Vendor: Microsoft

Product: Microsoft Defender

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
879	279	180	40	169

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Abnormal Authentication & Access	account-creation ↳microsoft-defenderep-json-user-create-success-useraccountcreated account-disabled ↳microsoft-defenderep-json-user-disable-success-accountdisabled account-enabled ↳microsoft-defenderep-json-user-enable-success-accountenabled account-password-change ↳microsoft-defenderep-json-user-password-modify-success-passwordchanged app-activity ↳microsoft-defenderep-str-endpoint-scan-fail-scanstopped ↳microsoft-defenderep-json-process-token-modify-success-processprimarytokenmodified ↳microsoft-defenderep-cef-process-token-modify-processprimarytokenmodified ↳microsoft-defenderep-xml-report-create-success-1151 ↳microsoft-defenderep-json-app-activity-success-clrunbackedmoduleloaded ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-file-success-advancedhuntingdevicefileevents ↳microsoft-defenderep-json-script-execute-success-scriptcontent ↳microsoft-defenderep-json-network-notification-advancedhunting ↳microsoft-defenderep-cef-network-notification-advancedhunting ↳microsoft-defenderep-json-group-modify-success-groupmembershipchanged ↳microsoft-windows-cef-endpoint-login-device ↳microsoft-defenderep-json-scheduled-task-delete-success-scheduledtaskdeleted ↳microsoft-defenderep-cef-scheduled-task-delete-scheduledtaskdeleted ↳microsoft-defenderep-xml-endpoint-activity-success-eventid ↳microsoft-defenderep-kv-endpoint-activity-deviceevents ↳microsoft-defenderep-sk4-endpoint-screenshot-screenshottaken ↳microsoft-defenderep-json-clipboard-read-getclipboarddata ↳microsoft-defenderep-sk4-clipboard-read-getclipboarddata ↳microsoft-defenderep-str-endpoint-scan-scanfinished ↳microsoft-defenderep-xml-endpoint-scan-success-1001 ↳microsoft-defenderep-xml-endpoint-scan-success-1002 ↳microsoft-defenderep-json-endpoint-scan-antivirusscan ↳microsoft-defenderep-str-endpoint-scan-scanhasstarted ↳microsoft-defenderep-kv-endpoint-scan-updated ↳microsoft-defenderep-xml-endpoint-scan-success-1000 ↳microsoft-defenderep-kv-endpoint-scan-success-scanstarted ↳microsoft-defenderep-cef-endpoint-scan-antivirusscan ↳microsoft-defenderep-str-app-notification-upandrunning ↳microsoft-defenderep-str-app-notification-clienthealthreport ↳microsoft-defenderep-str-app-notification-stateupdated ↳microsoft-defenderep-str-app-notification-avsignatureupdated ↳microsoft-defenderep-str-app-notification-versionupdated ↳microsoft-defenderep-kv-app-notification-scanfinished ↳microsoft-defenderep-str-app-notification-versionupdated-1 ↳microsoft-defenderep-str-app-notification-encounterederror ↳microsoft-defenderep-xml-app-notification-success-1150 ↳microsoft-defenderep-str-app-notification-removedhistory ↳microsoft-defenderep-sk4-driver-load-driverload ↳microsoft-defenderep-json-driver-load-success-driverload ↳microsoft-defenderep-sk4-alert-trigger-acgenforced ↳microsoft-defenderep-sk4-alert-trigger-antivirusreport ↳microsoft-defenderep-json-alert-trigger-antivirusreport ↳microsoft-defenderep-sk4-alert-trigger-theftblocked ↳microsoft-defenderep-json-endpoint-notification-pnpdeviceconnected ↳microsoft-defenderep-json-endpoint-notification-deviceinfo ↳microsoft-defenderep-sk4-alert-trigger-childprocessaudited ↳microsoft-defenderep-json-alert-trigger-success-childprocessaudited ↳microsoft-defenderep-cef-endpoint-notification-deviceconnected ↳microsoft-defenderep-json-endpoint-notification-success-devicefilecertificateinfo ↳microsoft-defenderep-json-process-pipe-create-success-namedpipeevent ↳microsoft-defenderep-cef-link-create-shelllinkcreatefileevent ↳microsoft-defenderep-json-link-create-success-shelllinkcreatefileevent ↳microsoft-defenderep-json-process-open-success-apicall ↳microsoft-defenderep-cef-process-open-apicall ↳microsoft-defenderep-cef-process-thread-create-remotethreadapicall ↳microsoft-defenderep-json-process-thread-create-success-remotethreadapicall ↳microsoft-defenderep-json-process-memory-read-readprocessmemoryapicall ↳microsoft-defenderep-cef-process-memory-read-readprocessmemoryapicall ↳microsoft-defenderep-json-app-notification-success-emailpostdeliveryevent ↳microsoft-defenderep-json-endpoint-activity-success-identityqueryevents ↳microsoft-defenderep-json-endpoint-activity-success-deviceevents ↳microsoft-defenderep-sk4-endpoint-activity-deviceevents ↳microsoft-365defender-json-endpoint-activity-success-publish-identityinfo ↳microsoft-defenderep-json-peripheral_storage-remove-success-usbdriveunmounted ↳microsoft-defenderep-json-process-memory-protect-success-ntprotectvirtualmemory ↳microsoft-defenderep-json-mailbox-item-delete-success-emailpostdeliveryeventsdelete ↳microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication ↳microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication authentication-failed ↳microsoft-defenderep-json-endpoint-login-identitylogonevents ↳microsoft-windows-cef-endpoint-login-device authentication-successful ↳microsoft-defenderep-kv-endpoint-login-devicelogonevents ↳microsoft-defenderep-json-endpoint-login-identitylogonevents ↳microsoft-windows-cef-endpoint-login-device failed-logon ↳microsoft-defenderep-cef-endpoint-login-service ↳microsoft-defenderep-cef-endpoint-login-remoteinteractive ↳microsoft-defenderep-cef-endpoint-login-network ↳microsoft-defenderep-cef-endpoint-login-interactive ↳microsoft-defenderep-cef-endpoint-login-batch local-logon ↳microsoft-defenderep-cef-endpoint-login-interactive member-added ↳microsoft-defenderep-json-group-member-add-success-useraccountadded ↳microsoft-azure-kv-group-member-add-success-eventhubbeat member-removed ↳microsoft-defenderep-json-group-member-remove-success-useraccountremoved ↳microsoft-azure-kv-group-member-remove-success-deviceevents remote-access ↳microsoft-defenderep-cef-endpoint-login-network remote-logon ↳microsoft-defenderep-json-rdp-traffic-success ↳microsoft-azure-csv-rdp-traffic-success-vmid ↳microsoft-defenderep-cef-endpoint-login-remoteinteractive web-activity-allowed ↳microsoft-defenderep-json-http-request-success-browserlaunchedtoopenurl ↳microsoft-defenderep-sk4-http-request-browserlaunched ↳microsoft-defenderep-json-http-session-success-urlclickevents web-activity-denied ↳microsoft-defenderep-json-http-session-success-urlclickevents	T1021 - Remote Services T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1110 - Brute Force T1133 - External Remote Services	55 Rules 26 Models
Account Manipulation	account-creation ↳microsoft-defenderep-json-user-create-success-useraccountcreated account-password-change ↳microsoft-defenderep-json-user-password-modify-success-passwordchanged app-activity ↳microsoft-defenderep-str-endpoint-scan-fail-scanstopped ↳microsoft-defenderep-json-process-token-modify-success-processprimarytokenmodified ↳microsoft-defenderep-cef-process-token-modify-processprimarytokenmodified ↳microsoft-defenderep-xml-report-create-success-1151 ↳microsoft-defenderep-json-app-activity-success-clrunbackedmoduleloaded ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo ↳microsoft-defenderep-json-file-success-advancedhuntingdevicefileevents ↳microsoft-defenderep-json-script-execute-success-scriptcontent ↳microsoft-defenderep-json-network-notification-advancedhunting ↳microsoft-defenderep-cef-network-notification-advancedhunting ↳microsoft-defenderep-json-group-modify-success-groupmembershipchanged ↳microsoft-windows-cef-endpoint-login-device ↳microsoft-defenderep-json-scheduled-task-delete-success-scheduledtaskdeleted ↳microsoft-defenderep-cef-scheduled-task-delete-scheduledtaskdeleted ↳microsoft-defenderep-xml-endpoint-activity-success-eventid ↳microsoft-defenderep-kv-endpoint-activity-deviceevents ↳microsoft-defenderep-sk4-endpoint-screenshot-screenshottaken ↳microsoft-defenderep-json-clipboard-read-getclipboarddata ↳microsoft-defenderep-sk4-clipboard-read-getclipboarddata ↳microsoft-defenderep-str-endpoint-scan-scanfinished ↳microsoft-defenderep-xml-endpoint-scan-success-1001 ↳microsoft-defenderep-xml-endpoint-scan-success-1002 ↳microsoft-defenderep-json-endpoint-scan-antivirusscan ↳microsoft-defenderep-str-endpoint-scan-scanhasstarted ↳microsoft-defenderep-kv-endpoint-scan-updated ↳microsoft-defenderep-xml-endpoint-scan-success-1000 ↳microsoft-defenderep-kv-endpoint-scan-success-scanstarted ↳microsoft-defenderep-cef-endpoint-scan-antivirusscan ↳microsoft-defenderep-str-app-notification-upandrunning ↳microsoft-defenderep-str-app-notification-clienthealthreport ↳microsoft-defenderep-str-app-notification-stateupdated ↳microsoft-defenderep-str-app-notification-avsignatureupdated ↳microsoft-defenderep-str-app-notification-versionupdated ↳microsoft-defenderep-kv-app-notification-scanfinished ↳microsoft-defenderep-str-app-notification-versionupdated-1 ↳microsoft-defenderep-str-app-notification-encounterederror ↳microsoft-defenderep-xml-app-notification-success-1150 ↳microsoft-defenderep-str-app-notification-removedhistory ↳microsoft-defenderep-sk4-driver-load-driverload ↳microsoft-defenderep-json-driver-load-success-driverload ↳microsoft-defenderep-sk4-alert-trigger-acgenforced ↳microsoft-defenderep-sk4-alert-trigger-antivirusreport ↳microsoft-defenderep-json-alert-trigger-antivirusreport ↳microsoft-defenderep-sk4-alert-trigger-theftblocked ↳microsoft-defenderep-json-endpoint-notification-pnpdeviceconnected ↳microsoft-defenderep-json-endpoint-notification-deviceinfo ↳microsoft-defenderep-sk4-alert-trigger-childprocessaudited ↳microsoft-defenderep-json-alert-trigger-success-childprocessaudited ↳microsoft-defenderep-cef-endpoint-notification-deviceconnected ↳microsoft-defenderep-json-endpoint-notification-success-devicefilecertificateinfo ↳microsoft-defenderep-json-process-pipe-create-success-namedpipeevent ↳microsoft-defenderep-cef-link-create-shelllinkcreatefileevent ↳microsoft-defenderep-json-link-create-success-shelllinkcreatefileevent ↳microsoft-defenderep-json-process-open-success-apicall ↳microsoft-defenderep-cef-process-open-apicall ↳microsoft-defenderep-cef-process-thread-create-remotethreadapicall ↳microsoft-defenderep-json-process-thread-create-success-remotethreadapicall ↳microsoft-defenderep-json-process-memory-read-readprocessmemoryapicall ↳microsoft-defenderep-cef-process-memory-read-readprocessmemoryapicall ↳microsoft-defenderep-json-app-notification-success-emailpostdeliveryevent ↳microsoft-defenderep-json-endpoint-activity-success-identityqueryevents ↳microsoft-defenderep-json-endpoint-activity-success-deviceevents ↳microsoft-defenderep-sk4-endpoint-activity-deviceevents ↳microsoft-365defender-json-endpoint-activity-success-publish-identityinfo ↳microsoft-defenderep-json-peripheral_storage-remove-success-usbdriveunmounted ↳microsoft-defenderep-json-process-memory-protect-success-ntprotectvirtualmemory ↳microsoft-defenderep-json-mailbox-item-delete-success-emailpostdeliveryeventsdelete ↳microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication ↳microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication ds-access ↳microsoft-defenderep-sk4-ds-object-read-ldapsearch ↳microsoft-defenderep-json-ds-object-read-success-ldapsearch member-added ↳microsoft-defenderep-json-group-member-add-success-useraccountadded ↳microsoft-azure-kv-group-member-add-success-eventhubbeat member-removed ↳microsoft-defenderep-json-group-member-remove-success-useraccountremoved ↳microsoft-azure-kv-group-member-remove-success-deviceevents process-created ↳microsoft-defenderep-cef-process-create-success-processcreated ↳microsoft-defenderep-sk4-process-create-success-processcreated ↳microsoft-windows-cef-process-create-success-process ↳microsoft-defenderep-cef-process-memory-allocate-advancedhunting ↳microsoft-defenderep-json-process-memory-allocate-success-ntallocatevirtualmemory ↳microsoft-defenderep-cef-process-memory-allocate-advancedhunting-1 ↳microsoft-defenderep-cef-script-execute-powershellcommand ↳microsoft-defenderep-json-script-execute-success-powershellcommand ↳microsoft-defenderep-json-process-create-success-processcreatedusingwmiquery ↳microsoft-defenderep-sk4-process-create-success-deviceprocessevents ↳microsoft-azure-kv-process-create-success-powershellcommand	T1003 - OS Credential Dumping T1003.003 - T1003.003 T1021 - Remote Services T1021.003 - T1021.003 T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1207 - Rogue Domain Controller T1218 - Signed Binary Proxy Execution T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1484 - Group Policy Modification T1531 - Account Access Removal T1559 - Inter-Process Communication T1559.002 - T1559.002	90 Rules 41 Models
