Vendor: Microsoft

Product: Microsoft Azure

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
17	17	8	13	13

Use-Case	Event Types/Parsers	MITRE ATT&CK® TTP	Content
Cloud Data Protection	azure-blob-read ↳azure-blob-activity1 ↳azure-blob-activity2 azure-blob-write ↳azure-blob-activity1 ↳azure-blob-activity2 azure-container-acl ↳azure-blob-activity1 ↳azure-blob-activity2 azure-disk-write ↳azure-disks-write azure-snapshot-write ↳azure-snapshots-write azure-storage-list ↳azure-blob-activity1 ↳azure-blob-activity2	T1078.004 - Valid Accounts: Cloud Accounts T1204 - User Execution T1580 - T1580 TA0009 - TA0009	5 Rules 5 Models
Compromised Credentials	azure-blob-read ↳azure-blob-activity1 ↳azure-blob-activity2 azure-blob-write ↳azure-blob-activity1 ↳azure-blob-activity2 azure-container-acl ↳azure-blob-activity1 ↳azure-blob-activity2 azure-disk-write ↳azure-disks-write azure-image-write ↳azure-images-write azure-instance-creds-write ↳azure-sshpublickeys-write azure-instance-write ↳azure-virtualmachines-write azure-keyvault-read ↳azure-keyvault-activity azure-keyvault-write ↳azure-keyvault-activity azure-role-assign ↳azure-roleassignments-write azure-role-write ↳azure-roledefiniton-write azure-snapshot-write ↳azure-snapshots-write azure-storage-list ↳azure-blob-activity1 ↳azure-blob-activity2	T1078.004 - Valid Accounts: Cloud Accounts T1535 - Unused/Unsupported Cloud Regions	5 Rules 5 Models
Cryptomining	azure-instance-write ↳azure-virtualmachines-write	T1496 - Resource Hijacking	1 Rules 1 Models
Malware	azure-blob-write ↳azure-blob-activity1 ↳azure-blob-activity2 azure-image-write ↳azure-images-write azure-instance-write ↳azure-virtualmachines-write	T1204 - User Execution T1204.003 - T1204.003	4 Rules 4 Models
Privilege Escalation	azure-role-assign ↳azure-roleassignments-write azure-role-write ↳azure-roledefiniton-write	TA0004 - TA0004	2 Rules 2 Models

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Valid Accounts Valid Accounts: Cloud Accounts	User Execution	Valid Accounts	Valid Accounts	Valid Accounts Unused/Unsupported Cloud Regions							Resource Hijacking