Vendor: Microsoft

April 15, 2026 · View on GitHub

Product: Microsoft Defender

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
87927918040169
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessaccount-creation
microsoft-defenderep-json-user-create-success-useraccountcreated

account-disabled
microsoft-defenderep-json-user-disable-success-accountdisabled

account-enabled
microsoft-defenderep-json-user-enable-success-accountenabled

account-password-change
microsoft-defenderep-json-user-password-modify-success-passwordchanged

app-activity
microsoft-defenderep-str-endpoint-scan-fail-scanstopped
microsoft-defenderep-json-process-token-modify-success-processprimarytokenmodified
microsoft-defenderep-cef-process-token-modify-processprimarytokenmodified
microsoft-defenderep-xml-report-create-success-1151
microsoft-defenderep-json-app-activity-success-clrunbackedmoduleloaded
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-file-success-advancedhuntingdevicefileevents
microsoft-defenderep-json-script-execute-success-scriptcontent
microsoft-defenderep-json-network-notification-advancedhunting
microsoft-defenderep-cef-network-notification-advancedhunting
microsoft-defenderep-json-group-modify-success-groupmembershipchanged
microsoft-windows-cef-endpoint-login-device
microsoft-defenderep-json-scheduled-task-delete-success-scheduledtaskdeleted
microsoft-defenderep-cef-scheduled-task-delete-scheduledtaskdeleted
microsoft-defenderep-xml-endpoint-activity-success-eventid
microsoft-defenderep-kv-endpoint-activity-deviceevents
microsoft-defenderep-sk4-endpoint-screenshot-screenshottaken
microsoft-defenderep-json-clipboard-read-getclipboarddata
microsoft-defenderep-sk4-clipboard-read-getclipboarddata
microsoft-defenderep-str-endpoint-scan-scanfinished
microsoft-defenderep-xml-endpoint-scan-success-1001
microsoft-defenderep-xml-endpoint-scan-success-1002
microsoft-defenderep-json-endpoint-scan-antivirusscan
microsoft-defenderep-str-endpoint-scan-scanhasstarted
microsoft-defenderep-kv-endpoint-scan-updated
microsoft-defenderep-xml-endpoint-scan-success-1000
microsoft-defenderep-kv-endpoint-scan-success-scanstarted
microsoft-defenderep-cef-endpoint-scan-antivirusscan
microsoft-defenderep-str-app-notification-upandrunning
microsoft-defenderep-str-app-notification-clienthealthreport
microsoft-defenderep-str-app-notification-stateupdated
microsoft-defenderep-str-app-notification-avsignatureupdated
microsoft-defenderep-str-app-notification-versionupdated
microsoft-defenderep-kv-app-notification-scanfinished
microsoft-defenderep-str-app-notification-versionupdated-1
microsoft-defenderep-str-app-notification-encounterederror
microsoft-defenderep-xml-app-notification-success-1150
microsoft-defenderep-str-app-notification-removedhistory
microsoft-defenderep-sk4-driver-load-driverload
microsoft-defenderep-json-driver-load-success-driverload
microsoft-defenderep-sk4-alert-trigger-acgenforced
microsoft-defenderep-sk4-alert-trigger-antivirusreport
microsoft-defenderep-json-alert-trigger-antivirusreport
microsoft-defenderep-sk4-alert-trigger-theftblocked
microsoft-defenderep-json-endpoint-notification-pnpdeviceconnected
microsoft-defenderep-json-endpoint-notification-deviceinfo
microsoft-defenderep-sk4-alert-trigger-childprocessaudited
microsoft-defenderep-json-alert-trigger-success-childprocessaudited
microsoft-defenderep-cef-endpoint-notification-deviceconnected
microsoft-defenderep-json-endpoint-notification-success-devicefilecertificateinfo
microsoft-defenderep-json-process-pipe-create-success-namedpipeevent
microsoft-defenderep-cef-link-create-shelllinkcreatefileevent
microsoft-defenderep-json-link-create-success-shelllinkcreatefileevent
microsoft-defenderep-json-process-open-success-apicall
microsoft-defenderep-cef-process-open-apicall
microsoft-defenderep-cef-process-thread-create-remotethreadapicall
microsoft-defenderep-json-process-thread-create-success-remotethreadapicall
microsoft-defenderep-json-process-memory-read-readprocessmemoryapicall
microsoft-defenderep-cef-process-memory-read-readprocessmemoryapicall
microsoft-defenderep-json-app-notification-success-emailpostdeliveryevent
microsoft-defenderep-json-endpoint-activity-success-identityqueryevents
microsoft-defenderep-json-endpoint-activity-success-deviceevents
microsoft-defenderep-sk4-endpoint-activity-deviceevents
microsoft-365defender-json-endpoint-activity-success-publish-identityinfo
microsoft-defenderep-json-peripheral_storage-remove-success-usbdriveunmounted
microsoft-defenderep-json-process-memory-protect-success-ntprotectvirtualmemory
microsoft-defenderep-json-mailbox-item-delete-success-emailpostdeliveryeventsdelete
microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication
microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication

authentication-failed
microsoft-defenderep-json-endpoint-login-identitylogonevents
microsoft-windows-cef-endpoint-login-device

authentication-successful
microsoft-defenderep-kv-endpoint-login-devicelogonevents
microsoft-defenderep-json-endpoint-login-identitylogonevents
microsoft-windows-cef-endpoint-login-device

failed-logon
microsoft-defenderep-cef-endpoint-login-service
microsoft-defenderep-cef-endpoint-login-remoteinteractive
microsoft-defenderep-cef-endpoint-login-network
microsoft-defenderep-cef-endpoint-login-interactive
microsoft-defenderep-cef-endpoint-login-batch

local-logon
microsoft-defenderep-cef-endpoint-login-interactive

member-added
microsoft-defenderep-json-group-member-add-success-useraccountadded
microsoft-azure-kv-group-member-add-success-eventhubbeat

member-removed
microsoft-defenderep-json-group-member-remove-success-useraccountremoved
microsoft-azure-kv-group-member-remove-success-deviceevents

remote-access
microsoft-defenderep-cef-endpoint-login-network

remote-logon
microsoft-defenderep-json-rdp-traffic-success
microsoft-azure-csv-rdp-traffic-success-vmid
microsoft-defenderep-cef-endpoint-login-remoteinteractive

web-activity-allowed
microsoft-defenderep-json-http-request-success-browserlaunchedtoopenurl
microsoft-defenderep-sk4-http-request-browserlaunched
microsoft-defenderep-json-http-session-success-urlclickevents

web-activity-denied
microsoft-defenderep-json-http-session-success-urlclickevents
T1021 - Remote Services
T1071 - Application Layer Protocol
T1071.001 - Application Layer Protocol: Web Protocols
T1078 - Valid Accounts
T1078.002 - T1078.002
T1078.003 - Valid Accounts: Local Accounts
T1110 - Brute Force
T1133 - External Remote Services
  • 55 Rules
  • 26 Models
Account Manipulationaccount-creation
microsoft-defenderep-json-user-create-success-useraccountcreated

account-password-change
microsoft-defenderep-json-user-password-modify-success-passwordchanged