Destruction of Data	file-delete ↳microsoft-defenderep-cef-file-devicefileevents ↳microsoft-defenderep-json-file-success-advancedhuntingdevicefileevents	T1070 - Indicator Removal on Host T1070.004 - Indicator Removal on Host: File Deletion T1485 - Data Destruction	1 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Phishing: Spearphishing Link External Remote Services Valid Accounts Drive-by Compromise Exploit Public Fasing Application Replication Through Removable Media Phishing	Windows Management Instrumentation Command and Scripting Interperter Scheduled Task/Job Inter-Process Communication System Services Exploitation for Client Execution User Execution Scheduled Task/Job: Scheduled Task Command and Scripting Interperter: PowerShell Software Deployment Tools Scheduled Task/Job: At (Windows)	Pre-OS Boot Create Account Create or Modify System Process External Remote Services Valid Accounts Hijack Execution Flow Server Software Component: Web Shell Account Manipulation BITS Jobs Create or Modify System Process: Windows Service Scheduled Task/Job Server Software Component Event Triggered Execution Boot or Logon Autostart Execution Create Account: Create: Local Account Account Manipulation: Exchange Email Delegate Permissions	Access Token Manipulation: Token Impersonation/Theft Create or Modify System Process Valid Accounts Access Token Manipulation Exploitation for Privilege Escalation Hijack Execution Flow Group Policy Modification Process Injection Scheduled Task/Job Abuse Elevation Control Mechanism Event Triggered Execution Boot or Logon Autostart Execution Process Injection: Dynamic-link Library Injection Abuse Elevation Control Mechanism: Bypass User Account Control	Hide Artifacts Indirect Command Execution Impair Defenses Indicator Removal on Host: Clear Windows Event Logs Group Policy Modification Rogue Domain Controller Trusted Developer Utilities Proxy Execution Masquerading: Match Legitimate Name or Location Masquerading: Rename System Utilities File and Directory Permissions Modification: Windows File and Directory Permissions Modification Obfuscated Files or Information: Compile After Delivery Obfuscated Files or Information: Indicator Removal from Tools Hijack Execution Flow: DLL Side-Loading Indicator Removal on Host: File Deletion Masquerading Valid Accounts Modify Registry BITS Jobs Use Alternate Authentication Material Hide Artifacts: NTFS File Attributes Use Alternate Authentication Material: Pass the Hash Indicator Removal on Host Use Alternate Authentication Material: Pass the Ticket Pre-OS Boot File and Directory Permissions Modification Deobfuscate/Decode Files or Information Abuse Elevation Control Mechanism Impair Defenses: Disable or Modify System Firewall Obfuscated Files or Information Signed Binary Proxy Execution: Compiled HTML File Access Token Manipulation Hijack Execution Flow Process Injection Valid Accounts: Local Accounts Signed Binary Proxy Execution: Msiexec Signed Binary Proxy Execution Signed Binary Proxy Execution: Regsvcs/Regasm Signed Binary Proxy Execution: CMSTP Signed Binary Proxy Execution: Control Panel Signed Binary Proxy Execution: InstallUtil Signed Binary Proxy Execution: Regsvr32 Trusted Developer Utilities Proxy Execution: MSBuild Signed Binary Proxy Execution: Rundll32	OS Credential Dumping Unsecured Credentials Brute Force Steal or Forge Kerberos Tickets Credentials from Password Stores Steal or Forge Kerberos Tickets: Kerberoasting OS Credential Dumping: DCSync Network Sniffing	Account Discovery Domain Trust Discovery System Service Discovery System Network Connections Discovery Account Discovery: Local Account Account Discovery: Domain Account File and Directory Discovery Network Sniffing System Information Discovery Network Share Discovery Query Registry Process Discovery System Owner/User Discovery Software Discovery Remote System Discovery System Network Configuration Discovery	Exploitation of Remote Services Remote Service Session Hijacking Remote Services Remote Services: SMB/Windows Admin Shares Use Alternate Authentication Material Remote Services: Remote Desktop Protocol Software Deployment Tools Replication Through Removable Media Internal Spearphishing	Screen Capture Data from Information Repositories Email Collection Audio Capture Archive Collected Data Email Collection: Email Forwarding Rule	Web Service Protocol Tunneling Application Layer Protocol: DNS Application Layer Protocol: File Transfer Protocols Application Layer Protocol: Web Protocols Remote Access Software Dynamic Resolution Ingress Tool Transfer Dynamic Resolution: Domain Generation Algorithms Proxy: Multi-hop Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Over Physical Medium: Exfiltration over USB Exfiltration Over C2 Channel Exfiltration Over Physical Medium Automated Exfiltration Exfiltration Over Web Service: Exfiltration to Cloud Storage Exfiltration Over Web Service	Account Access Removal Data Destruction Resource Hijacking Data Encrypted for Impact Inhibit System Recovery