Vendor: Microsoft

May 13, 2026 · View on GitHub

Product: Azure

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
58	29	7	3	3

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Abnormal Authentication & Access	app-activity ↳microsoft-azure-sk4-app-activity-adduser ↳microsoft-azure-sk4-app-activity-addmembertorole ↳microsoft-azuremon-sk4-app-activity-success-updategroup ↳microsoft-azure-sk4-app-activity-addmembertorole	T1078 - Valid Accounts T1133 - External Remote Services	12 Rules 4 Models
Account Manipulation	app-activity ↳microsoft-azure-sk4-app-activity-adduser ↳microsoft-azure-sk4-app-activity-addmembertorole ↳microsoft-azuremon-sk4-app-activity-success-updategroup ↳microsoft-azure-sk4-app-activity-addmembertorole	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Data Access	app-activity ↳microsoft-azure-sk4-app-activity-adduser ↳microsoft-azure-sk4-app-activity-addmembertorole ↳microsoft-azuremon-sk4-app-activity-success-updategroup ↳microsoft-azure-sk4-app-activity-addmembertorole	T1078 - Valid Accounts	19 Rules 11 Models
Data Leak	app-activity ↳microsoft-azure-sk4-app-activity-adduser ↳microsoft-azure-sk4-app-activity-addmembertorole ↳microsoft-azuremon-sk4-app-activity-success-updategroup ↳microsoft-azure-sk4-app-activity-addmembertorole	T1114 - Email Collection T1114.003 - Email Collection: Email Forwarding Rule	3 Rules
Privilege Escalation	app-activity ↳microsoft-azure-sk4-app-activity-adduser ↳microsoft-azure-sk4-app-activity-addmembertorole ↳microsoft-azuremon-sk4-app-activity-success-updategroup ↳microsoft-azure-sk4-app-activity-addmembertorole	T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
External Remote Services Valid Accounts Valid Accounts: Cloud Accounts		External Remote Services Valid Accounts Account Manipulation Account Manipulation: Exchange Email Delegate Permissions	Valid Accounts	Valid Accounts				Email Collection Email Collection: Email Forwarding Rule