2_ds_microsoft_microsoft_intune.md

April 15, 2026 · View on GitHub

Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Compromised Credentialsapp-activity
↳microsoft-azuremon-json-app-activity-success-devices
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices
T1078 - Valid Accounts
T1133 - External Remote Services
  • 39 Rules
  • 24 Models
Data Accessapp-activity
↳microsoft-azuremon-json-app-activity-success-devices
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices
T1078 - Valid Accounts
  • 19 Rules
  • 11 Models
Data Leakapp-activity
↳microsoft-azuremon-json-app-activity-success-devices
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices
T1114 - Email Collection
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Privilege Abuseapp-activity
↳microsoft-azuremon-json-app-activity-success-devices
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices

app-activity-failed
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices
T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 6 Rules
  • 2 Models
Privilege Escalationapp-activity
↳microsoft-azuremon-json-app-activity-success-devices
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Privileged Activityapp-activity
↳microsoft-azuremon-json-app-activity-success-devices
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices

app-activity-failed
↳microsoft-azuremon-json-app-activity-success-compliance
↳microsoft-azuremon-json-app-activity-success-devicecompliance
↳microsoft-intune-json-app-activity-auditlogs
↳microsoft-intune-json-app-activity-devices
T1078 - Valid Accounts
  • 2 Rules
  • 1 Models