Vendor: Microsoft

April 15, 2026 · View on GitHub

Product: Microsoft Entra

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
3011717
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Compromised Credentialssecurity-alert
microsoft-azureadip-json-alert-trigger-success-anonymouslogin
microsoft-azureadip-sk4-alert-trigger-success-maliciousip
microsoft-azureadip-mix-alert-trigger-success-unfamiliarlocation
microsoft-azureadip-json-alert-trigger-success-leakedcredentials
microsoft-azureadip-sk4-alert-trigger-success-passwordspray
microsoft-azureadip-sk4-alert-trigger-success-anomaloustoken
microsoft-azureadip-json-alert-trigger-success-anonymouslogin
microsoft-azureadip-sk4-alert-trigger-success-maliciousip
microsoft-azureadip-mix-alert-trigger-success-unfamiliarlocation
microsoft-azureadip-json-alert-trigger-success-leakedcredentials
microsoft-azureadip-sk4-alert-trigger-success-passwordspray
microsoft-azureadip-sk4-alert-trigger-success-anomaloustoken
microsoft-azureadip-json-alert-trigger-success-impossibletravel
T1027 - Obfuscated Files or Information
T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
  • 23 Rules
  • 9 Models
Lateral Movementsecurity-alert
microsoft-azureadip-json-alert-trigger-success-anonymouslogin
microsoft-azureadip-sk4-alert-trigger-success-maliciousip
microsoft-azureadip-mix-alert-trigger-success-unfamiliarlocation
microsoft-azureadip-json-alert-trigger-success-leakedcredentials
microsoft-azureadip-sk4-alert-trigger-success-passwordspray
microsoft-azureadip-sk4-alert-trigger-success-anomaloustoken
microsoft-azureadip-json-alert-trigger-success-anonymouslogin
microsoft-azureadip-sk4-alert-trigger-success-maliciousip
microsoft-azureadip-mix-alert-trigger-success-unfamiliarlocation
microsoft-azureadip-json-alert-trigger-success-leakedcredentials
microsoft-azureadip-sk4-alert-trigger-success-passwordspray
microsoft-azureadip-sk4-alert-trigger-success-anomaloustoken
microsoft-azureadip-json-alert-trigger-success-impossibletravel
T1027 - Obfuscated Files or Information
T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
  • 2 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Valid Accounts

Exploitation for Privilege Escalation

Obfuscated Files or Information: Indicator Removal from Tools

Valid Accounts

Obfuscated Files or Information