app-activity
microsoft-defenderep-str-endpoint-scan-fail-scanstopped
microsoft-defenderep-json-process-token-modify-success-processprimarytokenmodified
microsoft-defenderep-cef-process-token-modify-processprimarytokenmodified
microsoft-defenderep-xml-report-create-success-1151
microsoft-defenderep-json-app-activity-success-clrunbackedmoduleloaded
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-endpoint-notification-advancehuntingdevinfo
microsoft-defenderep-json-file-success-advancedhuntingdevicefileevents
microsoft-defenderep-json-script-execute-success-scriptcontent
microsoft-defenderep-json-network-notification-advancedhunting
microsoft-defenderep-cef-network-notification-advancedhunting
microsoft-defenderep-json-group-modify-success-groupmembershipchanged
microsoft-windows-cef-endpoint-login-device
microsoft-defenderep-json-scheduled-task-delete-success-scheduledtaskdeleted
microsoft-defenderep-cef-scheduled-task-delete-scheduledtaskdeleted
microsoft-defenderep-xml-endpoint-activity-success-eventid
microsoft-defenderep-kv-endpoint-activity-deviceevents
microsoft-defenderep-sk4-endpoint-screenshot-screenshottaken
microsoft-defenderep-json-clipboard-read-getclipboarddata
microsoft-defenderep-sk4-clipboard-read-getclipboarddata
microsoft-defenderep-str-endpoint-scan-scanfinished
microsoft-defenderep-xml-endpoint-scan-success-1001
microsoft-defenderep-xml-endpoint-scan-success-1002
microsoft-defenderep-json-endpoint-scan-antivirusscan
microsoft-defenderep-str-endpoint-scan-scanhasstarted
microsoft-defenderep-kv-endpoint-scan-updated
microsoft-defenderep-xml-endpoint-scan-success-1000
microsoft-defenderep-kv-endpoint-scan-success-scanstarted
microsoft-defenderep-cef-endpoint-scan-antivirusscan
microsoft-defenderep-str-app-notification-upandrunning
microsoft-defenderep-str-app-notification-clienthealthreport
microsoft-defenderep-str-app-notification-stateupdated
microsoft-defenderep-str-app-notification-avsignatureupdated
microsoft-defenderep-str-app-notification-versionupdated
microsoft-defenderep-kv-app-notification-scanfinished
microsoft-defenderep-str-app-notification-versionupdated-1
microsoft-defenderep-str-app-notification-encounterederror
microsoft-defenderep-xml-app-notification-success-1150
microsoft-defenderep-str-app-notification-removedhistory
microsoft-defenderep-sk4-driver-load-driverload
microsoft-defenderep-json-driver-load-success-driverload
microsoft-defenderep-sk4-alert-trigger-acgenforced
microsoft-defenderep-sk4-alert-trigger-antivirusreport
microsoft-defenderep-json-alert-trigger-antivirusreport
microsoft-defenderep-sk4-alert-trigger-theftblocked
microsoft-defenderep-json-endpoint-notification-pnpdeviceconnected
microsoft-defenderep-json-endpoint-notification-deviceinfo
microsoft-defenderep-sk4-alert-trigger-childprocessaudited
microsoft-defenderep-json-alert-trigger-success-childprocessaudited
microsoft-defenderep-cef-endpoint-notification-deviceconnected
microsoft-defenderep-json-endpoint-notification-success-devicefilecertificateinfo
microsoft-defenderep-json-process-pipe-create-success-namedpipeevent
microsoft-defenderep-cef-link-create-shelllinkcreatefileevent
microsoft-defenderep-json-link-create-success-shelllinkcreatefileevent
microsoft-defenderep-json-process-open-success-apicall
microsoft-defenderep-cef-process-open-apicall
microsoft-defenderep-cef-process-thread-create-remotethreadapicall
microsoft-defenderep-json-process-thread-create-success-remotethreadapicall
microsoft-defenderep-json-process-memory-read-readprocessmemoryapicall
microsoft-defenderep-cef-process-memory-read-readprocessmemoryapicall
microsoft-defenderep-json-app-notification-success-emailpostdeliveryevent
microsoft-defenderep-json-endpoint-activity-success-identityqueryevents
microsoft-defenderep-json-endpoint-activity-success-deviceevents
microsoft-defenderep-sk4-endpoint-activity-deviceevents
microsoft-365defender-json-endpoint-activity-success-publish-identityinfo
microsoft-defenderep-json-peripheral_storage-remove-success-usbdriveunmounted
microsoft-defenderep-json-process-memory-protect-success-ntprotectvirtualmemory
microsoft-defenderep-json-mailbox-item-delete-success-emailpostdeliveryeventsdelete
microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication
microsoft-defenderep-json-endpoint-activity-success-directoryservicesreplication

ds-access
microsoft-defenderep-sk4-ds-object-read-ldapsearch
microsoft-defenderep-json-ds-object-read-success-ldapsearch

member-added
microsoft-defenderep-json-group-member-add-success-useraccountadded
microsoft-azure-kv-group-member-add-success-eventhubbeat

member-removed
microsoft-defenderep-json-group-member-remove-success-useraccountremoved
microsoft-azure-kv-group-member-remove-success-deviceevents

process-created
microsoft-defenderep-cef-process-create-success-processcreated
microsoft-defenderep-sk4-process-create-success-processcreated
microsoft-windows-cef-process-create-success-process
microsoft-defenderep-cef-process-memory-allocate-advancedhunting
microsoft-defenderep-json-process-memory-allocate-success-ntallocatevirtualmemory
microsoft-defenderep-cef-process-memory-allocate-advancedhunting-1
microsoft-defenderep-cef-script-execute-powershellcommand
microsoft-defenderep-json-script-execute-success-powershellcommand
microsoft-defenderep-json-process-create-success-processcreatedusingwmiquery
microsoft-defenderep-sk4-process-create-success-deviceprocessevents
microsoft-azure-kv-process-create-success-powershellcommand
T1003 - OS Credential Dumping
T1003.003 - T1003.003
T1021 - Remote Services
T1021.003 - T1021.003
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1059.003 - T1059.003
T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1136.001 - Create Account: Create: Local Account
T1136.002 - T1136.002
T1207 - Rogue Domain Controller
T1218 - Signed Binary Proxy Execution
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1484 - Group Policy Modification
T1531 - Account Access Removal
T1559 - Inter-Process Communication
T1559.002 - T1559.002
  • 90 Rules
  • 41 Models
Destruction of Datafile-delete
microsoft-defenderep-cef-file-devicefileevents
microsoft-defenderep-json-file-success-advancedhuntingdevicefileevents
T1070 - Indicator Removal on Host
T1070.004 - Indicator Removal on Host: File Deletion
T1485 - Data Destruction
  • 1 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Phishing: Spearphishing Link

