Vendor: Microsoft

July 25, 2023 · View on GitHub

Product: OneDrive

RulesModelsMITRE TTPsEvent TypesParsers
123571744
Use-CaseEvent Types/ParsersMITRE TTPContent
Abnormal Authentication & Accessapp-activity
cef-onedrive-app-activity-7
cef-onedrive-app-activity-5
cef-onedrive-app-activity-4
cef-onedrive-app-activity-3
cef-onedrive-app-activity-2
cef-onedrive-app-activity-1

file-read
cef-onedrive-app-activity-7
cef-onedrive-app-activity-5
cef-onedrive-app-activity-4
cef-onedrive-app-activity-3
cef-onedrive-app-activity-2
cef-onedrive-app-activity-1

file-upload
cef-onedrive-file-activity

local-logon
cef-onedrive-app-activity
T1078 - Valid Accounts
T1078.003 - Valid Accounts: Local Accounts
T1133 - External Remote Services
  • 48 Rules
  • 22 Models
Account Manipulationapp-activity
cef-onedrive-app-activity-7
cef-onedrive-app-activity-5
cef-onedrive-app-activity-4
cef-onedrive-app-activity-3
cef-onedrive-app-activity-2
cef-onedrive-app-activity-1

file-read
cef-onedrive-app-activity-7
cef-onedrive-app-activity-5
cef-onedrive-app-activity-4
cef-onedrive-app-activity-3
cef-onedrive-app-activity-2
cef-onedrive-app-activity-1

file-upload
cef-onedrive-file-activity

local-logon
cef-onedrive-app-activity
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

User Execution

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Obfuscated Files or Information

Valid Accounts: Local Accounts

OS Credential Dumping

Steal or Forge Kerberos Tickets

Account Discovery

File and Directory Discovery

Remote Services

Remote Services: SMB/Windows Admin Shares

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy

Exfiltration Over Alternative Protocol

Automated Exfiltration