TA0010 - TA0010
TA0011 - TA0011
| |
| Malware | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
authentication-successful
↳s-azure-authentication
dns-query
↳cef-microsoft-dns-query
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
image-loaded
↳azure-event-hub-image-load
network-alert
↳microsoft-network-alert
network-connection-failed
↳azure-event-hub-network-security-group-event
↳azure-event-hub-network-security-group-rule-counter
↳azure-event-hub-network-connection
↳azure-event-hub-application-gateway-firewall-log
network-connection-successful
↳microsoft-azure-network-connection-successful
↳azure-event-hub-network-security-group-event
↳azure-network-connection-success
↳azure-event-hub-network-security-group-rule-counter
↳azure-event-hub-network-connection
↳azure-event-hub-application-gateway-firewall-log
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
security-alert
↳cef-azure-event-hub-security
| T1003 - OS Credential Dumping
T1003.002 - T1003.002
T1012 - Query Registry
T1021.002 - Remote Services: SMB/Windows Admin Shares
T1027 - Obfuscated Files or Information
T1027.004 - Obfuscated Files or Information: Compile After Delivery
T1036 - Masquerading
T1036.004 - T1036.004
T1047 - Windows Management Instrumentation
T1053 - Scheduled Task/Job
T1053.003 - T1053.003
T1053.005 - Scheduled Task/Job: Scheduled Task
T1055 - Process Injection
T1055.001 - Process Injection: Dynamic-link Library Injection
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1059.003 - T1059.003
T1059.005 - T1059.005
T1059.007 - T1059.007
T1071 - Application Layer Protocol
T1072 - Software Deployment Tools
T1078 - Valid Accounts
T1083 - File and Directory Discovery
T1105 - Ingress Tool Transfer
T1112 - Modify Registry
T1113 - Screen Capture
T1123 - Audio Capture
T1127 - Trusted Developer Utilities Proxy Execution
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1134.001 - Access Token Manipulation: Token Impersonation/Theft
T1134.002 - T1134.002
T1135 - Network Share Discovery
T1190 - Exploit Public Fasing Application
T1197 - BITS Jobs
T1202 - Indirect Command Execution
T1203 - Exploitation for Client Execution
T1204.002 - T1204.002
T1210 - Exploitation of Remote Services
T1218 - Signed Binary Proxy Execution
T1218.001 - Signed Binary Proxy Execution: Compiled HTML File
T1218.002 - Signed Binary Proxy Execution: Control Panel
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.005 - T1218.005
T1218.007 - Signed Binary Proxy Execution: Msiexec
T1218.008 - T1218.008
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1482 - Domain Trust Discovery
T1490 - Inhibit System Recovery
T1505.003 - Server Software Component: Web Shell
T1543.003 - Create or Modify System Process: Windows Service
T1546.001 - T1546.001
T1546.003 - T1546.003
T1546.011 - T1546.011
T1547.001 - T1547.001
T1547.002 - T1547.002
T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1555 - Credentials from Password Stores
T1558 - Steal or Forge Kerberos Tickets
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1562 - Impair Defenses
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1563.002 - T1563.002
T1568.002 - Dynamic Resolution: Domain Generation Algorithms
T1569 - System Services
T1574 - Hijack Execution Flow
T1574.002 - Hijack Execution Flow: DLL Side-Loading
T1574.010 - T1574.010
T1574.011 - T1574.011
T1583.001 - T1583.001
TA0002 - TA0002
TA0011 - TA0011
| |
| Privilege Abuse | account-password-change
↳cef-microsoft-password-change
app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-activity-failed
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
cloud-admin-activity
↳s-azure-authorization-activity
↳s-azure-api-management
↳s-azure-authorization-activity-3
↳s-azure-authorization-activity-2
↳s-azure-managed-identity
↳s-azure-pim-activity
↳s-azure-core-directory
↳s-azure-container-service
cloud-admin-activity-failed
↳s-azure-authorization-activity
↳s-azure-api-management
↳s-azure-authorization-activity-3
↳s-azure-authorization-activity-2
↳s-azure-managed-identity
↳s-azure-pim-activity
↳s-azure-core-directory
failed-app-login
↳cef-azure-failed-app-login
↳s-azure-app-login
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-failed-app-login
file-delete
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
file-download
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
file-read
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-file-read-1
↳azure-file-read
↳azure-file-read-3
↳azure-file-read-2
↳azure-event-hub-file-read
file-upload
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
member-added
↳azure-event-hub-member-added
member-removed
↳azure-event-hub-member-removed
↳azure-ad-member-removed-1
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
