| Account Manipulation | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Compromised Credentials | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
T1059.001 - Command and Scripting Interperter: PowerShell
T1078 - Valid Accounts
T1133 - External Remote Services
| |
| Data Access | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1078 - Valid Accounts
| |
| Data Exfiltration | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1020 - Automated Exfiltration
T1048 - Exfiltration Over Alternative Protocol
T1204 - User Execution
| |
| Data Leak | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1020 - Automated Exfiltration
T1048 - Exfiltration Over Alternative Protocol
T1114.003 - Email Collection: Email Forwarding Rule
T1204 - User Execution
| |
| Evasion | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1090.003 - Proxy: Multi-hop Proxy
| |
| Lateral Movement | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
| |
| Malware | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1078 - Valid Accounts
T1090.003 - Proxy: Multi-hop Proxy
T1204 - User Execution
| |
| Privilege Abuse | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1078 - Valid Accounts
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Privilege Escalation | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Privileged Activity | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1068 - Exploitation for Privilege Escalation
T1078 - Valid Accounts
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
| |
| Ransomware | app-activity
↳ ms-azure-eventhubs-app-activity
app-activity-failed
↳ ms-azure-eventhubs-app-activity
app-login
↳ ms-azure-eventhubs-login
dlp-alert
↳ s-o365-dlp-alert
↳ s-o365-dlp-alert-1
failed-app-login
↳ ms-azure-eventhubs-login
security-alert
↳ microsoft-scep-epp-alert
↳ forefront-epp-cef-alert
↳ raw-scep-epp-alert-csv
↳ raw-scep-alert
↳ json-microsoft-scep-epp-alert
↳ raw-scep-epp-alert
↳ s-scep-epp-alert
↳ microsoft-scep-security-alert
↳ cef-windows-defender
↳ win-def-mal-detect
| T1078 - Valid Accounts
| |