mapping_objects: - attack_object_id: T1036 attack_object_name: Masquerading capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal to partial coverage of a minority of this technique's sub-techniques and a minority of its procedure examples, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1003 attack_object_name: OS Credential Dumping capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1003.001 attack_object_name: LSASS Memory capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which contains an implementation of Mimikatz to gather credentials from memory, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1003 score_category: detect score_value: minimal - attack_object_id: T1016 attack_object_name: System Network Configuration Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can acquire network configuration information including DNS servers and network proxies used by a host, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1016.001 attack_object_name: Internet Connection Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel's ability to detect entities scanning the network configuration also covers the scanning of internet connections, providing a detection mechanism against this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1016 score_category: detect score_value: minimal - attack_object_id: T1018 attack_object_name: Remote System Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "High reverse DNS count by host" and "Squid malformed requests" queries can indicate potentially malicious reconnaissance aimed at detecting network layout and the presence of network security devices. The Microsoft Sentinel Analytics "Several deny actions registered" query can identify patterns in Azure Firewall incidents, potentially indicating that an adversary is scanning resources on the network, at a default frequency of once per hour. Note that detection only occurs if the firewall prevents the scanning. The Microsoft Sentinel Analytics "Rare client observed with high reverse DNS lookup count" query can detect when a particular IP address performs an unusually high number of reverse DNS lookups and has not been observed doing so previously. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1021 attack_object_name: Remote Services capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal to partial coverage for some of this technique's sub-techniques, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1021.001 attack_object_name: Remote Desktop Protocol capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "anomalous RDP Activity" query can detect potential lateral movement employing RDP. The following Microsoft Sentinel Analytics queries can identify potentially malicious use of RDP: "Anomalous RDP Login Detections", "Multiple RDP connections from Single Systems", "Rare RDP Connections", and "RDP Nesting".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.002 attack_object_name: SMB/Windows Admin Shares capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Anomalous Resource Access" query can identify potential lateral movement via use of valid accounts to access network shares (Windows Event 4624:3). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1021 score_category: detect score_value: minimal - attack_object_id: T1021.003 attack_object_name: Distributed Component Object Model capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can utilize Invoke-DCOM to leverage remote COM execution for lateral movement, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1021 score_category: detect score_value: minimal - attack_object_id: T1021.004 attack_object_name: SSH capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which contains modules for executing commands over SSH as well as in-memory VNC agent injection, but does not address other procedures. Microsoft Sentinel Analytics also provides a "New internet-exposed SSH endpoints" query. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1021 score_category: detect score_value: minimal - attack_object_id: T1027 attack_object_name: Obfuscated Files or Information capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can obfuscate commands using Invoke-Obfuscation, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1036.004 attack_object_name: Masquerade Task or Service capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Exes with double file extension and access summary" can identify malicious executable files that have been hidden as other file types. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1036 score_category: detect score_value: minimal - attack_object_id: T1036.005 attack_object_name: Match Legitimate Name or Location capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Masquerading Files" and "Rare Process Path" queries can detect an adversary attempting to make malicious activity blend in with legitimate commands and files. The Microsoft Sentinel Hunting "Azure DevOps Display Name Changes" query can detect potentially maliicous changes to the DevOps user display name. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1036 score_category: detect score_value: partial - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can be used to conduct packet capture on target hosts, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1041 attack_object_name: Exfiltration Over C2 Channel capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can send data gathered from a target through a command and control channel, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting?tabs=azure-portal score_category: detect score_value: minimal - attack_object_id: T1046 attack_object_name: Network Service Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "High count of connections by client IP on many ports" query can detect when a given client IP has 30 or more ports used within a 10 minute window, which may indicate malicious scanning. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect scanning via Empire, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting?tabs=azure-portal score_category: detect score_value: partial - attack_object_id: T1047 attack_object_name: Windows Management Instrumentation capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Analytics "Gain Code Execution on ADFS Server via Remote WMI Execution" query can detect use of Windows Managemement Instrumentation on ADFS servers. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect WMI use via Empire, but does not address other procedures. The coverage for these queries is minimal (specific to ADFS and Empire) resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting?tabs=azure-portal score_category: detect score_value: minimal - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal coverage for a minority of this technique's sub-techniques and does not cover all procedure examples, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting?tabs=azure-portal score_category: detect score_value: minimal - attack_object_id: T1048.003 attack_object_name: Exfiltration Over Unencrypted Non-C2 Protocol capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential exfiltration: "Abnormally long DNS URI queries" can identify potential exfiltration via DNS. "Multiple users email forwarded to same destination" and "Office Mail Forwarding - Hunting Version" can detect potential exfiltration via email. The Microsoft Sentinel Analytics "Multiple users email forwarded to same destination" query can detect potential exfiltration via email. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting?tabs=azure-portal related_score: T1048 score_category: detect score_value: minimal - attack_object_id: T1049 attack_object_name: System Network Connections Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate the current network connections of a host, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1053 attack_object_name: Scheduled Task/Job capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal to partial coverage of a minority of this technique's sub-techniques, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1053.003 attack_object_name: Cron capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Editing Linux scheduled tasks through Crontab" query can detect potentially malicious modification of cron jobs. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1053.005 attack_object_name: Scheduled Task capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can interact with the Windows task scheduler, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1053 score_category: detect score_value: minimal - attack_object_id: T1055 attack_object_name: Process Injection capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which contains multiple modules for injecting into processes, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1056 attack_object_name: Input Capture capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify two of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1056.001 attack_object_name: Keylogging capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which includes keylogging capabilities for both Windows and Linux and contains modules that leverage API hooking to carry out tasks, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1056 score_category: detect score_value: minimal - attack_object_id: T1056.004 attack_object_name: Credential API Hooking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which includes keylogging capabilities for both Windows and Linux and contains modules that leverage API hooking to carry out tasks, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1056 score_category: detect score_value: minimal - attack_object_id: T1057 attack_object_name: Process Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can find information about processes running on local and remote systems, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1059 attack_object_name: Command and Scripting Interpreter capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control provides minimal coverage for most of this technique''s sub-techniques, along with additional mappings for its procedure examples, resulting in an overall score of Minimal. The following Microsoft Sentinel Hunting queries can identify potentially malicious use of command and scripting interpreters that does not map directly to one/more sub-techniques: "Anomalous Code Execution" can identifyanomalous runCommand operations on virtual machines, "Azure CloudShell Usage" can identify potentially malicious use of CloudShell, "New processes observed in last 24 hours", "Rare processes run by Service accounts", and "Rare Custom Script Extension" can identify execution outliers that may suggest misuse. The following Microsoft Sentinel Analytics queries can identify potentially malicious use of command and scripting interpreters that does not map directly to one/more sub-techniques: "New CloudShell User" can identify potentially malicious use of CloudShell, "Rare and Potentially high-risk Office operations" can identify specific rare mailbox-related ccount and permission changes via execution.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1059.001 attack_object_name: PowerShell capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can identify use of Empire, which leverages PowerShell for the majority of its client-side agent tasks and can conduct PowerShell remoting. The coverage for these queries is minimal (specific to Empire) resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1059.003 attack_object_name: Windows Command Shell capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Cscript script daily summary breakdown" can detect potentially malicious scripting. The Microsoft Sentinel Hunting "Hosts running a rare process with commandline" query can identify uncommon command shell usage that may be malicious. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can identify use of Empire, which has modules for executing Windows Command Shell scripts. The Microsoft Sentinel Analytics "Base64 encoded Windows process command-lines" query can identify Base64 encoded PE files being launched via the command line.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1059.004 attack_object_name: Unix Shell capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Rare process running on a Linux host" query can identify uncommon shell usage that may be malicious. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1059.005 attack_object_name: Visual Basic capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Cscript script daily summary breakdown" can detect potentially malicious scripting. The Microsoft Sentinel Hunting "Hosts running a rare process with commandline" query can identify uncommon command shell usage that may be malicious. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1059.006 attack_object_name: Python capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Cscript script daily summary breakdown" can detect potentially malicious scripting. The Microsoft Sentinel Hunting "Hosts running a rare process with commandline" query can identify uncommon command shell usage that may be malicious. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1059.007 attack_object_name: JavaScript capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Cscript script daily summary breakdown" can detect potentially malicious scripting. The Microsoft Sentinel Hunting "Hosts running a rare process with commandline" query can identify uncommon command shell usage that may be malicious. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can exploit known system vulnerabilities, but does not explicitly address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=azure-portal - https://learn.microsoft.com/en-us/azure/sentinel/hunting?tabs=azure-portal score_category: detect score_value: minimal - attack_object_id: T1069 attack_object_name: Permission Groups Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal coverage for one of this technique's sub-techniques and only minimal coverage for its procedure examples, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1069.001 attack_object_name: Local Groups capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Enumeration of users and groups" query can identify potentially malicious group discovery through the use of the net tool. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1069 score_category: detect score_value: minimal - attack_object_id: T1069.002 attack_object_name: Domain Groups capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Enumeration of users and groups" query can identify potentially malicious group discovery through the use of the net tool. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1069 score_category: detect score_value: minimal - attack_object_id: T1070 attack_object_name: Indicator Removal capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control provides specific minimal coverage for two of this technique''s sub-techniques, without additional coverage of its procedure examples, resulting in an overall score of Minimal. The Microsoft Sentinel Analytics "Azure DevOps Agent Pool Created Then Deleted" query can detect specific suspicious activity for DevOps Agent Pool. This is close to this technique''s File Deletion sub-technique, but not a complete match.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1070.001 attack_object_name: Clear Windows Event Logs capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Security Event Log Cleared" query can detect clearing of the security event logs, though not necessarily clearing of any arbitrary Windows event logs. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1070 score_category: detect score_value: minimal - attack_object_id: T1070.006 attack_object_name: Timestomp capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Windows System Time changed on hosts" query can detect potential timestomping activities. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can identify use of Empire, which can timestomp files and/or payloads on a target machine to help them blend in.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1070 score_category: detect score_value: minimal - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Analytics "Malformed user agent" query can detect potential C2 or C2 agent activity. This control provides minimal to partial coverage for a minority of this technique''s sub-techniques and only some of its procedure examples, resulting in an overall score of Minimal.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1071.001 attack_object_name: Web Protocols capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Analytics queries can identify potentially malicious use of web protocols: "Powershell Empire cmdlets seen in command line" can identify use of Empire, which can perform command and control over protocols like HTTP and HTTPS. "Request for single resource on domain" can identify patterns that suggest possible command and control beaconing. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1071 score_category: detect score_value: minimal - attack_object_id: T1071.004 attack_object_name: DNS capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious use of DNS: "RareDNSLookupWithDataTransfer" [sic] can identify data transfer over DNS, though it is contingent on DNS traffic meeting the requirements to be considered rare. "Abnormally Long DNS URI queries" can identify suspicious DNS queries that may be indicative of command and control operations. "DNS - domain anomalous lookup increase", "DNS Full Name anomalous lookup increase", and "DNS lookups for commonly abused TLDs" can identify increases in domain lookups for a client IP and indicate malicious traffic or exfiltration of sensitive data.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1074 attack_object_name: Data Staged capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1074.001 attack_object_name: Local Data Staging capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Malware in the recycle bin" query can detect local hidden malware. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1074 score_category: detect score_value: minimal - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides partial coverage for all of this technique's sub-techniques and a number of its procedures, resulting in an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: partial - attack_object_id: T1078.001 attack_object_name: Default Accounts capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Rare processes run by Service accounts" query can identify potential misuse of default accounts. Because this detection is specific to rare processes its coverage score is Minimal resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1078 score_category: detect score_value: minimal - attack_object_id: T1078.002 attack_object_name: Domain Accounts capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential compromise of domain accounts based on access attempts and/or account usage: "Suspicious Windows Login outside normal hours", "User account added or removed from security group by an unauthorized user", "User Account added to Built in Domain Local or Global Group", "User Login IP Address Teleportation", "User made Owner of multiple teams", "Tracking Privileged Account Rare Activity", "New Admin account activity which was not seen historically", "New client running queries", "New users running queries", "Non-owner mailbox login activity", "Powershell or non-browser mailbox login activity", "Rare User Agent strings", "Same IP address with multiple csUserAgent" which may indicate that an account is being used from a new device, "Rare domains seen in Cloud Logs" when accounts from uncommon domains access or attempt to access cloud resources, "Same User - Successful logon for a given App and failure on another App within 1m and low distribution", "Hosts with new logons", "Inactive or new account signins", "Long lookback User Account Created and Deleted within 10mins", "Anomalous Geo Location Logon", and "Anomalous Sign-in Activity". The following Microsoft Sentinel Analytics queries can identify potential compromise of domain accounts based on access attempts and/or account usage: "Anomalous User Agent connection attempt", "New UserAgent observed in last 24 hours" which may indicate that an account is being used from a new device, "Anomalous sign-in location by user account and authenticating application", "Anomalous login followed by Teams action", "GitHub Signin Burst from Multiple Locations", "Sign-ins from IPs that attempt sign-ins to disabled accounts", "Failed Host logons but success logon to AzureAD", and "Anomalous RDP Login Detections".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1078 score_category: detect score_value: partial - attack_object_id: T1078.003 attack_object_name: Local Accounts capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential compromise of local accounts based on access attempts and/or account usage: "Suspicious Windows Login outside normal hours", "User Login IP Address Teleportation", "User account added or removed from a security group by an unauthorized user", "User Account added to Built in Domain Local or Global Group", "User added to SQL Server SecurityAdmin Group", "User Role altered on SQL Server", "User made Owner of multiple teams", "Tracking Privileged Account Rare Activity", and "Anomalous Login to Devices". The following Microsoft Sentinel Analytics queries can identify potential compromise of local accounts based on access attempts and/or account usage: "User account enabled and disabled within 10 mins", "Long lookback User Account Created and Deleted within 10mins", "Explicit MFA Deny", "Hosts with new logons", "Inactive or new account signins", "Anomalous SSH Login Detection", and "Anomalous RDP Login Detections".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1078 score_category: detect score_value: partial - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential compromise of cloud accounts: "New Admin account activity which was not seen historically", "New client running queries", "New users running queries", "User returning more data than daily average", "User Login IP Address Teleportation", "Non-owner mailbox login activity", "Powershell or non-browser mailbox login activity", "Rare User Agent strings" and "Same IP address with multiple csUserAgent" which may indicate that an account is being used from a new device, "Rare domains seen in Cloud Logs", "Same User - Successful logon for a given App and failure on another App within 1m and low distribution", "Anomalous Azure Active Directory Apps based on authentication location", "Anomalous Geo Location Logon", "Anomalous Sign-in Activity", "Azure Active Directory sign-in burst from multiple locations", and "Azure Active Directory signins from new locations". The following Microsoft Sentinel Analytics queries can identify potential compromise of cloud accounts: "Anomalous User Agent connection attempt" and "New UserAgent observed in last 24 hours", which may indicate that an account is being used from a new device which may belong to an adversary; "Anomalous sign-in location by user account and authenticating application", "GitHub Signin Burst from Multiple Locations", "GitHub Activites from a New Country", and "Sign-ins from IPs that attempt sign-ins to disabled accounts", which may indicate adversary access from atypical locations; "Azure Active Directory PowerShell accessing non-AAD resources", "Anomalous login followed by Teams action", "Login to AWS management console without MFA", and "Azure Active Directory PowerShell accessing non-AAD resources" which may indicate an adversary attempting to use a valid account to access resources from other contexts. The "Correlate Unfamiliar sign-in properties" query can further enhance detection of anomalous activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1078 score_category: detect score_value: partial - attack_object_id: T1080 attack_object_name: Taint Shared Content capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Analytics "Potential Build Process Compromise" query can detect when source code files have been modified immediately after the build process has started. The Microsoft Sentinel Analytics "ADO Build Variable Modified by New User" query may indicate malicious modification to the build process to taint shared content. The coverage for these queries is minimal (specific to Azure DevOps) resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1082 attack_object_name: System Information Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate host information like OS, architecture, applied patches, etc., but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1083 attack_object_name: File and Directory Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which includes modules for finding files of interest on hosts and network shares, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1087 attack_object_name: Account Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides specific forms of minimal coverage for half of this technique's sub-techniques, but does not address other procedures, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1087.001 attack_object_name: Local Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Enumeration of users and groups" query can identify potentially malicious account discovery through the use of the net tool. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can acquire local and domain user account information, but does not address other procedures.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1087 score_category: detect score_value: minimal - attack_object_id: T1087.002 attack_object_name: Domain Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Enumeration of users and groups" query can identify potentially malicious account discovery through the use of the net tool. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can acquire local and domain user account information, but does not address other procedures.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1087 score_category: detect score_value: minimal - attack_object_id: T1087.003 attack_object_name: Email Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Mail.Read Permissions Granted to Application" query can identify applications that may have been abused to gain access to mailboxes. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1087 score_category: detect score_value: minimal - attack_object_id: T1090 attack_object_name: Proxy capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal coverage for one sub-technique of this technique, resulting in an overall coverage score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1090.003 attack_object_name: Multi-hop Proxy capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "DNS events related to ToR proxies" query can identify potential use of Tor, though it provides only minimal coverage because it only covers a set of common domains and is easily bypassed via hardcoded IP addresses, redirection, etc. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1090 score_category: detect score_value: minimal - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious manipulation of accounts to increase or maintain access: "Azure DevOps - Guest users access enabled", "Azure DevOps - Additional Org Admin added", "Anomalous Activity Role Assignment", "Anomalous Role Assignment", and "Anomalous AAD Account Manipulation", which indicate expansion of accounts'' access/privileges; "Bots added to multiple teams" which indicates workspace access granted to automated accounts. The following Microsoft Sentinel Analytics queries can identify potentially malicious manipulation of accounts to increase or maintain access: "Suspicious granting of permissions to an account" from a previously unobserved IP address, "External user added and removed in short timeframe" for Teams resources, "Account added and removed from privileged group", "User account added to built in domain local or global group", and "New user created and added to the built-in administrator group". "Multiple Password Reset by user" can detect potentially malicious iterative password resets.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1098.001 attack_object_name: Additional Cloud Credentials capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "First access credential added to Application or Service Principal where no credential was present" query can identify potentially malicious changes to Service Principal credentials. The Microsoft Sentinel Analytics "Credential added after admin consented to Application" and "New access credential added to Application or Service Principal" queries can identify potentially malicious manipulation of additional cloud credentials.