| T1047 - Windows Management Instrumentation
T1078 - Valid Accounts
T1078.002 - T1078.002
T1078.004 - Valid Accounts: Cloud Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1136.001 - Create Account: Create: Local Account
T1530 - Data from Cloud Storage Object
| |
| Privilege Escalation | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
| T1003 - OS Credential Dumping
T1007 - System Service Discovery
T1012 - Query Registry
T1016 - System Network Configuration Discovery
T1018 - Remote System Discovery
T1027 - Obfuscated Files or Information
T1027.004 - Obfuscated Files or Information: Compile After Delivery
T1033 - System Owner/User Discovery
T1036.004 - T1036.004
T1047 - Windows Management Instrumentation
T1049 - System Network Connections Discovery
T1053.002 - Scheduled Task/Job: At (Windows)
T1053.005 - Scheduled Task/Job: Scheduled Task
T1057 - Process Discovery
T1059.001 - Command and Scripting Interperter: PowerShell
T1059.003 - T1059.003
T1068 - Exploitation for Privilege Escalation
T1078 - Valid Accounts
T1082 - System Information Discovery
T1087 - Account Discovery
T1087.001 - Account Discovery: Local Account
T1087.002 - Account Discovery: Domain Account
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1134.001 - Access Token Manipulation: Token Impersonation/Theft
T1134.002 - T1134.002
T1135 - Network Share Discovery
T1218.002 - Signed Binary Proxy Execution: Control Panel
T1218.003 - Signed Binary Proxy Execution: CMSTP
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification
T1482 - Domain Trust Discovery
T1484.001 - T1484.001
T1518.001 - T1518.001
T1543.003 - Create or Modify System Process: Windows Service
T1547.002 - T1547.002
T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control
T1552.006 - T1552.006
T1555.005 - T1555.005
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1574 - Hijack Execution Flow
T1574.002 - Hijack Execution Flow: DLL Side-Loading
T1574.011 - T1574.011
| |
| Privileged Activity | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-activity-failed
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
failed-app-login
↳cef-azure-failed-app-login
↳s-azure-app-login
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-failed-app-login
file-delete
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
file-download
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
file-read
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-file-read-1
↳azure-file-read
↳azure-file-read-3
↳azure-file-read-2
↳azure-event-hub-file-read
file-upload
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
security-alert
↳cef-azure-event-hub-security
| T1021 - Remote Services
T1068 - Exploitation for Privilege Escalation
T1078 - Valid Accounts
T1078.002 - T1078.002
T1482 - Domain Trust Discovery
| |
| Ransomware | app-activity
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-8
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
↳azure-event-hub-application-gateway-access-log
app-activity-failed
↳azure-eventhubbeat-app-activity-9
↳azure-eventhubbeat-app-activity-8
↳cef-azure-app-activity-5
↳azure-eventhubbeat-app-activity-5
↳azure-eventhubbeat-app-activity-4
↳cef-azure-app-activity-3
↳azure-eventhubbeat-app-activity-7
↳cef-azure-app-activity-4
↳azure-eventhubbeat-app-activity-6
↳cef-azure-app-activity-1
↳azure-app-activity-3
↳cef-azure-app-activity-2
↳azure-app-activity-2
↳azure-app-activity-1
↳azure-eventhubbeat-app-activity
↳azure-app-activity-7
↳azure-app-activity-6
↳azure-app-activity-5
↳azure-app-activity-4
↳azure-eventhubbeat-app-activity-1
↳ms-azure-eventhubs-app-activity
↳azure-eventhubbeat-app-activity-3
↳azure-eventhubbeat-app-activity-2
app-login
↳cef-azure-app-login
↳azure-event-hub-app-service-audit-logs
↳s-azure-app-login
↳azure-event-hub-key-vault-auth
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-app-login
↳azure-app-login
authentication-failed
↳s-azure-authentication
authentication-successful
↳s-azure-authentication
failed-app-login
↳cef-azure-failed-app-login
↳s-azure-app-login
↳ms-azure-signin-app-login
↳ms-azure-eventhubs-login
↳cef-microsoft-failed-app-login
file-write
↳cef-microsoft-app-activity-13
↳cef-microsoft-app-activity-44
↳cef-microsoft-app-activity-43
↳cef-microsoft-app-activity-38
↳azure-event-hub-file-events
↳azure-file-write
process-created
↳azure-process-created-1
↳azure-event-hub-process-events
↳azure-event-hub-process-events-1
remote-logon
↳cef-microsoft-remote-logon
↳azure-event-hub-remote-logon
| T1003.001 - T1003.001
T1059.003 - T1059.003
T1070 - Indicator Removal on Host
T1070.001 - Indicator Removal on Host: Clear Windows Event Logs
T1078 - Valid Accounts
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification
T1486 - Data Encrypted for Impact
T1490 - Inhibit System Recovery
| |