2_ds_microsoft_azure_mfa.md

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	app-activity ↳microsoft-azuremfa-str-app-activity-success-user ↳microsoft-azuremfa-str-user-modify-success-addednewuser ↳azure-azuremfa-json-app-activity-additionaldetails ↳azure-azuremfa-json-app-activity-additionaldetails app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired authentication-successful ↳microsoft-azure-str-endpoint-login-success-primaryauth ↳microsoft-azuremfa-str-endpoint-login-success-callstatus-1 ↳microsoft-azuremfa-str-endpoint-login-success-callstatus ↳microsoft-azuremfa-str-app-authentication-primery ↳azure-azuremfa-json-app-authentication-success-mfacompleted failed-app-login ↳azure-azuremfa-json-app-login-fail-errorvalidatingcreds ↳azure-azuremfa-json-app-login-mfa-expired	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Data Access	app-activity ↳microsoft-azuremfa-str-app-activity-success-user ↳microsoft-azuremfa-str-user-modify-success-addednewuser ↳azure-azuremfa-json-app-activity-additionaldetails ↳azure-azuremfa-json-app-activity-additionaldetails app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired failed-app-login ↳azure-azuremfa-json-app-login-fail-errorvalidatingcreds ↳azure-azuremfa-json-app-login-mfa-expired	T1078 - Valid Accounts	20 Rules 11 Models
Lateral Movement	app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired authentication-failed ↳microsoft-azuremfa-str-endpoint-login-fail-pfsvc ↳microsoft-azuremfa-str-endpoint-login-fail-auth ↳microsoft-azuremfa-str-endpoint-login-fail-callstatus ↳microsoft-azuremfa-str-app-authentication-fail-failed ↳microsoft-azuremfa-str-app-authentication-fail-from ↳azure-azuremfa-json-app-authentication-fail-token ↳azure-azuremfa-json-app-authentication-fail-authblocked ↳azure-azuremfa-json-app-authentication-fail-mfadenied authentication-successful ↳microsoft-azure-str-endpoint-login-success-primaryauth ↳microsoft-azuremfa-str-endpoint-login-success-callstatus-1 ↳microsoft-azuremfa-str-endpoint-login-success-callstatus ↳microsoft-azuremfa-str-app-authentication-primery ↳azure-azuremfa-json-app-authentication-success-mfacompleted failed-app-login ↳azure-azuremfa-json-app-login-fail-errorvalidatingcreds ↳azure-azuremfa-json-app-login-mfa-expired	T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Malware	app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired authentication-successful ↳microsoft-azure-str-endpoint-login-success-primaryauth ↳microsoft-azuremfa-str-endpoint-login-success-callstatus-1 ↳microsoft-azuremfa-str-endpoint-login-success-callstatus ↳microsoft-azuremfa-str-app-authentication-primery ↳azure-azuremfa-json-app-authentication-success-mfacompleted	T1078 - Valid Accounts	1 Rules
Privilege Abuse	account-deleted ↳microsoft-azuremfa-csv-user-delete-deleted app-activity ↳microsoft-azuremfa-str-app-activity-success-user ↳microsoft-azuremfa-str-user-modify-success-addednewuser ↳azure-azuremfa-json-app-activity-additionaldetails ↳azure-azuremfa-json-app-activity-additionaldetails app-activity-failed ↳azure-azuremfa-json-app-activity-additionaldetails app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired failed-app-login ↳azure-azuremfa-json-app-login-fail-errorvalidatingcreds ↳azure-azuremfa-json-app-login-mfa-expired	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1531 - Account Access Removal	7 Rules 3 Models
Privileged Activity	app-activity ↳microsoft-azuremfa-str-app-activity-success-user ↳microsoft-azuremfa-str-user-modify-success-addednewuser ↳azure-azuremfa-json-app-activity-additionaldetails ↳azure-azuremfa-json-app-activity-additionaldetails app-activity-failed ↳azure-azuremfa-json-app-activity-additionaldetails app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired failed-app-login ↳azure-azuremfa-json-app-login-fail-errorvalidatingcreds ↳azure-azuremfa-json-app-login-mfa-expired	T1078 - Valid Accounts	2 Rules 1 Models
Ransomware	app-login ↳azure-azuremfa-json-app-login-success-mfarequirementsatisfied ↳azure-azuremfa-json-app-login-mfa-expired authentication-failed ↳microsoft-azuremfa-str-endpoint-login-fail-pfsvc ↳microsoft-azuremfa-str-endpoint-login-fail-auth ↳microsoft-azuremfa-str-endpoint-login-fail-callstatus ↳microsoft-azuremfa-str-app-authentication-fail-failed ↳microsoft-azuremfa-str-app-authentication-fail-from ↳azure-azuremfa-json-app-authentication-fail-token ↳azure-azuremfa-json-app-authentication-fail-authblocked ↳azure-azuremfa-json-app-authentication-fail-mfadenied authentication-successful ↳microsoft-azure-str-endpoint-login-success-primaryauth ↳microsoft-azuremfa-str-endpoint-login-success-callstatus-1 ↳microsoft-azuremfa-str-endpoint-login-success-callstatus ↳microsoft-azuremfa-str-app-authentication-primery ↳azure-azuremfa-json-app-authentication-success-mfacompleted failed-app-login ↳azure-azuremfa-json-app-login-fail-errorvalidatingcreds ↳azure-azuremfa-json-app-login-mfa-expired	T1078 - Valid Accounts	2 Rules