Vendor: Microsoft
July 25, 2023 · View on GitHub
Product: OneDrive
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 123 | 57 | 17 | 4 | 4 |
ATT&CK Matrix for Enterprise
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| External Remote Services Valid Accounts | User Execution | External Remote Services Valid Accounts Account Manipulation Account Manipulation: Exchange Email Delegate Permissions | Valid Accounts | Valid Accounts Obfuscated Files or Information Valid Accounts: Local Accounts | OS Credential Dumping Steal or Forge Kerberos Tickets | Account Discovery File and Directory Discovery | Remote Services Remote Services: SMB/Windows Admin Shares | Email Collection Email Collection: Email Forwarding Rule | Proxy: Multi-hop Proxy Application Layer Protocol Proxy | Exfiltration Over Alternative Protocol Automated Exfiltration |