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1098 score_category: detect score_value: minimal - attack_object_id: T1102 attack_object_name: Web Service capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1102.002 attack_object_name: Bidirectional Communication capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use Dropbox and GitHub for command and control, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1102 score_category: detect score_value: minimal - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Crypto currency miners EXECVE" query can detect cryptocurrency mining software downloads through EXECVE. The following Microsoft Sentinel Analytics queries can identify potentiall malicious tool transfer: "Linked Malicious Storage Artifacts" may identify potential adversary tool downloads that are missed by anti-malware. "Powershell Empire cmdlets seen in command line" detects downloads via Empire. "New executable via Office FileUploaded Operations" can identify ingress of malicious code and attacker tools to Office services such as SharePoint and OneDrive, but with potential for high false positive rates from normal user upload activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: partial - attack_object_id: T1106 attack_object_name: Native API capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which includes a variety of enumeration modules that have an option to use API calls to carry out tasks, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control includes partial detection coverage for most of this technique's sub-techniques on a periodic basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: partial - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The "Summary of user logons by logon type" Microsoft Sentinel Hunting query compares successful and unsuccessful logon attempts to identify potential lateral movement. The following Microsoft Sentinel Hunting queries can identify potential attempts at credential brute force based on unsuccessful attempts: "VIP account more than 6 failed logons in 10", "Multiple Failed Logon on SQL Server in Short time Span", "Permutations on logon attempts by UserPrincipalNames indicating potential brute force", "Potential IIS brute force", "Failed attempt to access Azure Portal", "Failed Login Attempt by Expired account", "Failed Logon Attempts on SQL Server", "Failed Logon on SQL Server from Same IPAddress in Short time Span", "Failed service logon attempt by user account with available AuditData", "Login attempt by Blocked MFA user", "Login spike with increase failure rate", "Attempts to sign-in to disabled accounts by IP address", "Attempts to sign-in to disabled accounts by account name", "Brute Force attack against Azure Portal", and "Anomalous Failed Logon" The following Microsoft Sentinel Analytics queries can identify potential attempts at credential brute force based on unsuccessful attempts: "Brute force attack against Azure Portal", "Password spray attack against Azure AD application", "Successful logon from IP and failure from a different IP", "Failed logon attempts in authpriv", "Failed AzureAD logons but success logon to host", "Excessive Windows logon failures", "Failed login attempts to Azure Portal", "Failed logon attempts by valid accounts within 10 mins", "Brute Force Attack against GitHub Account", "Distributed Password cracking attempts in AzureAD", "Potential Password Spray Attack" based on periodic assessment of Azure Active Directory sign-in events and Okta console logins, "Attempts to sign in to disabled accounts", "Sign-ins from IPs that attempt sign-ins to disabled accounts", "High count of failed logins by a user", "Hi count of failed attempts same client IP", "SSH - Potential Brute Force", and "SecurityEvent - Multiple authentication failures followed by success".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1110 score_category: detect score_value: partial - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The "Summary of user logons by logon type" Microsoft Sentinel Hunting query compares successful and unsuccessful logon attempts to identify potential lateral movement. The following Microsoft Sentinel Hunting queries can identify potential attempts at credential brute force based on unsuccessful attempts: "VIP account more than 6 failed logons in 10", "Multiple Failed Logon on SQL Server in Short time Span", "Permutations on logon attempts by UserPrincipalNames indicating potential brute force", "Potential IIS brute force", "Failed attempt to access Azure Portal", "Failed Login Attempt by Expired account", "Failed Logon Attempts on SQL Server", "Failed Logon on SQL Server from Same IPAddress in Short time Span", "Failed service logon attempt by user account with available AuditData", "Login attempt by Blocked MFA user", "Login spike with increase failure rate", "Attempts to sign-in to disabled accounts by IP address", "Attempts to sign-in to disabled accounts by account name", "Brute Force attack against Azure Portal", and "Anomalous Failed Logon" The following Microsoft Sentinel Analytics queries can identify potential attempts at credential brute force based on unsuccessful attempts: "Brute force attack against Azure Portal", "Password spray attack against Azure AD application", "Successful logon from IP and failure from a different IP", "Failed logon attempts in authpriv", "Failed AzureAD logons but success logon to host", "Excessive Windows logon failures", "Failed login attempts to Azure Portal", "Failed logon attempts by valid accounts within 10 mins", "Brute Force Attack against GitHub Account", "Distributed Password cracking attempts in AzureAD", "Potential Password Spray Attack" based on periodic assessment of Azure Active Directory sign-in events and Okta console logins, "Attempts to sign in to disabled accounts", "Sign-ins from IPs that attempt sign-ins to disabled accounts", "High count of failed logins by a user", "Hi count of failed attempts same client IP", "SSH - Potential Brute Force", and "SecurityEvent - Multiple authentication failures followed by success".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1110 score_category: detect score_value: partial - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The "Summary of user logons by logon type" Microsoft Sentinel Hunting query compares successful and unsuccessful logon attempts to identify potential lateral movement. The following Microsoft Sentinel Hunting queries can identify potential attempts at credential brute force based on unsuccessful attempts: "VIP account more than 6 failed logons in 10", "Multiple Failed Logon on SQL Server in Short time Span", "Permutations on logon attempts by UserPrincipalNames indicating potential brute force", "Potential IIS brute force", "Failed attempt to access Azure Portal", "Failed Login Attempt by Expired account", "Failed Logon Attempts on SQL Server", "Failed Logon on SQL Server from Same IPAddress in Short time Span", "Failed service logon attempt by user account with available AuditData", "Login attempt by Blocked MFA user", "Login spike with increase failure rate", "Attempts to sign-in to disabled accounts by IP address", "Attempts to sign-in to disabled accounts by account name", "Brute Force attack against Azure Portal", and "Anomalous Failed Logon" The following Microsoft Sentinel Analytics queries can identify potential attempts at credential brute force based on unsuccessful attempts: "Brute force attack against Azure Portal", "Password spray attack against Azure AD application", "Successful logon from IP and failure from a different IP", "Failed logon attempts in authpriv", "Failed AzureAD logons but success logon to host", "Excessive Windows logon failures", "Failed login attempts to Azure Portal", "Failed logon attempts by valid accounts within 10 mins", "Brute Force Attack against GitHub Account", "Distributed Password cracking attempts in AzureAD", "Potential Password Spray Attack" based on periodic assessment of Azure Active Directory sign-in events and Okta console logins, "Attempts to sign in to disabled accounts", "Sign-ins from IPs that attempt sign-ins to disabled accounts", "High count of failed logins by a user", "Hi count of failed attempts same client IP", "SSH - Potential Brute Force", and "SecurityEvent - Multiple authentication failures followed by success".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1110 score_category: detect score_value: partial - attack_object_id: T1113 attack_object_name: Screen Capture capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can capture screenshots on Windows, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1114 attack_object_name: Email Collection capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal coverage for all of this technique's sub-techniques, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1114.001 attack_object_name: Local Email Collection capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can identify use of Empire, which has the ability to collect emails on a target system. The coverage for these queries is minimal (specific to Empire) resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1114 score_category: detect score_value: minimal - attack_object_id: T1114.002 attack_object_name: Remote Email Collection capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Suspect Mailbox Export on IIS/OWA" query can identify potential malicious exfiltration hosting via IIS. The Microsoft Sentinel Hunting "Host Exporting Mailbox and Removing Export" query can identify potential exfiltration of data from Exchange servers. The coverage for these queries is minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1114 score_category: detect score_value: minimal - attack_object_id: T1114.003 attack_object_name: Email Forwarding Rule capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Mail redirect via ExO transport rule" query can detect potentially malicious email redirection, but is limited to Exchange servers only. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1114 score_category: detect score_value: minimal - attack_object_id: T1115 attack_object_name: Clipboard Data capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can harvest clipboard data on Windows, but does not address other procedures or platforms. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1119 attack_object_name: Automated Collection capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious automated collection: "Multiple large queries made by user" and "Query data volume anomolies" can identify that automated queries are being used to collect data in bulk. "New ServicePrincipal running queries" can indicate that an application is performing automated collection via queries. The following Microsoft Sentinel Analytics queries can identify potentially malicious automated collection: "Mass secret retrieval from Azure Key Vault" and "Azure Key Vault access TimeSeries anomaly" can detect a sudden increase in access counts, which may indicate that an adversary is dumping credentials via automated methods. "Users searching for VIP user activity" can identify potentially suspicious Log Analytics queries by users looking for a listing of ''VIP'' activity. The coverage for these queries is minimal (applicable to specific technologies) resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1125 attack_object_name: Video Capture capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can capture webcam data on Windows, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1127 attack_object_name: Trusted Developer Utilities Proxy Execution capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1127.001 attack_object_name: MSBuild capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use abuse trusted utilities including MSBuild.exe, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1127 score_category: detect score_value: minimal - attack_object_id: T1134 attack_object_name: Access Token Manipulation capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control provides minimal coverage of a minority of this technique''s sub-techniques, but does not address other procedures, resulting in an overall score of Minimal. The Microsoft Sentinel Analytics "Azure DevOps Personal Access Token misuse" query can identify anomalous use of Personal Access Tokens, but does not map directly to any sub-techniques.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1134.002 attack_object_name: Create Process with Token capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can be used to make tokens via Invoke-RunAs and add a SID-History to a user if on a domain controller, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1134 score_category: detect score_value: minimal - attack_object_id: T1134.005 attack_object_name: SID-History Injection capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can be used to make tokens via Invoke-RunAs and add a SID-History to a user if on a domain controller, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1134 score_category: detect score_value: minimal - attack_object_id: T1135 attack_object_name: Network Share Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can perform port scans from an infected host, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1136 attack_object_name: Create Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides partial coverage for all of this technique's sub-techniques, resulting in an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: partial - attack_object_id: T1136.001 attack_object_name: Local Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "New User created on SQL Server" query can detect a specific type of potentially malicious local account creation. The following Microsoft Sentinel Analytics queries can identify potentially malicious local account creation: "Summary of users created using uncommon/undocumented commandline switches" which can identify use of the net command to create user accounts, "User created by unauthorized user", "User Granted Access and associated audit activity" and "User Granted Access and Grants others Access" which may identify account creation followed by suspicious behavior, "User account created and deleted within 10 mins" which suggests an account may have existed only long enough to fulfill a malicious purpose, and "Powershell Empire cmdlets seen in command line" which can identify use of Empire, including for account creation.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1136 score_category: detect score_value: partial - attack_object_id: T1136.002 attack_object_name: Domain Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Analytics queries can identify potentially malicious domain account creation: "Summary of users created using uncommon/undocumented commandline switches" which can identify use of the net command to create user accounts, "User created by unauthorized user", "User Granted Access and associated audit activity" and "User Granted Access and Grants others Access" which may identify account creation followed by suspicious behavior, "User account created and deleted within 10 mins" which suggests an account may have existed only long enough to fulfill a malicious purpose, and "Powershell Empire cmdlets seen in command line" which can identify use of Empire, including for account creation.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1136 score_category: detect score_value: partial - attack_object_id: T1136.003 attack_object_name: Cloud Account capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting queries can identify potentially malicious cloud account creation: "External user added and removed in short timeframe" and "External user from a new organisation added" can identify the addition of new external Teams user accounts. The following Microsoft Sentinel Analytics queries can identify potentially malicious cloud account creation: "User Granted Access and created resources" which identifies a newly created user account gaining access and creating resources in Azure, and "New Cloud Shell User".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1136 score_category: detect score_value: partial - attack_object_id: T1137 attack_object_name: Office Application Startup capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control only provides minimal to partial coverage for a minority of this technique''s sub-techniques and does not address all of its procedures, resulting in an overall score of Minimal.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1137.005 attack_object_name: Outlook Rules capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Analytics queries can identify potentially malicious use of Outlook rules: "Office policy tampering", "Malicious Inbox Rule" which can detect rules intended to delete emails that contain certain keywords (generally meant to warn compromised users about adversary behaviors), and "Mail redirect via ExO transport rule" (potentially to an adversary mailbox configured to collect mail).' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1137 score_category: detect score_value: partial - attack_object_id: T1137.006 attack_object_name: Add-ins capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Previously unseen bot or applicaiton added to Teams" [sic] query can detect the addition of a potentially malicious add-in, but is specific to Microsoft Teams. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1137 score_category: detect score_value: minimal - attack_object_id: T1140 attack_object_name: Deobfuscate/Decode Files or Information capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "New PowerShell Scripts encoded on the commandline" query can detect a specific type of obfuscated file. The Microsoft Sentinel Analytics "Process executed from binary hidden in Base64 encoded file" query can use security event searches to detect decoding by Python, bash/sh, and Ruby. The coverage for these queries is minimal (e.g. base64, PowerShell) resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Potential IIS code injection attempt" query can detect some potential injection attacks against public-facing applications. The Microsoft Sentinel Analytics "A potentially malicious web request was executed against a web server" query can detect a high ratio of blocked requests and unobstructed requests to a Web Application Firewall (WAF) for a given client IP and hostnam. The coverage for these queries is minimal (e.g. IIS) resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1195 attack_object_name: Supply Chain Compromise capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides partial coverage for one of this technique's sub-techniques, and its coverage is more for supply chain concerns of downstream consumers of software developed within the environemnt than the Azure environment itself, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1195.001 attack_object_name: Compromise Software Dependencies and Development Tools capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious changes to Azure DevOps project resources: "Azure DevOps - Project Visibility changed to public" can identify a specific action that may be an indicator of an attacker modifying the cloud compute infrastructure. "Azure DevOps - Public project created" and "Azure DevOps - Public project enabled by admin" can identify specific instances of potential defense evasion. The following Microsoft Sentinel Analytics queries can identify potentially malicious changes to Azure DevOps project resources: "AzureDevops Service Connection Abuse" can detect potential malicious behavior associated with use of large number of service connections, "External Upstream Source added to Azure DevOps" identifies a specific behavior that could compromise the DevOps build pipeline, "Azure DevOps Pull Request Policy Bypassing - History" can identify specific potentially malicious behavior that compromises the build process, "Azure DevOps Pipeline modified by a New User" identifies potentially malicious activity that could compromise the DevOps pipeline, "Azure DevOps Administrator Group Monitoring" monitors for specific activity which could compromise the build/release process, "New Agent Added to Pool by New User or a New OS" can detect a suspicious behavior that could potentially compromise DevOps pipeline.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1195 score_category: detect score_value: partial - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which includes built-in modules for exploiting remote SMB, JBoss, and Jenkins servers, but does not address other procedures. The Microsoft Sentinel Analytics "Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task" query can detect when an adversary gains execution capability on an ADFS server through SMB and Remote Service or Scheduled Task. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1213 attack_object_name: Data from Information Repositories capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control provides partial detection coverage for only this technique''s SharePoint sub-technique. The Microsoft Sentinel Hunting "Cross workspace query anomaly" query can identify potential adversary information collection (in this case from Azure ML workspaces), but does not map directly to any sub-techniques.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1213.002 attack_object_name: Sharepoint capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious access to SharePoint: "SharePointFileOperation via clientIP with previously unseen user agents", "SharePointFileOperation via devices with previously unseen user agents", and "SharePointFileOperation via previously unseen IPs". The Microsoft Sentinel Analytics "SharePointFileOperation via devices with previously unseen user agents" query can identify a high number of upload or download actions by an unknown and possible malicious actor.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1213 score_category: detect score_value: partial - attack_object_id: T1217 attack_object_name: Browser Information Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which has the ability to gather browser data including bookmarks and history, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1482 attack_object_name: Domain Trust Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate domain trusts, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1484 attack_object_name: Domain or Tenant Policy Modification capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal to partial coverage of both of this technique's sub-techniques, resulting in an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: partial - attack_object_id: T1484.001 attack_object_name: Group Policy Modification capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can modify group policy objects to install and execute malicious scheduled tasks, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1484 score_category: detect score_value: minimal - attack_object_id: T1484.002 attack_object_name: Trust Modification capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Modified Domain Federation Trust Settings" query can detect potentially malicious changes to domain trust settings. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1484 score_category: detect score_value: partial - attack_object_id: T1485 attack_object_name: Data Destruction capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Multiple Teams deleted by a single user" query can detect when a threshold is met for number of Teams deleted within an hour. Coverage is minimal because the control is limited to a specific resource (teams) and only works when the threshold is met. The Microsoft Sentinel Analytics "Multiple Teams deleted by a single user" query can detect when a threshold is met for number of Teams deleted within an hour. Coverage is minimal because the control is limited to a specific resource (teams) and only works when the threshold is met.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1486 attack_object_name: Data Encrypted for Impact capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Sensitive Azure Key Vault Operations" query can identify potential attacker activity intended to delete private key(s) required to decrypt content. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1490 attack_object_name: Inhibit System Recovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Sensitive Azure Key Vault Operations" query can identify potential attacker activity intended to interfere with backups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1496 attack_object_name: Resource Hijacking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential resource hijacking based on anomolies in access and usage patterns: "Anomalous Resource Creation and related Network Activity", "Creation of an anomalous number of resources". The following Microsoft Sentinel Analytis queries can identify potential resource hijacking: "Creation of Expensive Computes in Azure" and "Suspicious number of resource creation or deployed" [sic] can identify suspicious outliers in resource quantities requested. "Suspicious Resource deployment" can identify deployments from new, potentially malicious, users. "Process execution frequency anomaly" can identify execution that may indicate hijacking. "DNS events related to mining pools", can identify potential cryptocurrency mining activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: partial - attack_object_id: T1505 attack_object_name: Server Software Component capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides partial coverage for only one of this technique's sub-techniques, resulting in overall coverage of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1505.003 attack_object_name: Web Shell capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Web shell command alert enrichment", "Web shell Detection", and "Web shell file alert enrichment" queries can identify potentially malicious activity via web shell. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1505 score_category: detect score_value: partial - attack_object_id: T1518 attack_object_name: Software Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1518.001 attack_object_name: Security Software Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate antivirus software on the target, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1518 score_category: detect score_value: minimal - attack_object_id: T1528 attack_object_name: Steal Application Access Token capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Consent to Application discovery" query can identify recent permissions granted by a user to a particular app. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1530 attack_object_name: Data from Cloud Storage capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Anomalous Data Access" query identifies all users performing out-of-profile read operations regarding data or files, which may be indicative of adversarial collection from cloud storage objects. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1531 attack_object_name: Account Access Removal capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious behavior on user accounts: "AD Account Lockout", "Anomalous Password Reset", "SQL User deleted from Database", "User removed from SQL Server Roles", and "User removed from SQL Server SecurityAdmin Group". The Microsoft Sentinel Analytics "Sensitive Azure Key Vault operations" query can identify attempts to remove account access by deleting keys or entire key vaults.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1535 attack_object_name: Unused/Unsupported Cloud Regions capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Suspicious Resource deployment" query can identify adversary attempts to maintain persistence or evade defenses by leveraging unused and/or unmonitored resources. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1543 attack_object_name: Create or Modify System Process capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1543.003 attack_object_name: Windows Service capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can modify service binaries and restore them to their original states, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1543 score_category: detect score_value: minimal - attack_object_id: T1546 attack_object_name: Event Triggered Execution capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1546.008 attack_object_name: Accessibility Features capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can leverage WMI debugging to remotely replace binaries like seth.exe, utilman.exe, and magnify.exe with cmd.exe, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1546 score_category: detect score_value: minimal - attack_object_id: T1547 attack_object_name: Boot or Logon Autostart Execution capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify three of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1547.001 attack_object_name: Registry Run Keys / Startup Folder capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate SSPs, install malicious SSPs, persist by modifying .lnk files to include backdoors, and modify the registry run keys, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1547.005 attack_object_name: Security Support Provider capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate SSPs, install malicious SSPs, persist by modifying .lnk files to include backdoors, and modify the registry run keys, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1547.009 attack_object_name: Shortcut Modification capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate SSPs, install malicious SSPs, persist by modifying .lnk files to include backdoors, and modify the registry run keys, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1548 attack_object_name: Abuse Elevation Control Mechanism capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1548.002 attack_object_name: Bypass User Account Control capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which includes various modules to attempt to bypass UAC for privilege escalation, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1548 score_category: detect score_value: minimal - attack_object_id: T1550 attack_object_name: Use Alternate Authentication Material capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal coverage of half of this technique's sub-techniques, without additional coverage of procedure examples, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1550.001 attack_object_name: Application Access Token capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Azure DevOps - PAT used with Browser." query can identify potentially malicious usage of Personal Access Tokens intended for code or applications to be used through the web browser. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1550 score_category: detect score_value: minimal - attack_object_id: T1550.002 attack_object_name: Pass the Hash capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can perform pass the hash attacks, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1550 score_category: detect score_value: minimal - attack_object_id: T1552 attack_object_name: Unsecured Credentials capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal to partial coverage for a minority of this technique's sub-techniques, resulting in an overall detection score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1552.001 attack_object_name: Credentials In Files capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Query looking for secrets" query can identify potentially malicious database requests for secrets like passwords or other credentials. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use various modules to search for files containing passwords, but does not address other procedures. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1552 score_category: detect score_value: minimal - attack_object_id: T1552.004 attack_object_name: Private Keys capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Analytics "ADFS DKM Master Key Export" and "ADFS Key Export (Sysmon)" queries can detect potentially malicious access intended to decrypt access tokens. The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use modules to extract private key and session information, but does not address other procedures. The coverage for these queries is minimal (specific to Empire, ADFS) resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1552 score_category: detect score_value: minimal - attack_object_id: T1552.007 attack_object_name: Container API capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/microsoft-sentinel-security-baseline related_score: T1552 score_category: detect score_value: minimal - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1555.003 attack_object_name: Credentials from Web Browsers capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can extract passwords from common web browsers including Firefox and Chrome, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1555 score_category: detect score_value: minimal - attack_object_id: T1556 attack_object_name: Modify Authentication Process capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Azure DevOps Conditional Access Disabled" query can identify potentially malicious modifications of the DevOps access policy. The Microsoft Sentinel Analytics "MFA disabled for a user" and "GitHub Two Factor Auth Disable" queries can detect potentially malicious changes in multi-factor authentication settings.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1557 attack_object_name: Adversary-in-the-Middle capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1557.001 attack_object_name: LLMNR/NBT-NS Poisoning and SMB Relay capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1557 score_category: detect score_value: minimal - attack_object_id: T1558 attack_object_name: Steal or Forge Kerberos Tickets capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control only provides minimal to partial coverage for some this technique's sub-techniques, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1558.001 attack_object_name: Golden Ticket capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect execution of these sub-techniques via Empire, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1558 score_category: detect score_value: minimal - attack_object_id: T1558.002 attack_object_name: Silver Ticket capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect execution of these sub-techniques via Empire, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1558 score_category: detect score_value: minimal - attack_object_id: T1558.003 attack_object_name: Kerberoasting capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel Analytics includes a "Potential Kerberoasting" query. Kerberoasting via Empire can also be detected using the Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1558 score_category: detect score_value: partial - attack_object_id: T1560 attack_object_name: Archive Collected Data capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can ZIP directories on target systems, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1562 attack_object_name: Impair Defenses capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control provides minimal (mostly) to partial coverage for most of this technique''s sub-techniques, resulting in an overall score of Minimal. The Microsoft Sentinel Hunting "Anomalous Defensive Mechanism Modification" query detects users performing delete operations on security policies, which may indicate an adversary attempting to impair defenses.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1562.001 attack_object_name: Disable or Modify Tools capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious modifications to Sentinel resources: "Microsoft Sentinel Analytics Rules Administrative Operations", "Microsoft Sentinel Connectors Administrative Operations", and "Microsoft Sentinel Workbooks Administrative Operations". The Microsoft Sentinel Analytics "Starting or Stopping HealthService to Avoid Detection" query can detect potentially malicious disabling of telemetry collection/detection. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1562.002 attack_object_name: Disable Windows Event Logging capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Audit policy manipulation using auditpol utility" query can detect potentially malicious to modification and/or disabling of logging via the auditpol utility. The coverage for these queries is minimal (specific to Audit policy) resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1562.006 attack_object_name: Indicator Blocking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Microsoft Sentinel Analytics Rules Administrative Operations" query can identify potential attempts to impair defenses by changing or deleting detection analytics. The Microsoft Sentinel Analytics "Azure DevOps - Retention Reduced to Zero" query can identify that an adversary is looking to reduce their malicious activity''s footprint by preventing retention of artifacts. Control is specific to indicators produced by Azure DevOps. The coverage for these queries is minimal resulting in an overall Minimal score.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1562.007 attack_object_name: Disable or Modify Cloud Firewall capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potentially malicious modifications to cloud firewall resources: "Azure Network Security Group NSG Administrative Operations" query can identify potential defensive evasion involving changing or disabling network access rules. "Port opened for an Azure Resource" may indicate an adversary increasing the accessibility of a resource for easier collection/exfiltration. The Microsoft Sentinel Analytics "Security Service Registry ACL Modification" query can detect attempts to modify registry ACLs, potentially done to evade security solutions.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1562.008 attack_object_name: Disable or Modify Cloud Logs capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Exchange AuditLog disabled" query can detect potentially malicious disabling of Exchange logs. The Microsoft Sentinel Analytics "Azure DevOps Audit Stream Disabled" query can identify disabling of Azure DevOps log streaming. The coverage for these queries is minimal (specific to these technologies) resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1567 attack_object_name: Exfiltration Over Web Service capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'This control provides minimal coverage to both of this technique''s sub-techniques as well as some of its procedure examples, resulting in an overall score of Minimal. The Microsoft Sentinel Analytics "Malformed user agent" query can detect potential exfiltration over a web service by malicious code with a hard-coded user agent string, or possibly data encoded via the user agent string.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1567.001 attack_object_name: Exfiltration to Code Repository capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can identify use of Empire, which can use Dropbox and GitHub for data exfiltration. The Microsoft Sentinel Analytics "SharePointFileOperation via previously unseen IPs" can detect potential exfiltration activity via SharePoint. The coverage for these queries is minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1567 score_category: detect score_value: minimal - attack_object_id: T1567.002 attack_object_name: Exfiltration to Cloud Storage capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can identify use of Empire, which can use Dropbox and GitHub for data exfiltration. The Microsoft Sentinel Analytics "SharePointFileOperation via previously unseen IPs" can detect potential exfiltration activity via SharePoint. The coverage for these queries is minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1567 score_category: detect score_value: minimal - attack_object_id: T1568 attack_object_name: Dynamic Resolution capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control only provides partial coverage for one of this technique's sub-techniques, resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1568.002 attack_object_name: Domain Generation Algorithms capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Hunting "Potential DGA detected" query can detect clients with a high NXDomain count, which might indicate an adversary cycling through possible C2 domains where most C2s are not live. The following Microsoft Sentinel Analytics queries can identify potential use of domain generation algorithms: "Possible contact with a domain generated by a DGA" and "Potential DGA detected" within DNS.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1568 score_category: detect score_value: partial - attack_object_id: T1569 attack_object_name: System Services capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1569.002 attack_object_name: Service Execution capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can use PsExec to execute a payload on a remote host, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1569 score_category: detect score_value: minimal - attack_object_id: T1573 attack_object_name: Encrypted Channel capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control provides minimal coverage for one sub-technique of this technique, resulting in an overall coverage score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1573.002 attack_object_name: Asymmetric Cryptography capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Analytics queries can detect potentially malicious usage of asymmetric cryptography channels: "DNS events related to ToR proxies" can identify potential use of Tor, though it provides only minimal coverage because it only covers a set of common domains and is easily bypassed via hardcoded IP addresses, redirection, etc. "Powershell Empire cmdlets seen in command line" can identify use of Empire, which can use TLS to encrypt a command and control channel.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1573 score_category: detect score_value: minimal - attack_object_id: T1574 attack_object_name: Hijack Execution Flow capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control can identify several of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1574.001 attack_object_name: DLL Search Order Hijacking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can discover and exploit DLL hijacking opportunities, path interception opportunities in the PATH environment variable, search order hijacking vulnerabilities, and unquoted path vulnerabilities, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1574.007 attack_object_name: Path Interception by PATH Environment Variable capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can discover and exploit DLL hijacking opportunities, path interception opportunities in the PATH environment variable, search order hijacking vulnerabilities, and unquoted path vulnerabilities, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1574.008 attack_object_name: Path Interception by Search Order Hijacking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can discover and exploit DLL hijacking opportunities, path interception opportunities in the PATH environment variable, search order hijacking vulnerabilities, and unquoted path vulnerabilities, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1574.009 attack_object_name: Path Interception by Unquoted Path capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can discover and exploit DLL hijacking opportunities, path interception opportunities in the PATH environment variable, search order hijacking vulnerabilities, and unquoted path vulnerabilities, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1578 attack_object_name: Modify Cloud Compute Infrastructure capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Azure Resources assigned Public IP addresses" query detect suspicious IP address changes. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1580 attack_object_name: Cloud Infrastructure Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Hunting "Azure storage key enumeration" query can identify potential attempts by an attacker to discover cloud infrastructure resources. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1590 attack_object_name: Gather Victim Network Information capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: This control detects a highly specific behavior that applies to one sub-technique of this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1590.002 attack_object_name: DNS capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Rare client observed with high reverse DNS lookup count" query can detect if a particular IP is observed performing an unusually high number of reverse DNS lookups and has not been observed doing so previously. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1590 score_category: detect score_value: minimal - attack_object_id: T1595 attack_object_name: Active Scanning capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The Microsoft Sentinel Analytics "Malformed user agent" query can detect hard-coded user-agent strings associated with some vulnerability scanning tools. This control provides partial coverage for only one of this technique''s sub-techniques, resulting in an overall score of Minimal.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1595.002 attack_object_name: Vulnerability Scanning capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "High count of connections by client IP on many ports" query can identify client IP addresses with 30 or more active ports used within a ten minute window, checked at a default frequency of once per hour, which may indicate scanning. Note that false positives are probable based on changes in usage patterns and/or misconfiguration, and this detection only works if scanning is not spread out over a longer timespan. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1595 score_category: detect score_value: partial - attack_object_id: T1016.002 attack_object_name: Wi-Fi Discovery capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel's ability to detect entities scanning the network configuration also covers the scanning of Wi-Fi connections, providing a detection mechanism against this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1016 score_category: detect score_value: partial - attack_object_id: T1021.007 attack_object_name: Cloud Services capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can acquire network configuration information including DNS servers and network proxies used by a host, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.008 attack_object_name: Direct Cloud VM Connections capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can acquire network configuration information including DNS servers and network proxies used by a host, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1059.010 attack_object_name: AutoHotKey & AutoIT capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel can potentially detect the use of malicious code, including automation scripts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1059.011 attack_object_name: Lua capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel can potentially detect the use of malicious code, including Lua scripts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1070.010 attack_object_name: Relocate Malware capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel's ability to detect suspicious activity could detect malware relocation occurring on a system or network. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1070 score_category: detect score_value: minimal - attack_object_id: T1071.005 attack_object_name: Publish/Subscribe Protocols capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Microsoft Sentinel can ingest pub/sub logs to determine if pub/sub protocol channels have been used for malicious activity. However, these determinations are met using a set of threat detection rules, meaning that adversaries who are able to skirt those rules may not be detected, leading to a partial rating. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1496.001 attack_object_name: Compute Hijacking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential compute hijacking based on anomolies in access and usage patterns: "Anomalous Resource Creation and related Network Activity", "Creation of an anomalous number of resources". The following Microsoft Sentinel Analytis queries can identify potential resource hijacking: "Creation of Expensive Computes in Azure" and "Suspicious number of resource creation or deployed" [sic] can identify suspicious outliers in resource quantities requested. "Suspicious Resource deployment" can identify deployments from new, potentially malicious, users. "Process execution frequency anomaly" can identify execution that may indicate hijacking. "DNS events related to mining pools", can identify potential cryptocurrency mining activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1496.002 attack_object_name: Bandwidth Hijacking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential compute hijacking based on anomolies in access and usage patterns: "Anomalous Resource Creation and related Network Activity", "Creation of an anomalous number of resources". The following Microsoft Sentinel Analytis queries can identify potential resource hijacking: "Creation of Expensive Computes in Azure" and "Suspicious number of resource creation or deployed" [sic] can identify suspicious outliers in resource quantities requested. "Suspicious Resource deployment" can identify deployments from new, potentially malicious, users. "Process execution frequency anomaly" can identify execution that may indicate hijacking. "DNS events related to mining pools", can identify potential cryptocurrency mining activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1496.003 attack_object_name: SMS Pumping capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential compute hijacking based on anomolies in access and usage patterns: "Anomalous Resource Creation and related Network Activity", "Creation of an anomalous number of resources". The following Microsoft Sentinel Analytis queries can identify potential resource hijacking: "Creation of Expensive Computes in Azure" and "Suspicious number of resource creation or deployed" [sic] can identify suspicious outliers in resource quantities requested. "Suspicious Resource deployment" can identify deployments from new, potentially malicious, users. "Process execution frequency anomaly" can identify execution that may indicate hijacking. "DNS events related to mining pools", can identify potential cryptocurrency mining activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1496.004 attack_object_name: Cloud Service Hijacking capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: 'The following Microsoft Sentinel Hunting queries can identify potential resource hijacking based on anomolies in access and usage patterns: "Anomalous Resource Creation and related Network Activity", "Creation of an anomalous number of resources". The following Microsoft Sentinel Analytis queries can identify potential resource hijacking: "Creation of Expensive Computes in Azure" and "Suspicious number of resource creation or deployed" [sic] can identify suspicious outliers in resource quantities requested. "Suspicious Resource deployment" can identify deployments from new, potentially malicious, users. "Process execution frequency anomaly" can identify execution that may indicate hijacking. "DNS events related to mining pools", can identify potential cryptocurrency mining activity.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1543.005 attack_object_name: Container Service capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can modify service binaries and restore them to their original states, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1543 score_category: detect score_value: minimal - attack_object_id: T1547.013 attack_object_name: XDG Autostart Entries capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate SSPs, install malicious SSPs, persist by modifying .lnk files to include backdoors, and modify the registry run keys, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1547.014 attack_object_name: Active Setup capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate SSPs, install malicious SSPs, persist by modifying .lnk files to include backdoors, and modify the registry run keys, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1547.015 attack_object_name: Login Items capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate SSPs, install malicious SSPs, persist by modifying .lnk files to include backdoors, and modify the registry run keys, but does not address other procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1648 attack_object_name: Serverless Execution capability_description: Microsoft Sentinel capability_group: microsoft_sentinel capability_id: microsoft_sentinel comments: Integrating Azure Functions with Azure Monitor Logs and Microsoft Sentinel can provide insights into Serverless Execution activities and unusual Serverless function modifications. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/sentinel/overview - https://learn.microsoft.com/en-us/azure/sentinel/hunting score_category: detect score_value: minimal - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: 'This control may generate alerts based on unfamiliar or suspicious IP addresses, TOR exit node, and anonymous access. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction related_score: T1078 score_category: detect score_value: significant - attack_object_id: T1530 attack_object_name: Data from Cloud Storage capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: 'A variety of alerts may be generated by malicious access and enumeration of Azure Storage. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: detect score_value: significant - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: When a file is suspected to contain malware, Security Center displays an alert and can optionally email the storage owner for approval to delete the suspicious file. This delete response capability leads to a Response type of Eradication although it is specific to Azure Blob, Azure Files and Azure Data Lake Storage storage types resulting in an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: respond score_value: partial - attack_object_id: T1080 attack_object_name: Taint Shared Content capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: When a file is suspected to contain malware, Security Center displays an alert and can optionally email the storage owner for approval to delete the suspicious file. This delete response capability leads to a Response type of Eradication although it is specific to Azure Blob, Azure Files and Azure Data Lake Storage storage types resulting in an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: respond score_value: partial - attack_object_id: T1537 attack_object_name: Transfer Data to Cloud Account capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: This control may alert on unusually large amounts of data being extracted from Azure storage and suspicious access to storage accounts. There are no alerts specifically tied to data transfer between cloud accounts but there are several alerts for anomalous storage access and transfer. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: detect score_value: partial - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: This control may alert on upload of possible malware or executable and Azure Cloud Services Package files. These alerts are dependent on Microsoft threat intelligence and may not alert on novel or modified malware. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: detect score_value: partial - attack_object_id: T1080 attack_object_name: Taint Shared Content capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: This control may alert on upload of possible malware or executable and Azure Cloud Services Package files. These alerts are dependent on Microsoft threat intelligence and may not alert on novel or modified malware. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: detect score_value: partial - attack_object_id: T1485 attack_object_name: Data Destruction capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: This control may generate alerts when there has been an unusual or unexpected delete operation within Azure cloud storage. Alerts may not be generated by disabling of storage backups, versioning, or editing of storage objects. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: detect score_value: minimal - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: 'Microsoft Defender for Cloud: Defender for Storage' capability_group: defender_for_storage capability_id: defender_for_storage comments: This control provides minimal detection for its procedure examples. Additionally, it is able to detect only one of its sub-techniques (Cloud Accounts) resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurestorage score_category: detect score_value: minimal - attack_object_id: T1003 attack_object_name: OS Credential Dumping capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: Most credential dumping operations do not require modifying resources that can be detected by this control (i.e. Registry and File system) and therefore its coverage is minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: minimal - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect account manipulation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: minimal - attack_object_id: T1137 attack_object_name: Office Application Startup capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect peristence via office application startup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: minimal - attack_object_id: T1546.010 attack_object_name: AppInit DLLs capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'The detection score for this group of sub-techniques is assessed as Minimal due to the accuracy component of the score. The registry keys which are modified as a result of these sub-techniques can change frequently or are too numerous to monitor and therefore can result in significant amount of false positives. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: minimal - attack_object_id: T1546.015 attack_object_name: Component Object Model Hijacking capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'The detection score for this group of sub-techniques is assessed as Minimal due to the accuracy component of the score. The registry keys which are modified as a result of these sub-techniques can change frequently or are too numerous to monitor and therefore can result in significant amount of false positives. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: minimal - attack_object_id: T1548 attack_object_name: Abuse Elevation Control Mechanism capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect abuse of elevation control mechanisms. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: minimal - attack_object_id: T1548.002 attack_object_name: Bypass User Account Control capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: Some UAC bypass methods rely on modifying specific, user-accessible Registry settings that can be monitored using this control. Overall, there are numerous other bypass methods that do not result in Registry modification that this control will not be effective in detection resulting in a low detection coverage factor. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1548 score_category: detect score_value: minimal - attack_object_id: T1562 attack_object_name: Impair Defenses capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: Due to low detection coverage, this technique is scored as minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: minimal - attack_object_id: T1562.001 attack_object_name: Disable or Modify Tools capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can be used to monitor Registry keys related to security software or event logging processes that can detect when an adversary attempts to disable these tools via modifying or deleting Registry keys. A majority of the cited procedure examples for this sub-technique are related to killing security processes rather than modifying the Registry, and therefore the detection coverage for this control is low. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1562.004 attack_object_name: Disable or Modify System Firewall capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: There are numerous ways depending on the operating system that these sub-techniques can be accomplished. Monitoring the Windows Registry is one way depending on the procedure chosen to implement the sub-technique and therefore the overall coverage is low. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1562.006 attack_object_name: Indicator Blocking capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: There are numerous ways depending on the operating system that these sub-techniques can be accomplished. Monitoring the Windows Registry is one way depending on the procedure chosen to implement the sub-technique and therefore the overall coverage is low. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1574 attack_object_name: Hijack Execution Flow capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect hijacked execution flow. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: minimal - attack_object_id: T1003.001 attack_object_name: LSASS Memory capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control can be used to detect the Windows Security Support Provider (SSP) DLLs variation of this sub-technique by monitoring the Registry keys used to register these DLLs. These keys should change infrequently and therefore false positives should be minimal. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1003 score_category: detect score_value: partial - attack_object_id: T1036.007 attack_object_name: Double File Extension capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect when files with two file extensions are created. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1036 score_category: detect score_value: partial - attack_object_id: T1036.008 attack_object_name: Masquerade File Type capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect if files are created or edited where the header and extension do not match. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1036 score_category: detect score_value: partial - attack_object_id: T1037 attack_object_name: Boot or Logon Initialization Scripts capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect abuse of boot or logon initialization scripts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1037.001 attack_object_name: Logon Script (Windows) capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of logon scripts. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1037 score_category: detect score_value: partial - attack_object_id: T1037.003 attack_object_name: Network Logon Script capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of logon scripts. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1037 score_category: detect score_value: partial - attack_object_id: T1053.001 attack_object_name: At (Linux) capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of scheduled tasks. This control may also detect changes to files used by cron or systemd to create/modify scheduled tasks. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1053.002 attack_object_name: At capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of scheduled tasks. This control may also detect changes to files used by cron or systemd to create/modify scheduled tasks. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1053.003 attack_object_name: Cron capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of scheduled tasks. This control may also detect changes to files used by cron or systemd to create/modify scheduled tasks. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1053.005 attack_object_name: Scheduled Task capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of scheduled tasks. This control may also detect changes to files used by cron or systemd to create/modify scheduled tasks. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1053.006 attack_object_name: Systemd Timers capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of scheduled tasks. This control may also detect changes to files used by cron or systemd to create/modify scheduled tasks. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1070.007 attack_object_name: Clear Network Connection History and Configurations capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect changes to files associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.008 attack_object_name: Clear Mailbox Data capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect changes to files associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.009 attack_object_name: Clear Persistence capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect changes to files associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.010 attack_object_name: Relocate Malware capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect changes to files associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1098.004 attack_object_name: SSH Authorized Keys capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the SSH authorized keys file which may indicate establishment of persistence. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1098 score_category: detect score_value: partial - attack_object_id: T1137.002 attack_object_name: Office Test capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry to establish persistence with the Office Test sub-technique. The specificity of registry keys involved may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1137 score_category: detect score_value: partial - attack_object_id: T1222 attack_object_name: File and Directory Permissions Modification capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect file and directory permissions modification. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1222.001 attack_object_name: Windows File and Directory Permissions Modification capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect changes to the permissions of Windows and Linux files and can be used to detect modifications to sensitive directories and files that shouldn't change frequently. This control at worst scans for changes on an hourly basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1222 score_category: detect score_value: partial - attack_object_id: T1222.002 attack_object_name: Linux and Mac File and Directory Permissions Modification capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect changes to the permissions of Windows and Linux files and can be used to detect modifications to sensitive directories and files that shouldn't change frequently. This control at worst scans for changes on an hourly basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1222 score_category: detect score_value: partial - attack_object_id: T1505.004 attack_object_name: IIS Components capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect when files associated with the technique are created or modified, such as %windir%\system32\inetsrv\config\applicationhost.config. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1505 score_category: detect score_value: partial - attack_object_id: T1505.005 attack_object_name: Terminal Services DLL capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect when files or registry keys associated with this technique are created or modified, such as termsrv.dll and ServiceDll. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1505 score_category: detect score_value: partial - attack_object_id: T1543 attack_object_name: Create or Modify System Process capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect creation or modification of system-level processes. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1543.002 attack_object_name: Systemd Service capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of Windows services. This control may also detect changes to files used by systemd to create/modify systemd services. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1543 score_category: detect score_value: partial - attack_object_id: T1543.003 attack_object_name: Windows Service capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry upon creation or modification of Windows services. This control may also detect changes to files used by systemd to create/modify systemd services. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1543 score_category: detect score_value: partial - attack_object_id: T1546 attack_object_name: Event Triggered Execution capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'The detection score for this technique was assessed as Partial because it doesn''t detect some of the sub-techniques of this technique such as Windows Management Instrumentation (WMI) Event Subscription and Trap sub-techniques. Additionally for some sub-techniques, this control can be noisy. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1546.001 attack_object_name: Change Default File Association capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.002 attack_object_name: Screensaver capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.004 attack_object_name: Unix Shell Configuration Modification capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.007 attack_object_name: Netsh Helper DLL capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.008 attack_object_name: Accessibility Features capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.009 attack_object_name: AppCert DLLs capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.011 attack_object_name: Application Shimming capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.012 attack_object_name: Image File Execution Options Injection capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.013 attack_object_name: PowerShell Profile capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that indicate event triggered execution. The specificity of registry keys and files used in creation or modification of these scheduled tasks may reduce the false positive rate. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.016 attack_object_name: Installer Packages capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect event triggered execution via installer packages. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.017 attack_object_name: Udev Rules capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect event triggered execution via udev rules. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1547 attack_object_name: Boot or Logon Autostart Execution capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect boot or logon autostart execution. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1547.001 attack_object_name: Registry Run Keys / Startup Folder capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.002 attack_object_name: Authentication Package capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.003 attack_object_name: Time Providers capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.004 attack_object_name: Winlogon Helper DLL capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.005 attack_object_name: Security Support Provider capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.006 attack_object_name: Kernel Modules and Extensions capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.008 attack_object_name: LSASS Driver capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.009 attack_object_name: Shortcut Modification capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.010 attack_object_name: Port Monitors capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.012 attack_object_name: Print Processors capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.014 attack_object_name: Active Setup capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect commands or registry key modifications associated with Active Setup such as HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1548.003 attack_object_name: Sudo and Sudo Caching capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the sudoers file which may indicate privilege escalation. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1548 score_category: detect score_value: partial - attack_object_id: T1553 attack_object_name: Subvert Trust Controls capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can be used to detect a subset of this technique's sub-techniques while minimizing the false positive rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1553.003 attack_object_name: SIP and Trust Provider Hijacking capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect modifications made to the Registry keys used to register Windows Subject Interface Packages (SIPs). Because this sub-technique can be accomplished without modifying the Registry via DLL Search Order Hijacking, it has been scored as Partial. The related Registry keys should not change often and therefore the false positive rate should be minimal. This control at worst scans for changes on an hourly basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1553 score_category: detect score_value: partial - attack_object_id: T1553.004 attack_object_name: Install Root Certificate capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can be used to detect when the system root certificates has changed by detecting the corresponding Registry or File system modifications that occur as a result. These root certificates should not change often and therefore the false positive rate is minimal. This control at worst scans for changes on an hourly basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1553 score_category: detect score_value: partial - attack_object_id: T1556 attack_object_name: Modify Authentication Process capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control is effective for detecting the Registry and file system artifacts that are generated during the execution of some variations of this technique while minimizing false positives due to the locations being monitored changing infrequently (e.g. /etc/pam.d/). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: partial - attack_object_id: T1556.002 attack_object_name: Password Filter DLL capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: The Registry key used to register a Password Filter DLL can be monitored for changes using this control providing substantial coverage of this sub-technique. This key should not change often and therefore false positives should be minimal. This control at worst scans for changes on an hourly basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1556 score_category: detect score_value: partial - attack_object_id: T1556.003 attack_object_name: Pluggable Authentication Modules capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: The PAM configuration and module paths (/etc/pam.d/) can be monitored for changes using this control. The files in this path should not change often and therefore false positives should be minimal. This control at worst scans for changes on an hourly basis. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1556 score_category: detect score_value: partial - attack_object_id: T1556.007 attack_object_name: Hybrid Identity capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can monitor for suspicious modification of files associated with hybrid identity authentication processes, such as configuration files. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1556 score_category: detect score_value: partial - attack_object_id: T1556.008 attack_object_name: Network Provider DLL capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can monitor for creation or changes to registry keys associated with network provider DLL such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\\NetworkProvider and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1556 score_category: detect score_value: partial - attack_object_id: T1564.008 attack_object_name: Email Hiding Rules capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect when files are modified related to email rules such as RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist, and MessageRules.plist on MacOS. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1564.009 attack_object_name: Resource Forking capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect when files are created or modified related to resource forking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1564.012 attack_object_name: File/Path Exclusions capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect when files are created in folders associated with or spoofing that of trusted applications. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1574.006 attack_object_name: Dynamic Linker Hijacking capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: 'This control may detect changes to the ld.so.preload file which may indicate an attempt to hijack execution flow. This sub-technique may also be utilized through an environment variable which this control may not detect. This control at worst scans for changes on an hourly basis. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1574 score_category: detect score_value: partial - attack_object_id: T1574.007 attack_object_name: Path Interception by PATH Environment Variable capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect file changes on VMs indicative of Path Interception by PATH Environment Variable. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1574 score_category: detect score_value: partial - attack_object_id: T1574.008 attack_object_name: Path Interception by Search Order Hijacking capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect file changes on VMs indicative of Path Interception by Search Order Hijacking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1574 score_category: detect score_value: partial - attack_object_id: T1574.009 attack_object_name: Path Interception by Unquoted Path capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect file changes on VMs indicative of Path Interception by Unquoted Path. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1574 score_category: detect score_value: partial - attack_object_id: T1574.014 attack_object_name: AppDomainManager capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect file changes on VMs indicative of hijacking of the AppDomainManager. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview related_score: T1574 score_category: detect score_value: partial - attack_object_id: T1053 attack_object_name: Scheduled Task/Job capability_description: 'Microsoft Defender for Cloud: File Integrity Monitoring' capability_group: file_integrity_monitoring capability_id: file_integrity_monitoring comments: This control can detect scheduled tasks/jobs. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview score_category: detect score_value: significant - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control may alert on Docker containers that are misconfigured or do not conform to CIS Docker Benchmarks. This may result in detection of container images implanted within Linux VMs with specific vulnerabilities or misconfigurations for malicious purposes. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: detect score_value: minimal - attack_object_id: T1005 attack_object_name: Data from Local System capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control may provide recommendations that limit the ability of an attacker to gain access to a host from a container, preventing the attacker from discovering and compromising local system data. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: protect score_value: minimal - attack_object_id: T1021 attack_object_name: Remote Services capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control can protect against abuse of remote services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: protect score_value: minimal - attack_object_id: T1021.004 attack_object_name: SSH capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control may provide recommendations to ensure sshd is not running within Docker containers. This can prevent attackers from utilizing unmonitored SSH servers within containers. This may not prevent attackers from installing a SSH server in containers or hosts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts related_score: T1021 score_category: protect score_value: minimal - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: 'This control may recommend usage of TLS to encrypt communication between the Docker daemon and clients. This can prevent possible leakage of sensitive information through network sniffing. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: protect score_value: minimal - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: 'This control may provide recommendations on how to reduce the surface area and mechanisms by which an attacker could escalate privileges. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: protect score_value: minimal - attack_object_id: T1083 attack_object_name: File and Directory Discovery capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: 'This control may provide recommendations to ensure sensitive host system directories are not mounted in the container. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: protect score_value: minimal - attack_object_id: T1548 attack_object_name: Abuse Elevation Control Mechanism capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control is only relevant for Linux endpoints containing Docker containers. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts score_category: protect score_value: minimal - attack_object_id: T1548.001 attack_object_name: Setuid and Setgid capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control may provide recommendations to remove setuid and setguid permissions from container images. It may not be feasible to audit and remediate all binaries that have and require setuid and setguid permissions. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts related_score: T1548 score_category: protect score_value: minimal - attack_object_id: T1021.007 attack_object_name: Cloud Services capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control can protect against abuse of remote cloud services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.008 attack_object_name: Direct Cloud VM Connections capability_description: 'Microsoft Defender for Cloud: Docker Host Hardening' capability_group: docker_host_hardening capability_id: docker_host_hardening comments: This control can protect against abuse of direct cloud VM connections. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/harden-docker-hosts related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This capability can protect against Account Manipulation by requiring DevOps best practices. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction - https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md#built-in-rules score_category: protect score_value: partial - attack_object_id: T1098.001 attack_object_name: Additional Cloud Credentials capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This capability can protect against creation of additional cloud credentials by requiring DevOps best practices. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction - https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md#built-in-rules related_score: T1098 score_category: protect score_value: partial - attack_object_id: T1213.003 attack_object_name: Code Repositories capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This control can protect against repository misconfigurations. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/iac-vulnerabilities related_score: T1213 score_category: protect score_value: partial - attack_object_id: T1552.007 attack_object_name: Container API capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This capability can protect against unsecured Container API credentials by ensuring credential security is part of the DevOps process. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction - https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md#built-in-rules related_score: T1552 score_category: protect score_value: partial - attack_object_id: T1557 attack_object_name: Adversary-in-the-Middle capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This capability can protect against adversary-in-the-middle attacks by ensuring encryption is baked into the DevOps process of applications. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction - https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md#built-in-rules score_category: protect score_value: partial - attack_object_id: T1564.009 attack_object_name: Resource Forking capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This control can provide DevOps guidance that applications should use the application bundle structure which leverages the /Resources folder location to mitigate resource forking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction related_score: T1564 score_category: protect score_value: partial - attack_object_id: T1593.003 attack_object_name: Code Repositories capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This control can protect code repositories by employing DevSecOps best practices. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction related_score: T1593 score_category: protect score_value: partial - attack_object_id: T1189 attack_object_name: Drive-by Compromise capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This capability can protect against drive by compromise by ensuring application security is baked into DevOps. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction score_category: protect score_value: significant - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: 'Microsoft Defender for Cloud: DevOps Security' capability_group: devops_security capability_id: devops_security comments: This capability can protect against exploitation of public facing applications by ensuring application security is baked into DevOps. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction score_category: protect score_value: significant - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control only provides alerts for a set of Azure database offerings. Databases that have been deployed to endpoints within Azure or third-party databases deployed to Azure do not generate alerts for this control. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse score_category: detect score_value: minimal - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control covers the majority of sub-techniques for this parent technique and may cover both successful and unsuccessful brute force attacks. This control only provides alerts for a set of Azure database offerings. Databases that have been deployed to endpoints within Azure or third-party databases deployed to Azure do not generate alerts for this control. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse score_category: detect score_value: minimal - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control may alert on repeated sign in attempts to the resource and successful logins from a suspicious location, IP address, or a user that does not commonly log in to the resource. Because this control is specific to Azure database offerings, the detection coverage is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview?view=azuresql related_score: T1110 score_category: detect score_value: minimal - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control may alert on repeated sign in attempts to the resource and successful logins from a suspicious location, IP address, or a user that does not commonly log in to the resource. Because this control is specific to Azure database offerings, the detection coverage is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview?view=azuresql related_score: T1110 score_category: detect score_value: minimal - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control may alert on repeated sign in attempts to the resource and successful logins from a suspicious location, IP address, or a user that does not commonly log in to the resource. Because this control is specific to Azure database offerings, the detection coverage is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview?view=azuresql related_score: T1110 score_category: detect score_value: minimal - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control may alert on usage of faulty SQL statements. This generates an alert for a possible SQL injection by an application. Alerts may not be generated on usage of valid SQL statements by attackers for malicious purposes. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse score_category: detect score_value: minimal - attack_object_id: T1213 attack_object_name: Data from Information Repositories capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: This control may alert on extraction of a large amount of data to an unusual location. No documentation is provided on the logic for determining an unusual location. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse score_category: detect score_value: minimal - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: Advanced Threat Protection for Azure SQL Database capability_group: advanced_threat_protection_for_azure_sql_database capability_id: advanced_threat_protection_for_azure_sql_database comments: 'This control may alert on logon events that are suspicious. This includes logins from unusual locations, logins from suspicious IP addresses, and users that do not commonly access the resource. These alerts may limit the ability of an attacker to utilize a valid cloud account to access and manipulate Azure databases. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview?view=azuresql related_score: T1078 score_category: detect score_value: partial - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: "This control's recommendations related to enforcing the usage of the\ \ secure versions of the HTTP and FTP protocols (HTTPS and FTPS) can lead to encrypting\ \ traffic which reduces the ability for an adversary to gather sensitive data\ \ via network sniffing. \nThis also applies to the \"Service Fabric clusters\ \ should have the ClusterProtectionLevel property set to EncryptAndSign\", \"\ Enforce SSL connection should be enabled for MySQL database servers\", \"Enforce\ \ SSL connection should be enabled for PostgreSQL database servers\", \"Only secure\ \ connections to your Redis Cache should be enabled\" and \"Secure transfer to\ \ storage accounts should be enabled\" recommendations for their respective protocols.