External Remote Services

Valid Accounts

Drive-by Compromise

Exploit Public Fasing Application

Replication Through Removable Media

Phishing

Windows Management Instrumentation

Command and Scripting Interperter

Scheduled Task/Job

Inter-Process Communication

System Services

Exploitation for Client Execution

User Execution

Scheduled Task/Job: Scheduled Task

Command and Scripting Interperter: PowerShell

Software Deployment Tools

Scheduled Task/Job: At (Windows)

Pre-OS Boot

Create Account

Create or Modify System Process

External Remote Services

Valid Accounts

Hijack Execution Flow

Server Software Component: Web Shell

Account Manipulation

BITS Jobs

Create or Modify System Process: Windows Service

Scheduled Task/Job

Server Software Component

Event Triggered Execution

Boot or Logon Autostart Execution

Create Account: Create: Local Account

Account Manipulation: Exchange Email Delegate Permissions

Access Token Manipulation: Token Impersonation/Theft

Create or Modify System Process

Valid Accounts

Access Token Manipulation

Exploitation for Privilege Escalation

Hijack Execution Flow

Group Policy Modification

Process Injection

Scheduled Task/Job

Abuse Elevation Control Mechanism

Event Triggered Execution

Boot or Logon Autostart Execution

Process Injection: Dynamic-link Library Injection

Abuse Elevation Control Mechanism: Bypass User Account Control

Hide Artifacts

Indirect Command Execution

Impair Defenses

Indicator Removal on Host: Clear Windows Event Logs

Group Policy Modification

Rogue Domain Controller

Trusted Developer Utilities Proxy Execution

Masquerading: Match Legitimate Name or Location

Masquerading: Rename System Utilities

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Obfuscated Files or Information: Compile After Delivery

Obfuscated Files or Information: Indicator Removal from Tools

Hijack Execution Flow: DLL Side-Loading

Indicator Removal on Host: File Deletion

Masquerading

Valid Accounts

Modify Registry

BITS Jobs

Use Alternate Authentication Material

Hide Artifacts: NTFS File Attributes

Use Alternate Authentication Material: Pass the Hash

Indicator Removal on Host

Use Alternate Authentication Material: Pass the Ticket

Pre-OS Boot

File and Directory Permissions Modification

Deobfuscate/Decode Files or Information

Abuse Elevation Control Mechanism

Impair Defenses: Disable or Modify System Firewall

Obfuscated Files or Information

Signed Binary Proxy Execution: Compiled HTML File

Access Token Manipulation

Hijack Execution Flow

Process Injection

Valid Accounts: Local Accounts

Signed Binary Proxy Execution: Msiexec

Signed Binary Proxy Execution

Signed Binary Proxy Execution: Regsvcs/Regasm

Signed Binary Proxy Execution: CMSTP

Signed Binary Proxy Execution: Control Panel

Signed Binary Proxy Execution: InstallUtil

Signed Binary Proxy Execution: Regsvr32

Trusted Developer Utilities Proxy Execution: MSBuild

Signed Binary Proxy Execution: Rundll32

OS Credential Dumping

Unsecured Credentials

Brute Force

Steal or Forge Kerberos Tickets

Credentials from Password Stores

Steal or Forge Kerberos Tickets: Kerberoasting

OS Credential Dumping: DCSync

Network Sniffing

Account Discovery

Domain Trust Discovery

System Service Discovery

System Network Connections Discovery

Account Discovery: Local Account

Account Discovery: Domain Account

File and Directory Discovery

Network Sniffing

System Information Discovery

Network Share Discovery

Query Registry

Process Discovery

System Owner/User Discovery

Software Discovery

Remote System Discovery

System Network Configuration Discovery

Exploitation of Remote Services

Remote Service Session Hijacking

Remote Services

Remote Services: SMB/Windows Admin Shares

Use Alternate Authentication Material

Remote Services: Remote Desktop Protocol

Software Deployment Tools

Replication Through Removable Media

Internal Spearphishing

Screen Capture

Data from Information Repositories

Email Collection

Audio Capture

Archive Collected Data

Email Collection: Email Forwarding Rule

Web Service

Protocol Tunneling

Application Layer Protocol: DNS

Application Layer Protocol: File Transfer Protocols

Application Layer Protocol: Web Protocols

Remote Access Software

Dynamic Resolution

Ingress Tool Transfer

Dynamic Resolution: Domain Generation Algorithms

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy

Exfiltration Over Alternative Protocol

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Exfiltration Over Physical Medium: Exfiltration over USB

Exfiltration Over C2 Channel

Exfiltration Over Physical Medium

Automated Exfiltration

Exfiltration Over Web Service: Exfiltration to Cloud Storage

Exfiltration Over Web Service

Account Access Removal

Data Destruction

Resource Hijacking

Data Encrypted for Impact

Inhibit System Recovery