\n\ The \"Usage of host networking and ports should be restricted\" recommendation\ \ for Kubernetes clusters can also lead to mitigating this technique.\nThese recommendations\ \ are limited to specific technologies on the platform and therefore its coverage\ \ score is Minimal." mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/review-security-recommendations - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-multicloud-security-get-started - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction score_category: protect score_value: minimal - attack_object_id: T1053 attack_object_name: Scheduled Task/Job capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a few of the sub-techniques of this technique. Due to its Minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1053.003 attack_object_name: Cron capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing the addition or modification of config files in Kubernetes containers required to implement the behaviors described in these sub-techniques. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1053 score_category: protect score_value: minimal - attack_object_id: T1053.006 attack_object_name: Systemd Timers capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing the addition or modification of config files in Kubernetes containers required to implement the behaviors described in these sub-techniques. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1053 score_category: protect score_value: minimal - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's recommendations about removing deprecated and external accounts with sensitive permissions from your subscription can lead to mitigating the Cloud Accounts sub-technique of this technique. Because this is a recommendation and has low coverage, it is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: "This control's \"Deprecated accounts should be removed from your subscription\"\ \ and \"Deprecated accounts with owner permissions should be removed from your\ \ subscription\" recommendation can lead to removing accounts that should not\ \ be utilized from your subscriptions thereby denying adversaries the usage of\ \ these accounts to find ways to access your data without being noticed. \nLikewise,\ \ the recommendations related to External account permissions can also mitigate\ \ this sub-technique.\nBecause these are recommendations and only limited to deprecated\ \ and external accounts, this is scored as Minimal." mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1078 score_category: protect score_value: minimal - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can prevent modifying the ssh_authorized keys file. Because it is a recommendation and limited to only one sub-technique, its score is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1098.004 attack_object_name: SSH Authorized Keys capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing modification of a Kubernetes container's file system which can mitigate this technique. Because this recommendation is specific to Kubernetes containers, its score is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1098 score_category: protect score_value: minimal - attack_object_id: T1110 attack_object_name: Brute Force capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Authentication to Linux machines should require SSH keys" recommendation can lead to obviating SSH Brute Force password attacks. Because this is specific to Linux, the coverage score is Minimal leading to an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Authentication to Linux machines should require SSH keys" can obviate SSH Brute Force password attacks. Because this is specific to Linux, the coverage score is Minimal leading to an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1110 score_category: protect score_value: minimal - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Authentication to Linux machines should require SSH keys" can obviate SSH Brute Force password attacks. Because this is specific to Linux, the coverage score is Minimal leading to an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1110 score_category: protect score_value: minimal - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Authentication to Linux machines should require SSH keys" can obviate SSH Brute Force password attacks. Because this is specific to Linux, the coverage score is Minimal leading to an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1110 score_category: protect score_value: minimal - attack_object_id: T1136 attack_object_name: Create Account capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: "This control's CORS related recommendations can help lead to hardened\ \ web applications. This can reduce the likelihood of an application being exploited\ \ to reveal sensitive data that can lead to the compromise of an environment.\ \ \nLikewise this control's recommendations related to keeping Java/PHP up to\ \ date for API/Function/Web apps can lead to hardening the public facing content\ \ that uses these runtimes.\nThis control's recommendations related to disabling\ \ Public network access for Azure databases can lead to reducing the exposure\ \ of resources to the public Internet and thereby reduce the attack surface.\n\ These recommendations are limited to specific technologies (Java, PHP and CORS,\ \ SQL DBs) and therefore provide Minimal coverage leading to a Minimal score." mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1222 attack_object_name: File and Directory Permissions Modification capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1222.002 attack_object_name: Linux and Mac File and Directory Permissions Modification capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing the modification of the file system permissions in Kubernetes containers thereby mitigating this sub-technique. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1222 score_category: protect score_value: minimal - attack_object_id: T1499 attack_object_name: Endpoint Denial of Service capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control provides recommendations for limiting the CPU and memory resources consumed by a container to minimize resource exhaustion attacks. Because this control only covers one sub-technique of this technique, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1505 attack_object_name: Server Software Component capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1505.003 attack_object_name: Web Shell capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing modifications to the file system in Kubernetes containers which can mitigate adversaries installing web shells. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1505 score_category: protect score_value: minimal - attack_object_id: T1543 attack_object_name: Create or Modify System Process capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1543.002 attack_object_name: Systemd Service capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing the addition or modification of systemd service files in Kubernetes containers thereby mitigating this sub-technique. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1543 score_category: protect score_value: minimal - attack_object_id: T1546 attack_object_name: Event Triggered Execution capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1546.004 attack_object_name: Unix Shell Configuration Modification capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing the addition or modification of the file system in Kubernetes containers thereby mitigating this sub-technique. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1546 score_category: protect score_value: minimal - attack_object_id: T1556 attack_object_name: Modify Authentication Process capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-techniques of this technique. Due to it being a recommendation and providing minimal coverage, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1556.003 attack_object_name: Pluggable Authentication Modules capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing this sub-technique which often modifies Pluggable Authentication Modules (PAM) components in the file system. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1556 score_category: protect score_value: minimal - attack_object_id: T1564 attack_object_name: Hide Artifacts capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate some of the sub-techniques of this technique. Due to its partial coverage and Minimal score assessed for its sub-techniques, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1564.001 attack_object_name: Hidden Files and Directories capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing these sub-techniques which result in changes to the file system directly or indirectly during their execution. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1564 score_category: protect score_value: minimal - attack_object_id: T1564.005 attack_object_name: Hidden File System capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing these sub-techniques which result in changes to the file system directly or indirectly during their execution. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1564 score_category: protect score_value: minimal - attack_object_id: T1564.006 attack_object_name: Run Virtual Instance capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing these sub-techniques which result in changes to the file system directly or indirectly during their execution. Because this is a recommendation, and specific to Kubernetes containers, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1564 score_category: protect score_value: minimal - attack_object_id: T1565 attack_object_name: Data Manipulation capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to mitigating a sub-technique of this technique by preventing modification of the local filesystem. Due to it being a recommendation and mitigating only one sub-technique, its score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: minimal - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Container with privilege escalation should be avoided", "Least privileged Linux capabilities should be enforced for containers", "Privileged containers should be avoided", "Running containers as root user should be avoided" and "Containers sharing sensitive host namespaces should be avoided" recommendations can make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities. Because this is a recommendation, the assessed score has been capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1074 attack_object_name: Data Staged capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to mitigating a sub-technique of this technique by preventing modification of the local filesystem. Due to it being a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1074.001 attack_object_name: Local Data Staging capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to mitigating this sub-technique by preventing modification of the local filesystem. Due to it being a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1074 score_category: protect score_value: partial - attack_object_id: T1080 attack_object_name: Taint Shared Content capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" and "Usage of pod HostPath volume mounts should be restricted to a known list to restrict node access from compromised containers" recommendations can mitigate this technique. Due to it being a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Management ports should be closed on your virtual machines" recommendation can lead to reducing the attack surface of your Azure VMs by recommending closing management ports. Because this is a recommendation, its score is limited to Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1136.001 attack_object_name: Local Account capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing system files from being modified in Kubernetes containers thereby mitigating this sub-technique since adding an account (on Linux) requires modifying system files. Because this is a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1136 score_category: protect score_value: partial - attack_object_id: T1485 attack_object_name: Data Destruction capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to mitigating this technique by preventing modification of the local filesystem. Due to it being a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1486 attack_object_name: Data Encrypted for Impact capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to mitigating this technique by preventing modification of the local filesystem. Due to it being a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1499.001 attack_object_name: OS Exhaustion Flood capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Container CPU and memory limits should be enforced" recommendation can lead to preventing resource exhaustion attacks by recommending enforcing limits for containers to ensure the runtime prevents the container from using more than the configured resource limit. Because this is a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Container images should be deployed from trusted registries only", "Container registries should not allow unrestricted network access" and "Container registries should use private link" recommendations can lead to ensuring that container images are only loaded from trusted registries thereby mitigating this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1542 attack_object_name: Pre-OS Boot capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control provides recommendations for enabling Secure Boot of Linux VMs that can mitigate a few of the sub-techniques of this technique. Because this is a recommendation and only limited to a few sub-techniques of this technique, its assessed score is Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1542.001 attack_object_name: System Firmware capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Secure Boot should be enabled on your Linux virtual machine" and "Virtual machines should be attested for boot integrity health" recommendations can lead to enabling secure boot on Linux VMs to mitigate these sub-techniques. Because this recommendation is specific to Linux VM and is a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1542 score_category: protect score_value: partial - attack_object_id: T1542.003 attack_object_name: Bootkit capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Secure Boot should be enabled on your Linux virtual machine" and "Virtual machines should be attested for boot integrity health" recommendations can lead to enabling secure boot on Linux VMs to mitigate these sub-techniques. Because this recommendation is specific to Linux VM and is a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1542 score_category: protect score_value: partial - attack_object_id: T1554 attack_object_name: Compromise Host Software Binary capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to preventing modification of binaries in Kubernetes containers thereby mitigating this technique. Because this is a recommendation, its score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai score_category: protect score_value: partial - attack_object_id: T1562.010 attack_object_name: Downgrade Attack capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: This control may prevent downgrade attacks by enforcing use of HTTPS protocol. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1562 score_category: protect score_value: partial - attack_object_id: T1565.001 attack_object_name: Stored Data Manipulation capability_description: 'Microsoft Defender for Cloud: AI Security Recommendations' capability_group: ai_security_recommendations capability_id: ai_security_recommendations comments: "This control's \"Immutable (read-only) root filesystem should be enforced\ \ for containers\" recommendation can lead to mitigating this sub-technique by\ \ preventing modification of the local filesystem. \n\nLikewise this control's\ \ recommendations related to using customer-managed keys to encrypt data at rest\ \ and enabling transparent data encryption for SQL databases can mitigate this\ \ sub-technique by reducing an adversary's ability to perform tailored data modifications.\n\ \nDue to it being a recommendation, its score is capped at Partial." mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai related_score: T1565 score_category: protect score_value: partial - attack_object_id: T1090.003 attack_object_name: Multi-hop Proxy capability_description: 'Microsoft Defender for Cloud: AI Threat Protection' capability_group: ai_threat_protection capability_id: ai_threat_protection comments: 'This capability can detect (alert: AI.Azure_AccessFromAnonymizedIP) when an AI is accessed from a Tor network IP.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads related_score: T1090 score_category: detect score_value: partial - attack_object_id: T1491 attack_object_name: Defacement capability_description: 'Microsoft Defender for Cloud: AI Threat Protection' capability_group: ai_threat_protection capability_id: ai_threat_protection comments: This capability can alert (using AI.Azure_MaliciousUrl.ModelResponse) when an AI model has shared a malicious URL with a user. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads score_category: detect score_value: partial - attack_object_id: T1552 attack_object_name: Unsecured Credentials capability_description: 'Microsoft Defender for Cloud: AI Threat Protection' capability_group: ai_threat_protection capability_id: ai_threat_protection comments: 'This control provides detection of unsecured credentials being divulged by AI model responses. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads score_category: detect score_value: partial - attack_object_id: T1496.004 attack_object_name: Cloud Service Hijacking capability_description: 'Microsoft Defender for Cloud: AI Threat Protection' capability_group: ai_threat_protection capability_id: ai_threat_protection comments: This capability has multiple alerts (AI.Azure_DOWDuplicateRequests, AI.Azure_DOWVolumeAnomaly) that can detect abuse of an AI for financial impact on an organization. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-ai-workloads related_score: T1496 score_category: detect score_value: significant - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Alerts for Azure Cosmos DB capability_group: alerts_for_azure_cosmos_db capability_id: alerts_for_azure_cosmos_db comments: This control's detection is specific to the Cosmos DB and therefore provides minimal overall detection coverage for Valid Accounts resulting in a Minimal score. A relevant alert is "Access from an unusual location to a Cosmos DB account". mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/other-threat-protections - https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/defender-for-cosmos-db score_category: detect score_value: minimal - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: Alerts for Azure Cosmos DB capability_group: alerts_for_azure_cosmos_db capability_id: alerts_for_azure_cosmos_db comments: This control triggers an alert when there is a change in the access pattern to an Azure Cosmos account based on access from an unusual geographical location. False positives are fairly likely and misuse from a typical location is not covered, so score is Minimal. Relevant alert is "Access from an unusual location to a Cosmos DB account" mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-cosmos-db related_score: T1078 score_category: detect score_value: minimal - attack_object_id: T1213 attack_object_name: Data from Information Repositories capability_description: Alerts for Azure Cosmos DB capability_group: alerts_for_azure_cosmos_db capability_id: alerts_for_azure_cosmos_db comments: This control triggers an alert when an unusually large amount of data is extracted from/by an account compared to recent activity. False positives are fairly likely and extraction in quantities below the control's threshold is not detected, so score is Minimal. Neither of the sub-techniques are relevant in this context, since they are repository-specific. Relevant alert is "Unusual amount of data extracted from a Cosmos DB account" mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/other-threat-protections - https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/defender-for-cosmos-db score_category: detect score_value: minimal - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: 'This control can identify connections to known malicious sites. Scored minimal since the malicious sites must be on block list. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurenetlayer score_category: detect score_value: minimal - attack_object_id: T1071.001 attack_object_name: Web Protocols capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: 'This control can identify connections to known malicious sites. Scored minimal since the malicious sites must be on a block list. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1071 score_category: detect score_value: minimal - attack_object_id: T1071.002 attack_object_name: File Transfer Protocols capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: 'This control can identify connections to known malicious sites. Scored minimal since the malicious sites must be on a block list. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1071 score_category: detect score_value: minimal - attack_object_id: T1071.003 attack_object_name: Mail Protocols capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: 'This control can identify connections to known malicious sites. Scored minimal since the malicious sites must be on a block list. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1071 score_category: detect score_value: minimal - attack_object_id: T1071.004 attack_object_name: DNS capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: 'This control can identify connections to known malicious sites. Scored minimal since the malicious sites must be on a block list. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1071 score_category: detect score_value: minimal - attack_object_id: T1071.005 attack_object_name: Publish/Subscribe Protocols capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: 'This control can identify connections to known malicious sites. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: This control can potentially identify malicious use of remote services via alerts such as "Suspicious incoming RDP network activity" and "Suspicious Incoming SSH network activity". mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurenetlayer score_category: detect score_value: partial - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: This control can identify multiple connection attempts by external IPs, which may be indicative of Brute Force attempts, though not T1110.002, which is performed offline. It provides significant detection from most of this technique's sub-techniques and procedure examples resulting in an overall score of Significant. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurenetlayer score_category: detect score_value: significant - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: This control can identify multiple connection attempts by external IPs, which may be indicative of Brute Force attempts, though not T1110.002, which is performed offline. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1110 score_category: detect score_value: significant - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: This control can identify multiple connection attempts by external IPs, which may be indicative of Brute Force attempts, though not T1110.002, which is performed offline. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1110 score_category: detect score_value: significant - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: Alerts for Azure Network Layer capability_group: alerts_for_azure_network_layer capability_id: alerts_for_azure_network_layer comments: This control can identify multiple connection attempts by external IPs, which may be indicative of Brute Force attempts, though not T1110.002, which is performed offline. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-network-layer related_score: T1110 score_category: detect score_value: significant - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Can detect anomalous use of DNS. Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns score_category: detect score_value: minimal - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Can detect potential DNS protocol misuse/anomalies. Technique coverage is restricted to DNS and therefore results in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns score_category: detect score_value: minimal - attack_object_id: T1090 attack_object_name: Proxy capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Can detect DNS activity to anonymity networks e.g. TOR. Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns score_category: detect score_value: minimal - attack_object_id: T1572 attack_object_name: Protocol Tunneling capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Can identify protocol misuse/anomalies in DNS. Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns score_category: detect score_value: minimal - attack_object_id: T1568 attack_object_name: Dynamic Resolution capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: 'Can identify "random" DNS occurences which can be associated with domain generation algorithm or Fast Flux sub-techniques. Partial for coverage and accuracy (potential for false positive/benign). ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns score_category: detect score_value: partial - attack_object_id: T1568.001 attack_object_name: Fast Flux DNS capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Detects "random" DNS name occurences, potentially indicative of Fast Flux or DGA. Potential false positives from benign "random" DNS names. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns related_score: T1568 score_category: detect score_value: partial - attack_object_id: T1568.002 attack_object_name: Domain Generation Algorithms capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Detects "random" DNS name occurences, potentially indicative of Fast Flux or DGA. Potential false positives from benign "random" DNS names. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns related_score: T1568 score_category: detect score_value: partial - attack_object_id: T1071.004 attack_object_name: DNS capability_description: Alerts for DNS capability_group: alerts_for_dns capability_id: alerts_for_dns comments: Can alert on anomalies and misuse of the DNS protocol. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns related_score: T1071 score_category: detect score_value: significant - attack_object_id: T1021 attack_object_name: Remote Services capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control is only relevant for Linux environments. Among the sub-techinques that are relevant for Linux, this control may only alert on SSH. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1027 attack_object_name: Obfuscated Files or Information capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control only provides detection coverage for the Compile After Delivery sub-technique while not providing detection for all other sub-techniques relevant to the Linux platform or most of its procedure examples. As a result of this minimal coverage, the overall score is assessed as Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1027.004 attack_object_name: Compile After Delivery capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on suspicious compilation. No documentation is provided on the logic for determining a suspicious compilation event. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1027 score_category: detect score_value: minimal - attack_object_id: T1059 attack_object_name: Command and Scripting Interpreter capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on suspicious Unix shell and PHP execution. Mismatched script extensions may also generate alerts of suspicious activity. Only one of the technique's sub-techniques is covered, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on suspicious arguments used to exploit Xorg vulnerabilities for privilege escalation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control provides partial detection for only one of this technique's sub-techniques and does not cover most of its procedure examples, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1136 attack_object_name: Create Account capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control is only relevant for Linux endpoints, and it provides partial coverage for the only sub-technique relevant on Linux endpoints, Local Account. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1505 attack_object_name: Server Software Component capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control provides coverage for the only sub-technique this control is relevant for, Web Shell, but that coverage is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1505.003 attack_object_name: Web Shell capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on usage of web shells. No documentation is provided on logic for this detection. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1505 score_category: detect score_value: minimal - attack_object_id: T1547 attack_object_name: Boot or Logon Autostart Execution capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control is only relevant for Linux endpoint machines and the only sub-technique relevant for Linux is Kernel Modules and Extensions. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1562 attack_object_name: Impair Defenses capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control only provides coverage for a miniority of the sub-techniques under this technique and provides no coverage for other relevant sub-techniques, such as Impair Command History Logging or Disable or Modify Tools, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1562.006 attack_object_name: Indicator Blocking capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on activity which disables auditd logging on Linux endpoints. The auditd package may not be the only logging system being utilized and this control may not alert on activity that disables other logging software. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1562 score_category: detect score_value: minimal - attack_object_id: T1564 attack_object_name: Hide Artifacts capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control only provides coverage for a minority of this technique's relevant sub-techniques, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: minimal - attack_object_id: T1564.001 attack_object_name: Hidden Files and Directories capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on the execution of hidden files. Since this control is only triggered on execution, it may not fire on a variety of hidden files or directories that are being utilized for malicious purposes. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1564 score_category: detect score_value: minimal - attack_object_id: T1003 attack_object_name: OS Credential Dumping capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control is only relevant for Linux environments, and provides partial coverage for one of the technique's two Linux-relevant sub-techniques. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: partial - attack_object_id: T1003.008 attack_object_name: /etc/passwd and /etc/shadow capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on suspicious access to encrypted user passwords. The documentation does not reference "/etc/passwd" and "/etc/shadow" directly nor does it describe the logic in determining suspicious access. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1003 score_category: detect score_value: partial - attack_object_id: T1021.004 attack_object_name: SSH capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alerts on SSH brute force attempts, addition of new SSH keys, and usage of a SSH server within a container. Alerts may not be generated by usage of existing SSH keys by malicious actors for lateral movement. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.007 attack_object_name: Cloud Services capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect abuse of remote services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.008 attack_object_name: Direct Cloud VM Connections capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect direct cloud VM connections. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1027.008 attack_object_name: Stripped Payloads capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect stripped payloads. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.009 attack_object_name: Embedded Payloads capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect embedded payloads. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.010 attack_object_name: Command Obfuscation capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect command obsfucation attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.013 attack_object_name: Encrypted/Encoded File capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect obsfucation via encrypted/encoded files. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.014 attack_object_name: Polymorphic Code capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect obsfucation via polymorphic code. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1036.008 attack_object_name: Masquerade File Type capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect if files are created or edited where the header and extension do not match. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1036 score_category: detect score_value: partial - attack_object_id: T1059.004 attack_object_name: Unix Shell capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on suspicious commandline activity. Alerts may be generated on possible detection of shellcode usage on the commandline, based on arguments, location, user, etc. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1070 attack_object_name: Indicator Removal capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control is only relevant for Linux environments and provides partial coverage for multiple Linux-relevant sub-techniques. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: partial - attack_object_id: T1070.002 attack_object_name: Clear Linux or Mac System Logs capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on possible log tampering activity, including deletion of logs. No documentation is provided on which log sources are targeted by this control. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.003 attack_object_name: Clear Command History capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on clearing of the command history file. Documentation is not provided on the logic for detecting when the command history is cleared but on Linux machines the location of the history file tends not to change from the default. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1098.004 attack_object_name: SSH Authorized Keys capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on addition of new SSH keys to the authorized key file and unusual process access of the authorized key file. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1098 score_category: detect score_value: partial - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control provides partial coverage for most of this technique's sub-techniques and procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: partial - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on multiple successful and failed brute force attempts against SSH. There are no alerts for other methods of logging into Linux machines. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1110 score_category: detect score_value: partial - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on multiple successful and failed brute force attempts against SSH. There are no alerts for other methods of logging into Linux machines. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1110 score_category: detect score_value: partial - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on multiple successful and failed brute force attempts against SSH. There are no alerts for other methods of logging into Linux machines. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1110 score_category: detect score_value: partial - attack_object_id: T1113 attack_object_name: Screen Capture capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on usage of a screenshot tool. Documentation is not provided on the logic for determining a screenshot tool. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: partial - attack_object_id: T1136.001 attack_object_name: Local Account capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on usage of the useradd command to create new users and the creation of local user accounts with suspicious similarity to other account names. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1136 score_category: detect score_value: partial - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on suspicious container images running mining software or SSH servers. Privileged Docker containers and privileged commands running within containers may also be detected. These alerts are only generated on containers in Linux endpoint machines and not for containers running from Azure Docker deployment. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux score_category: detect score_value: partial - attack_object_id: T1547.006 attack_object_name: Kernel Modules and Extensions capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on a suspicious shared object file being loaded as a kernel module. No documentation is provided on the logic but kernel module loading is a relatively rare event and can only be done with a small set of commands. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1547.013 attack_object_name: XDG Autostart Entries capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect command execution associated with xdg modification. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1555.002 attack_object_name: Securityd Memory capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect command execution associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1555.003 attack_object_name: Credentials from Web Browsers capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect command execution associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1555.005 attack_object_name: Password Managers capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control can detect command execution associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1562.004 attack_object_name: Disable or Modify System Firewall capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on manipulation of the on-host firewall. Firewall rules should not be changed often in a standard environment and such an event can provide a high fidelity alert. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1562.012 attack_object_name: Disable or Modify Linux Audit System capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on activity which disables auditd logging on Linux endpoints. The auditd package may not be the only logging system being utilized and this control may not alert on activity that disables other logging software. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1564.006 attack_object_name: Run Virtual Instance capability_description: Alerts for Linux Machines capability_group: alerts_for_linux_machines capability_id: alerts_for_linux_machines comments: This control may alert on containers using privileged commands, running SSH servers, or running mining software. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1003 attack_object_name: OS Credential Dumping capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control provides detection for a minority of this technique's sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal. Furthermore, its detection capability relies on detecting the usage of specific tools (e.g. sqldumper.exe) further adversely impacting its score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1003.004 attack_object_name: LSA Secrets capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when the registry is modified to allow logon credentials to be stored in clear text in LSA memory. This change allows a threat actor to gain plain text credentials from the host machine. The following alerts may be generated: "Detected enabling of the WDigest UseLogonCredential registry key".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1003 score_category: detect score_value: minimal - attack_object_id: T1027 attack_object_name: Obfuscated Files or Information capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect usage of VBScript.Encode and base-64 encoding to obfuscate malicious commands and scripts. The following alerts may be generated: "Detected suspicious execution of VBScript.Encode command", "Detected encoded executable in command line data".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1048.001 attack_object_name: Exfiltration Over Symmetric Encrypted Non-C2 Protocol capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious use of the Telegram tool for transferring malicious binaries across hosts. The following alerts may be generated: "Detected potentially suspicious use of Telegram tool".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1048 score_category: detect score_value: minimal - attack_object_id: T1059 attack_object_name: Command and Scripting Interpreter capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1070 attack_object_name: Indicator Removal capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1082 attack_object_name: System Information Discovery capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect local reconnaissance activity specific to using the systeminfo commands. The following alerts may be generated: "Detected possible local reconnaissance activity".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1136 attack_object_name: Create Account capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1202 attack_object_name: Indirect Command Execution capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious use of Pcalua.exe to launch executable code. There are other methods of indirect command execution that this control may not detect. The following alerts may be generated: "Detected suspicious use of Pcalua.exe to launch executable code".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1218 attack_object_name: System Binary Proxy Execution capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1222 attack_object_name: File and Directory Permissions Modification capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control provides minimal detection for some of this technique''s sub-techniques resulting in an overall score of Minimal. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1222.001 attack_object_name: Windows File and Directory Permissions Modification capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect the usage of cacls.exe to modify file and directory permissions. The following alerts may be generated: "Detected suspicious use of Cacls to lower the security state of the system".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1222 score_category: detect score_value: minimal - attack_object_id: T1489 attack_object_name: Service Stop capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when critical services have been disabled through the usage of specifically net.exe. The following alerts may be generated: "Detected the disabling of critical services".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1543 attack_object_name: Create or Modify System Process capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1546 attack_object_name: Event Triggered Execution capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1547 attack_object_name: Boot or Logon Autostart Execution capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1548 attack_object_name: Abuse Elevation Control Mechanism capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: The only sub-technique scored (Bypass User Account Control) is the only one relevant to Windows. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1548.002 attack_object_name: Bypass User Account Control capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when User Account Control is bypassed by manipulating the Windows registry. There may be other methods to Bypass User Account Control which limits the score to Minimal. The following alerts may be generated: "Detected change to a registry key that can be abused to bypass UAC"' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1548 score_category: detect score_value: minimal - attack_object_id: T1558 attack_object_name: Steal or Forge Kerberos Tickets capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1562 attack_object_name: Impair Defenses capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1564 attack_object_name: Hide Artifacts capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: minimal - attack_object_id: T1027.008 attack_object_name: Stripped Payloads capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect stripped payloads. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.009 attack_object_name: Embedded Payloads capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect embedded payloads. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.010 attack_object_name: Command Obfuscation capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect command obsfucation attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.013 attack_object_name: Encrypted/Encoded File capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect obsfucation via encrypted/encoded files. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1027.014 attack_object_name: Polymorphic Code capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect obsfucation via polymorphic code. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1027 score_category: detect score_value: partial - attack_object_id: T1036.008 attack_object_name: Masquerade File Type capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect if commands are executed that are otherwise non-executable file types. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1036 score_category: detect score_value: partial - attack_object_id: T1053.007 attack_object_name: Container Orchestration Job capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands associated with this technique are executed. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1055 attack_object_name: Process Injection capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control's Fileless Attack Detection covers all relevant sub-techniques. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1055.001 attack_object_name: Dynamic-link Library Injection capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.002 attack_object_name: Portable Executable Injection capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.003 attack_object_name: Thread Execution Hijacking capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.004 attack_object_name: Asynchronous Procedure Call capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.005 attack_object_name: Thread Local Storage capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.011 attack_object_name: Extra Window Memory Injection capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.012 attack_object_name: Process Hollowing capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.013 attack_object_name: "Process Doppelg\xE4nging" capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1059.009 attack_object_name: Cloud API capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect supicious usage of commands and scripts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1059.010 attack_object_name: AutoHotKey & AutoIT capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect supicious usage of commands and scripts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1059.011 attack_object_name: Lua capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect supicious usage of commands and scripts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1070.001 attack_object_name: Clear Windows Event Logs capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when an event log has been cleared or IIS logs have been deleted. The following alerts may be generated: "Detected actions indicative of disabling and deleting IIS log files", "An event log was cleared".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.004 attack_object_name: File Deletion capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious file cleanup commands and shadow copy deletion activity. The following alerts may be generated: "Detected suspicious file cleanup commands", "Suspicious Volume Shadow Copy Activity".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.007 attack_object_name: Clear Network Connection History and Configurations capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can monitor for executed commands associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.008 attack_object_name: Clear Mailbox Data capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can monitor for executed commands associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1070.009 attack_object_name: Clear Persistence capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can monitor for executed commands associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1070 score_category: detect score_value: partial - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control is able to detect some of this technique''s sub-techniques resulting in a Partial Coverage score and consequently an overall score of Partial. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1078.001 attack_object_name: Default Accounts capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious activity from existing Windows accounts and logons from suspicious IP addresses. The following alerts may be generated: "A logon from a malicious IP has been detected", "A logon from a malicious IP has been detected. [seen multiple times]".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1078 score_category: detect score_value: partial - attack_object_id: T1078.003 attack_object_name: Local Accounts capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious activity from existing Windows accounts and logons from suspicious IP addresses. The following alerts may be generated: "A logon from a malicious IP has been detected", "A logon from a malicious IP has been detected. [seen multiple times]".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1078 score_category: detect score_value: partial - attack_object_id: T1087 attack_object_name: Account Discovery capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control provides partial detection for some of this technique's sub-techniques and procedure examples resulting in a Partial Coverage score and consequently an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1087.001 attack_object_name: Local Account capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when the local administrators group is enumerated or when mulitiple domain accounts are queried. The following alerts may be generated: "Multiple Domain Accounts Queried", "Local Administrators group members were enumerated".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1087 score_category: detect score_value: partial - attack_object_id: T1087.002 attack_object_name: Domain Account capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when the local administrators group is enumerated or when mulitiple domain accounts are queried. The following alerts may be generated: "Multiple Domain Accounts Queried", "Local Administrators group members were enumerated".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1087 score_category: detect score_value: partial - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect usage of malware droppers and creation of suspicious files on the host machine. The following alerts may be generated: "Detected possible execution of malware dropper", "Detected suspicious file creation".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control provides detection for some of this technique's sub-techniques and procedure examples resulting in a Partial Coverage score and consequently an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1112 attack_object_name: Modify Registry capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect several methods used to modify the registry for purposes of persistence, privilege elevation, and execution. The following alerts may be generated: "Detected change to a registry key that can be abused to bypass UAC", "Detected enabling of the WDigest UseLogonCredential registry key", "Detected suppression of legal notice displayed to users at logon", "Suspicious WindowPosition registry value detected", "Windows registry persistence method detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1134 attack_object_name: Access Token Manipulation capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands associated with this technique are executed, such as runas. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1136.001 attack_object_name: Local Account capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when an account is created with an account name that closely resembles a standard Windows account or group name. This may be an account created by an attacker to blend into the environment. The following alerts may be generated: "Suspicious Account Creation Detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1136 score_category: detect score_value: partial - attack_object_id: T1140 attack_object_name: Deobfuscate/Decode Files or Information capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect decoding of suspicious files by certutil.exe and may detect the presence of various encoding schemes to obfuscate malicious scripts and commandline arguments. The following alerts may be generated: "Suspicious download using Certutil detected", "Suspicious download using Certutil detected [seen multiple times]", "Detected decoding of an executable using built-in certutil.exe tool".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1189 attack_object_name: Drive-by Compromise capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1203 attack_object_name: Exploitation for Client Execution capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1204 attack_object_name: User Execution capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control provides detection for one of the two sub-techniques of this technique, Malicious File, resulting in a Partial Coverage score and consequently an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1204.002 attack_object_name: Malicious File capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect the usage of a malware dropper and other indicators of a malicious file being executed by the user. The following alerts may be generated: "Detected possible execution of keygen executable", "Detected possible execution of malware dropper", "Detected suspicious file creation".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1204 score_category: detect score_value: partial - attack_object_id: T1204.003 attack_object_name: Malicious Image capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect when commands are executed that are associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1204 score_category: detect score_value: partial - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1211 attack_object_name: Exploitation for Defense Evasion capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1212 attack_object_name: Exploitation for Credential Access capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control''s Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1218.005 attack_object_name: Mshta capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious usage of Mshta to execute PowerShell and suspicious Rundll32 execution. The following alerts may be generated: "Detected suspicious execution via rundll32.exe", "Detected suspicious combination of HTA and PowerShell".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1218 score_category: detect score_value: partial - attack_object_id: T1218.011 attack_object_name: Rundll32 capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious usage of Mshta to execute PowerShell and suspicious Rundll32 execution. The following alerts may be generated: "Detected suspicious execution via rundll32.exe", "Detected suspicious combination of HTA and PowerShell".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1218 score_category: detect score_value: partial - attack_object_id: T1218.013 attack_object_name: Mavinject capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control may detect usage of the argument INJECTRUNNING which is required for mavinject.exe. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1218 score_category: detect score_value: partial - attack_object_id: T1218.014 attack_object_name: MMC capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control may detect creation and usage of non-microsoft .msc files. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1218 score_category: detect score_value: partial - attack_object_id: T1218.015 attack_object_name: Electron Applications capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control may detect commands invoking teams.exe or chrome.exe and analyze whether they are being used to execute malicious or abnormal content. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1218 score_category: detect score_value: partial - attack_object_id: T1505.004 attack_object_name: IIS Components capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands associated with installing IIS web servers are executed, such as AppCmd.exe. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1505 score_category: detect score_value: partial - attack_object_id: T1505.005 attack_object_name: Terminal Services DLL capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands associated with this technique are executed, such as reg.exe. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1505 score_category: detect score_value: partial - attack_object_id: T1543.003 attack_object_name: Windows Service capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when the tscon.exe binary is installed as a service to exploit RDP sessions or when a rare service group is executed under SVCHOST. The following alerts may be generated: "Suspect service installation".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1543 score_category: detect score_value: partial - attack_object_id: T1543.005 attack_object_name: Container Service capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands associated with container services are executed, such as docker or podman. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1543 score_category: detect score_value: partial - attack_object_id: T1546.002 attack_object_name: Screensaver capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when a suspicious screensaver process is executed, based on the location of the .scr file. Because this detection is based solely on the location of the file, it has been scored as Partial. The following alerts may be generated: "Suspicious Screensaver process executed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1546.008 attack_object_name: Accessibility Features capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when the binary for the sticky keys utility has been replaced, possibly to gain persistence or execution. The following alerts may be generated: "Sticky keys attack detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1546 score_category: detect score_value: partial - attack_object_id: T1547.001 attack_object_name: Registry Run Keys / Startup Folder capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when the Registry is leveraged to gain persistence. The following alerts may be generated: "Windows registry persistence method detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1547 score_category: detect score_value: partial - attack_object_id: T1552.001 attack_object_name: Credentials In Files capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands associated with searching for passwords are executed. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1552 score_category: detect score_value: partial - attack_object_id: T1553.006 attack_object_name: Code Signing Policy Modification capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can be used to monitor for the execution of commands that could modify the code signing policy of a system, such as bcdedit.exe -set TESTSIGNING ON. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1553 score_category: detect score_value: partial - attack_object_id: T1555.003 attack_object_name: Credentials from Web Browsers capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect command execution associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1555.004 attack_object_name: Windows Credential Manager capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect command execution associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1555.005 attack_object_name: Password Managers capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect command execution associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1556.005 attack_object_name: Reversible Encryption capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can monitor for command execution related to reversible encryption such as -AllowReversiblePasswordEncryption $true. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1556 score_category: detect score_value: partial - attack_object_id: T1558.001 attack_object_name: Golden Ticket capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect commandline parameters consistent with a Kerberos Golden Ticket attack. The following alerts may be generated: "Suspected Kerberos Golden Ticket attack parameters observed".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1558 score_category: detect score_value: partial - attack_object_id: T1562.001 attack_object_name: Disable or Modify Tools capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect when critical services have been disabled, such as Windows Security Center. This control may also detect when IIS logging has been disabled. The following alerts may be generated: "Detected the disabling of critical services", "Detected actions indicative of disabling and deleting IIS log files".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1562.004 attack_object_name: Disable or Modify System Firewall capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect modification of the Windows firewall through use of netsh.exe or using a method that matches a known threat actor. The following alerts may be generated: "Malicious firewall rule created by ZINC server implant [seen multiple times]", "Detected suspicious new firewall rule".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1562.009 attack_object_name: Safe Mode Boot capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control may detect executed commands indicative of changes to boot settings such as bcdedit.exe and bootcfg.exe mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1562.010 attack_object_name: Downgrade Attack capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: "This control may detect executed commands indicative of indicative of\ \ attempts to abuse older or deprecated technologies (ex: powershell \u2013v 2)." mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1563 attack_object_name: Remote Service Session Hijacking capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control provides partial detection for some of this technique's sub-techniques resulting in a Partial Coverage score and consequently an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1563.002 attack_object_name: RDP Hijacking capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect RDP hijacking through use of the tscon.exe binary. The following alerts may be generated: "Suspect integrity level indicative of RDP hijacking", "Suspect service installation".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1563 score_category: detect score_value: partial - attack_object_id: T1564.003 attack_object_name: Hidden Window capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect usage of the WindowPosition Registry value to hide application windows in non-visible sections of the desktop. The following alerts may be generated: "Suspicious WindowPosition registry value detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1564.008 attack_object_name: Email Hiding Rules capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands are run on VMs that can indicate creation or modification of email rules such as New-InboxRule, Set-InboxRule, New-TransportRule, and Set-TransportRule. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1564.009 attack_object_name: Resource Forking capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands are run related to resource forking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1564.011 attack_object_name: Ignore Process Interrupts capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect when commands are run related to process interrupts such as nohup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1564 score_category: detect score_value: partial - attack_object_id: T1567.004 attack_object_name: Exfiltration Over Webhook capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect commands on VMs indicative of exfiltration over webhook. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1567 score_category: detect score_value: partial - attack_object_id: T1574.013 attack_object_name: KernelCallbackTable capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This control can detect windows API calls on VMs indicative of Hijacking Execution Flow via KernelCallBack table such as WriteProcessMemory() and NtQueryInformationProcess(). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1574 score_category: detect score_value: partial - attack_object_id: T1612 attack_object_name: Build Image on Host capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect execution of commands related to container creation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1614 attack_object_name: System Location Discovery capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect if commands associated with this technique such as GetLocaleInfoW are executed. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1614.001 attack_object_name: System Language Discovery capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect if commands associated with this technique are executed. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1614 score_category: detect score_value: partial - attack_object_id: T1622 attack_object_name: Debugger Evasion capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect system processes that indicate debugger evasion. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1652 attack_object_name: Device Driver Discovery capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect if commands associated with this technique are executed. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1654 attack_object_name: Log Enumeration capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: This capability can detect if commands associated with log enumeration (such as wevutil.exe on Windows and CollectGuestLogs.exe on Azure hosted VMs) are executed. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines score_category: detect score_value: partial - attack_object_id: T1059.001 attack_object_name: PowerShell capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious usage of PowerShell and the Windows command line. These detections include usage of suspicious arguments, dynamic script construction, and shellcode on the commandline. The following alerts may be generated: "Detected anomalous mix of upper and lower case characters in command-line", "Detected encoded executable in command line data", "Detected obfuscated command line", "Detected suspicious combination of HTA and PowerShell", "Detected suspicious commandline arguments", "Detected suspicious commandline used to start all executables in a directory", "Detected suspicious credentials in commandline", "Dynamic PS script construction", "Suspicious PowerShell Activity Detected", "Suspicious PowerShell cmdlets executed", "Suspicious command execution".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1059 score_category: detect score_value: significant - attack_object_id: T1059.003 attack_object_name: Windows Command Shell capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect suspicious usage of PowerShell and the Windows command line. These detections include usage of suspicious arguments, dynamic script construction, and shellcode on the commandline. The following alerts may be generated: "Detected anomalous mix of upper and lower case characters in command-line", "Detected encoded executable in command line data", "Detected obfuscated command line", "Detected suspicious combination of HTA and PowerShell", "Detected suspicious commandline arguments", "Detected suspicious commandline used to start all executables in a directory", "Detected suspicious credentials in commandline", "Dynamic PS script construction", "Suspicious PowerShell Activity Detected", "Suspicious PowerShell cmdlets executed", "Suspicious command execution".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1059 score_category: detect score_value: significant - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect successful and failed brute force attempts with logic that factors the IP, time between attempts, and other suspicious activity. The following alerts may be generated: "A logon from a malicious IP has been detected", "A logon from a malicious IP has been detected. [seen multiple times]", "Successful brute force attack", "Suspicious authentication activity".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1110 score_category: detect score_value: significant - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect successful and failed brute force attempts with logic that factors the IP, time between attempts, and other suspicious activity. The following alerts may be generated: "A logon from a malicious IP has been detected", "A logon from a malicious IP has been detected. [seen multiple times]", "Successful brute force attack", "Suspicious authentication activity".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1110 score_category: detect score_value: significant - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: Alerts for Windows Machines capability_group: alerts_for_windows_machines capability_id: alerts_for_windows_machines comments: 'This control may detect successful and failed brute force attempts with logic that factors the IP, time between attempts, and other suspicious activity. The following alerts may be generated: "A logon from a malicious IP has been detected", "A logon from a malicious IP has been detected. [seen multiple times]", "Successful brute force attack", "Suspicious authentication activity".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines related_score: T1110 score_category: detect score_value: significant - attack_object_id: T1561.002 attack_object_name: Disk Structure Wipe capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Allows for recovery of disk content, though Disk structure wipes require additional procedures for recovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview related_score: T1561 score_category: respond score_value: partial - attack_object_id: T1485 attack_object_name: Data Destruction capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to data destruction by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview score_category: respond score_value: significant - attack_object_id: T1485.001 attack_object_name: Lifecycle-Triggered Deletion capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to data destruction by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview related_score: T1485 score_category: respond score_value: significant - attack_object_id: T1486 attack_object_name: Data Encrypted for Impact capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to data encryption/ransomware by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview score_category: respond score_value: significant - attack_object_id: T1491 attack_object_name: Defacement capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to data defacement attacks by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview score_category: respond score_value: significant - attack_object_id: T1491.001 attack_object_name: Internal Defacement capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to external or internal data defacement attacks by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview related_score: T1491 score_category: respond score_value: significant - attack_object_id: T1491.002 attack_object_name: External Defacement capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to external or internal data defacement attacks by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview related_score: T1491 score_category: respond score_value: significant - attack_object_id: T1561 attack_object_name: Disk Wipe capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to disk wipe attacks by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview score_category: respond score_value: significant - attack_object_id: T1561.001 attack_object_name: Disk Content Wipe capability_description: Azure Backup capability_group: azure_backup capability_id: azure_backup comments: Data backups provide a significant response to disk content wipe attacks by enabling the restoration of data from backup. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/backup/backup-overview related_score: T1561 score_category: respond score_value: significant - attack_object_id: T1498 attack_object_name: Network Denial of Service capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: Designed to address multiple DDOS techniques including volumetric attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview score_category: protect score_value: significant - attack_object_id: T1498.001 attack_object_name: Direct Network Flood capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: This control can protect against network denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview related_score: T1498 score_category: protect score_value: significant - attack_object_id: T1498.002 attack_object_name: Reflection Amplification capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: This control can protect against network denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview related_score: T1498 score_category: protect score_value: significant - attack_object_id: T1499 attack_object_name: Endpoint Denial of Service capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: Protects against volumetric and protocol DOS, though not application. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview score_category: protect score_value: significant - attack_object_id: T1499.001 attack_object_name: OS Exhaustion Flood capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview related_score: T1499 score_category: protect score_value: significant - attack_object_id: T1499.002 attack_object_name: Service Exhaustion Flood capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview related_score: T1499 score_category: protect score_value: significant - attack_object_id: T1499.003 attack_object_name: Application Exhaustion Flood capability_description: Azure DDoS Protection capability_group: azure_ddos_protection capability_id: azure_ddos_protection comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview related_score: T1499 score_category: protect score_value: significant - attack_object_id: T1552 attack_object_name: Unsecured Credentials capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: This control's protection is specific to a minority of this technique's sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview - https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/ score_category: protect score_value: minimal - attack_object_id: T1553 attack_object_name: Subvert Trust Controls capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Provides protection against sub-techniques involved with stealing credentials / certificates / keys from the organization. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview - https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/ score_category: protect score_value: partial - attack_object_id: T1553.002 attack_object_name: Code Signing capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Certificate credentials can be vaulted in an HSM thereby reducing its attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview related_score: T1553 score_category: protect score_value: partial - attack_object_id: T1553.004 attack_object_name: Install Root Certificate capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Certificate credentials can be vaulted in an HSM thereby reducing its attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview related_score: T1553 score_category: protect score_value: partial - attack_object_id: T1588 attack_object_name: Obtain Capabilities capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Provides protection against sub-techniques involved with stealing credentials / certificates / keys from the organization. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview - https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/ score_category: protect score_value: partial - attack_object_id: T1588.003 attack_object_name: Code Signing Certificates capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Certificate credentials can be vaulted in an HSM thereby reducing its attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview related_score: T1588 score_category: protect score_value: partial - attack_object_id: T1588.004 attack_object_name: Digital Certificates capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Certificate credentials can be vaulted in an HSM thereby reducing its attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview related_score: T1588 score_category: protect score_value: partial - attack_object_id: T1552.004 attack_object_name: Private Keys capability_description: Azure Dedicated HSM capability_group: azure_dedicated_hsm capability_id: azure_dedicated_hsm comments: Provides significant protection of private keys. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview related_score: T1552 score_category: protect score_value: significant - attack_object_id: T1584 attack_object_name: Compromise Infrastructure capability_description: Azure DNS Alias Records capability_group: azure_dns_alias_records capability_id: azure_dns_alias_records comments: This control only provides protection for one of this technique's sub-techniques while not providing any protection for the remaining and therefore its coverage score factor is Minimal, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dns/dns-alias#prevent-dangling-dns-records score_category: protect score_value: minimal - attack_object_id: T1584.001 attack_object_name: Domains capability_description: Azure DNS Alias Records capability_group: azure_dns_alias_records capability_id: azure_dns_alias_records comments: Alias records prevent dangling references by tightly coupling the life cycle of a DNS record with an Azure resource. For example, consider a DNS record that's qualified as an alias record to point to a public IP address or a Traffic Manager profile. If you delete those underlying resources, the DNS alias record becomes an empty record set. It no longer references the deleted resource. This control is effective for protecting DNS records that resolve to Azure resources but does not offer protection for records pointing to non-Azure resources, resulting in a Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/dns/dns-alias related_score: T1584 score_category: protect score_value: partial - attack_object_id: T1041 attack_object_name: Exfiltration Over C2 Channel capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can potentially be used to forensically identify exfiltration via a DNS-based C2 channel. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics score_category: detect score_value: minimal - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can identify anomalous / high talker DNS clients, possibly related to exfil via DNS mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics score_category: detect score_value: minimal - attack_object_id: T1048.003 attack_object_name: Exfiltration Over Unencrypted Non-C2 Protocol capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can potentially be used to forensically identify exfiltration via DNS protocol. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics related_score: T1048 score_category: detect score_value: minimal - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used forensically to identify clients that communicated with identified C2 hosts via DNS. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics score_category: detect score_value: minimal - attack_object_id: T1071.004 attack_object_name: DNS capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used forensically to identify clients that communicated with identified C2 hosts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics related_score: T1071 score_category: detect score_value: minimal - attack_object_id: T1566 attack_object_name: Phishing capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used forensically to identify DNS queries to known malicious sites, which may be evidence of phishing. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics score_category: detect score_value: minimal - attack_object_id: T1566.002 attack_object_name: Spearphishing Link capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used forensically to identify DNS queries to known malicious sites, which may be evidence of phishing. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics related_score: T1566 score_category: detect score_value: minimal - attack_object_id: T1568 attack_object_name: Dynamic Resolution capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used for after-the-fact analysis of potential fast-flux DNS C2 mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics score_category: detect score_value: minimal - attack_object_id: T1568.001 attack_object_name: Fast Flux DNS capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used for after-the-fact analysis of potential fast-flux DNS C2 mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics related_score: T1568 score_category: detect score_value: minimal - attack_object_id: T1568.002 attack_object_name: Domain Generation Algorithms capability_description: Azure DNS Analytics capability_group: azure_dns_analytics capability_id: azure_dns_analytics comments: This control can be used for after-the-fact analysis of potential fast-flux DNS C2 mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics related_score: T1568 score_category: detect score_value: minimal - attack_object_id: T1557.003 attack_object_name: DHCP Spoofing capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can detect DHCP spoofing by monitoring network traffic. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1557 score_category: detect score_value: partial - attack_object_id: T1567.003 attack_object_name: Exfiltration to Text Storage Sites capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can detect exfiltration attempts to text storage sites. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1567 score_category: detect score_value: partial - attack_object_id: T1665 attack_object_name: Hide Infrastructure capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This capability can detect some traffic related to adversary command and control behavior. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: detect score_value: partial - attack_object_id: T1008 attack_object_name: Fallback Channels capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1018 attack_object_name: Remote System Discovery capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control typically filters external network traffic and therefore can be effective for preventing external remote system discovery but such activity originating from inside the trusted network is not mitigated. Due to this partial protection coverage, it has been scored as Partial protection. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1046 attack_object_name: Network Service Discovery capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control typically filters external network traffic and therefore can be effective for preventing external network service scanning but network service scanning originating from inside the trusted network is not mitigated. Due to this partial protection coverage, it has been scored as Partial protection. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control provides partial protection for this technique's sub-techniques and some of its procedure examples resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1048.001 attack_object_name: Exfiltration Over Symmetric Encrypted Non-C2 Protocol capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1048 score_category: protect score_value: partial - attack_object_id: T1048.002 attack_object_name: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1048 score_category: protect score_value: partial - attack_object_id: T1048.003 attack_object_name: Exfiltration Over Unencrypted Non-C2 Protocol capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1048 score_category: protect score_value: partial - attack_object_id: T1071.005 attack_object_name: Publish/Subscribe Protocols capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can filter network traffic on ports associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1071 score_category: protect score_value: partial - attack_object_id: T1095 attack_object_name: Non-Application Layer Protocol capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: 'This control''s threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. Furthermore, it can be used to filter non-application layer protocol traffic such as ICMP.' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can limit access to external remote services to the minimum necessary. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1204 attack_object_name: User Execution capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control provides partial protection for this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1204.003 attack_object_name: Malicious Image capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can prevent malicious downloads associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1204 score_category: protect score_value: partial - attack_object_id: T1205 attack_object_name: Traffic Signaling capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control provides partial protection for this technique's sub-techniques and procedure examples resulting in a Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1205.001 attack_object_name: Port Knocking capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can protect against this sub-technique by enforcing limited access to only required ports. Consequently, even if the adversary is able to utilize port knocking to open additional ports at the host level, it is still blocked at the firewall service level. This service typically applies to external traffic and not internal traffic and therefore lateral movement using this technique within a network is still possible. Due to this partial coverage, it has been scored as Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1205 score_category: protect score_value: partial - attack_object_id: T1205.002 attack_object_name: Socket Filters capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can protect against some variations of this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1205 score_category: protect score_value: partial - attack_object_id: T1219 attack_object_name: Remote Access Software capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can be used to limit outgoing traffic to only sites and services used by authorized remote access tools. This is scored as partial because it doesn't protect against an adversary using an authorized remote access tool for malicious activity. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1567.003 attack_object_name: Exfiltration to Text Storage Sites capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can protect from exfiltration to text storage site by blocking unauthorized sites. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1567 score_category: protect score_value: partial - attack_object_id: T1590 attack_object_name: Gather Victim Network Information capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can prevent the gathering of victim network information via scanning methods but is not effective against methods such as Phishing resulting in a Partial coverage score and an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1590.004 attack_object_name: Network Topology capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can prevent attempts by an adversary to gather this information using active scanning methods but is not effective of gathering this information using phishing related methods. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1590.005 attack_object_name: IP Addresses capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can prevent attempts by an adversary to gather this information using active scanning methods but is not effective of gathering this information using phishing related methods. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1590.006 attack_object_name: Network Security Appliances capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can prevent attempts by an adversary to gather this information using active scanning methods but is not effective of gathering this information using phishing related methods. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1595 attack_object_name: Active Scanning capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control provides Partial protection for its sub-techniques resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: partial - attack_object_id: T1595.001 attack_object_name: Scanning IP Blocks capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1595 score_category: protect score_value: partial - attack_object_id: T1595.002 attack_object_name: Vulnerability Scanning capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1595 score_category: protect score_value: partial - attack_object_id: T1595.003 attack_object_name: Wordlist Scanning capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control monitors for accesses of potentially sensitive web pages from source IP addresses whose access pattern resembles that of a web scanner or have not been logged before. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1595 score_category: protect score_value: partial - attack_object_id: T1557.003 attack_object_name: DHCP Spoofing capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can protect against DHCP spoofing by restricting DHCP traffic to trusted DHCP servers. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview related_score: T1557 score_category: protect score_value: significant - attack_object_id: T1571 attack_object_name: Non-Standard Port capability_description: Azure Firewall capability_group: azure_firewall capability_id: azure_firewall comments: This control can limit access to the minimum required ports and therefore protect against adversaries attempting to use non-standard ports for C2 traffic. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/firewall/overview score_category: protect score_value: significant - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: Azure Key Vault capability_group: azure_key_vault capability_id: azure_key_vault comments: This control provides secure methods for accessing secrets and passwords. This can reduce the incidences of credentials and other authentication material being transmitted in plain text or by insecure encryption methods. Any communication between applications or endpoints after access to Key Vault may not be secure. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/key-vault/general/overview score_category: protect score_value: minimal - attack_object_id: T1528 attack_object_name: Steal Application Access Token capability_description: Azure Key Vault capability_group: azure_key_vault capability_id: azure_key_vault comments: This control can provide protection against attackers stealing application access tokens if they are stored within Azure Key Vault. Key vault significantly raises the bar for access for stored tokens by requiring legitimate credentials with proper authorization. Applications may have to be modified to take advantage of Key Vault and may not always be possible to utilize. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/key-vault/general/overview score_category: protect score_value: partial - attack_object_id: T1552 attack_object_name: Unsecured Credentials capability_description: Azure Key Vault capability_group: azure_key_vault capability_id: azure_key_vault comments: 'This control provides a central, secure location for storage of credentials to reduce the possibility of attackers discovering unsecured credentials. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/key-vault/general/overview score_category: protect score_value: partial - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: Azure Key Vault capability_group: azure_key_vault capability_id: azure_key_vault comments: This control may provide a more secure location for storing passwords. If an Azure user account, endpoint, or application is compromised, they may have limited access to passwords stored in the Key Vault. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/key-vault/general/overview score_category: protect score_value: partial - attack_object_id: T1555.006 attack_object_name: Cloud Secrets Management Stores capability_description: Azure Key Vault capability_group: azure_key_vault capability_id: azure_key_vault comments: This control may provide a more secure location for storing passwords. If an Azure user account, endpoint, or application is compromised, they may have limited access to passwords stored in the Key Vault. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/key-vault/general/overview related_score: T1555 score_category: protect score_value: partial - attack_object_id: T1542 attack_object_name: Pre-OS Boot capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: Provides protection coverage for only one sub-technique partially (booting from remote devies ala TFTP boot) resulting in an overall score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: minimal - attack_object_id: T1021 attack_object_name: Remote Services capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control provides partial protection for all of its sub-techniques and procedure examples resulting in an overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1021.001 attack_object_name: Remote Desktop Protocol capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.002 attack_object_name: SMB/Windows Admin Shares capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.003 attack_object_name: Distributed Component Object Model capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.004 attack_object_name: SSH capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.005 attack_object_name: VNC capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.006 attack_object_name: Windows Remote Management capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.007 attack_object_name: Cloud Services capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can protect against abuse of remote cloud services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.008 attack_object_name: Direct Cloud VM Connections capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can protect against abuse of direct cloud VM connections. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1046 attack_object_name: Network Service Discovery capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to trusted networks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1072 attack_object_name: Software Deployment Tools capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to limit access to critical network systems such as software deployment tools. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1090 attack_object_name: Proxy capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can restrict ports and inter-system / inter-enclave connections as described by the Proxy related sub-techniques although it doesn't provide protection for domain-fronting. It furthermore provides partial protection of this technique's procedure examples resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1090.001 attack_object_name: Internal Proxy capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can restrict access between systems, enclaves, and workloads thereby mitigating these proxy related sub-techniques. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1090 score_category: protect score_value: partial - attack_object_id: T1090.002 attack_object_name: External Proxy capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can restrict access between systems, enclaves, and workloads thereby mitigating these proxy related sub-techniques. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1090 score_category: protect score_value: partial - attack_object_id: T1090.003 attack_object_name: Multi-hop Proxy capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can restrict access between systems, enclaves, and workloads thereby mitigating these proxy related sub-techniques. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1090 score_category: protect score_value: partial - attack_object_id: T1095 attack_object_name: Non-Application Layer Protocol capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to trusted networks and protocols. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict direct access to remote service gateways and concentrators that typically accompany external remote services. This can be circumvented though if an adversary is able to compromise a trusted host and use it to access the external remote service. This results in an overall partial (coverage) score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1199 attack_object_name: Trusted Relationship capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can isolate portions of network that do not require network-wide access, limiting some attackers that leverage trusted relationships such as remote access for vendor maintenance. Coverage partial, Temporal Immediate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1205 attack_object_name: Traffic Signaling capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control provides partial protection for this technique's sub-techniques and procedure examples resulting in an overall Partial score. Other variations that trigger a special response, such as executing a malicous task are not mitigated by this control. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to remote services to minimum necessary. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1219 attack_object_name: Remote Access Software capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict network communications to protect sensitive enclaves that may mitigate some of the procedure examples of this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1482 attack_object_name: Domain Trust Discovery capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to isolate sensitive domains to limit discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1498 attack_object_name: Network Denial of Service capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to endpoints and thereby mitigate low-end network DOS attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1499 attack_object_name: Endpoint Denial of Service capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control provides partial protection for a majority of this control's sub-techinques and procedure examples resulting in overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1499.001 attack_object_name: OS Exhaustion Flood capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to endpoints and thereby mitigate low-end DOS attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1499.002 attack_object_name: Service Exhaustion Flood capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to endpoints and thereby mitigate low-end DOS attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1499.003 attack_object_name: Application Exhaustion Flood capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict access to endpoints and thereby mitigate low-end DOS attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1542.005 attack_object_name: TFTP Boot capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to restrict clients to connecting (and therefore booting) from only trusted network resources. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1542 score_category: protect score_value: partial - attack_object_id: T1557 attack_object_name: Adversary-in-the-Middle capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce MiTM conditions. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1570 attack_object_name: Lateral Tool Transfer capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to limit traffic between systems and enclaves to minimum necessary for example via a zero-trust strategy. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1602 attack_object_name: Data from Configuration Repository capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can limit attackers access to configuration repositories such as SNMP management stations, or to dumps of client configurations from common management ports. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1602.001 attack_object_name: SNMP (MIB Dump) capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: Can limit access to client management interfaces or configuration databases mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1602 score_category: protect score_value: partial - attack_object_id: T1602.002 attack_object_name: Network Device Configuration Dump capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: Can limit access to client management interfaces or configuration databases mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1602 score_category: protect score_value: partial - attack_object_id: T1659 attack_object_name: Content Injection capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce content injection conditions. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: partial - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: NSG can minimize alternative protocols allowed to communicate externally. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: significant - attack_object_id: T1048.001 attack_object_name: Exfiltration Over Symmetric Encrypted Non-C2 Protocol capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can reduce the protocols available for data exfiltration. Temporal immediate, coverage substantial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1048 score_category: protect score_value: significant - attack_object_id: T1048.002 attack_object_name: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can reduce the protocols available for data exfiltration. Temporal immediate, coverage substantial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1048 score_category: protect score_value: significant - attack_object_id: T1048.003 attack_object_name: Exfiltration Over Unencrypted Non-C2 Protocol capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can reduce the protocols available for data exfiltration. Temporal immediate, coverage substantial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1048 score_category: protect score_value: significant - attack_object_id: T1205.001 attack_object_name: Port Knocking capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can be used to implement whitelist based network rules that can mitigate variations of this sub-techniques that result in opening closed ports for communication. Because this control is able to drop traffic before reaching a compromised host, it can effectively mitigate this port knocking sub-technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview related_score: T1205 score_category: protect score_value: significant - attack_object_id: T1496.002 attack_object_name: Bandwidth Hijacking capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This capability can be configured to limit bandwidth available to connections. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices related_score: T1496 score_category: protect score_value: significant - attack_object_id: T1571 attack_object_name: Non-Standard Port capability_description: Azure Network Security Groups capability_group: azure_network_security_groups capability_id: azure_network_security_groups comments: This control can restrict traffic to standard ports and protocols. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works - https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#feature-functionality score_category: protect score_value: significant - attack_object_id: T1542 attack_object_name: Pre-OS Boot capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic related to one of its sub-techniques (TFTP boot). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: minimal - attack_object_id: T1021 attack_object_name: Remote Services capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic or attempts related to network security group (NSG) for remote services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1021.001 attack_object_name: Remote Desktop Protocol capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to remote access protocols and groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.002 attack_object_name: SMB/Windows Admin Shares capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to remote access protocols and groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.003 attack_object_name: Distributed Component Object Model capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to remote access protocols and groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.004 attack_object_name: SSH capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to remote access protocols and groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.005 attack_object_name: VNC capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to remote access protocols and groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.006 attack_object_name: Windows Remote Management capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to remote access protocols and groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.007 attack_object_name: Cloud Services capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous network traffic associated with abuse of remote cloud services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1021.008 attack_object_name: Direct Cloud VM Connections capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect direct cloud VM connections. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1021 score_category: detect score_value: partial - attack_object_id: T1048 attack_object_name: Exfiltration Over Alternative Protocol capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to specific protocols/ports. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas score_category: detect score_value: partial - attack_object_id: T1048.001 attack_object_name: Exfiltration Over Symmetric Encrypted Non-C2 Protocol capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1048 score_category: detect score_value: partial - attack_object_id: T1048.002 attack_object_name: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1048 score_category: detect score_value: partial - attack_object_id: T1048.003 attack_object_name: Exfiltration Over Unencrypted Non-C2 Protocol capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1048 score_category: detect score_value: partial - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic with respect to NSG and application layer protocols. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1071.002 attack_object_name: File Transfer Protocols capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1071.003 attack_object_name: Mail Protocols capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1071.004 attack_object_name: DNS capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1071.005 attack_object_name: Publish/Subscribe Protocols capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous application protocol traffic related to this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1072 attack_object_name: Software Deployment Tools capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic with respect to critical systems and software deployment ports. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1090 attack_object_name: Proxy capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic between systems and external networks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1090.001 attack_object_name: Internal Proxy capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect abuse of internal proxies. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1090 score_category: detect score_value: partial - attack_object_id: T1090.002 attack_object_name: External Proxy capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect abuse of external proxies. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1090 score_category: detect score_value: partial - attack_object_id: T1090.003 attack_object_name: Multi-hop Proxy capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect abuse of multi-hop proxies. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1090 score_category: detect score_value: partial - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous access to external remote services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1189 attack_object_name: Drive-by Compromise capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This capability can detect suspicious script execution over a network. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas score_category: detect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect anomalous traffic to and from externally facing systems with respect to network security group (NSG) policy. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1199 attack_object_name: Trusted Relationship capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can be used to gain insight into normal traffic from trusted third parties which can then be used to detect anomalous traffic that may be indicative of a threat. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1204 attack_object_name: User Execution capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect network traffic associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas score_category: detect score_value: partial - attack_object_id: T1219 attack_object_name: Remote Access Software capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect network traffic associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas score_category: detect score_value: partial - attack_object_id: T1496.002 attack_object_name: Bandwidth Hijacking capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This capability can detect anomalous network traffic indicative of bandwidth hijacking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1499 attack_object_name: Endpoint Denial of Service capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify volumetric and multi-sourced denial-of-service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1499.001 attack_object_name: OS Exhaustion Flood capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1499 score_category: detect score_value: partial - attack_object_id: T1499.002 attack_object_name: Service Exhaustion Flood capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1499 score_category: detect score_value: partial - attack_object_id: T1499.003 attack_object_name: Application Exhaustion Flood capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1499 score_category: detect score_value: partial - attack_object_id: T1542.005 attack_object_name: TFTP Boot capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can be used to identify anomalous TFTP boot traffic. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1542 score_category: detect score_value: partial - attack_object_id: T1563 attack_object_name: Remote Service Session Hijacking capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can be used to identify anomalous traffic related to RDP and SSH sessions or blocked attempts to access these management ports. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1563.001 attack_object_name: SSH Hijacking capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect SSH hijacking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1563 score_category: detect score_value: partial - attack_object_id: T1563.002 attack_object_name: RDP Hijacking capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect RDP hijacking. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1563 score_category: detect score_value: partial - attack_object_id: T1602 attack_object_name: Data from Configuration Repository capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic with respect to configuration repositories or identified configuration management ports. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: partial - attack_object_id: T1602.001 attack_object_name: SNMP (MIB Dump) capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect collection from configuration repositories. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1602 score_category: detect score_value: partial - attack_object_id: T1602.002 attack_object_name: Network Device Configuration Dump capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect collection from configuration repositories. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas related_score: T1602 score_category: detect score_value: partial - attack_object_id: T1046 attack_object_name: Network Service Discovery capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can detect network service scanning/discovery activity. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas score_category: detect score_value: significant - attack_object_id: T1571 attack_object_name: Non-Standard Port capability_description: 'Azure Network Watcher: Traffic Analytics' capability_group: azure_network_watcher_traffic_analytics capability_id: azure_network_watcher_traffic_analytics comments: This control can identify anomalous traffic that utilizes non-standard application ports. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics score_category: detect score_value: significant - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable scanning and auditing of container images. This can provide information on images that have been added with high privileges or vulnerabilities. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: detect score_value: minimal - attack_object_id: T1021 attack_object_name: Remote Services capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against abuse of remote services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1021.001 attack_object_name: Remote Desktop Protocol capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to restrict public access to Remote Desktop Protocol. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1021 score_category: protect score_value: minimal - attack_object_id: T1021.004 attack_object_name: SSH capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: 'This control may provide recommendations to restrict public SSH access and enable usage of SSH keys. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1021 score_category: protect score_value: minimal - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against command and control via application layer protocol. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1071.004 attack_object_name: DNS capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable Azure Defender for DNS which can monitor DNS queries between Azure applications for malicious traffic. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1071 score_category: protect score_value: minimal - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against abuse of valid accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to audit and restrict privileges on Azure cloud accounts. This control may provide information to reduce surface area for privileged access to Azure. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1078 score_category: protect score_value: minimal - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against account manipulation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1098.001 attack_object_name: Additional Cloud Credentials capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may recommend removing deprecated accounts, reducing privileges, and enabling multi-factor authentication. This can reduce the amount of accounts available to be exploited and what could be done with those accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1098 score_category: protect score_value: minimal - attack_object_id: T1203 attack_object_name: Exploitation for Client Execution capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable Azure security controls to harden remote services and reduce surface area for possible exploitation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1211 attack_object_name: Exploitation for Defense Evasion capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1212 attack_object_name: Exploitation for Credential Access capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1485 attack_object_name: Data Destruction capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable soft deletion and purge protection in Azure Key Vault. This can help mitigate against malicious deletion of keys and secrets stored within Key Vault. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1485.001 attack_object_name: Lifecycle-Triggered Deletion capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations that protect from lifecycle-triggered deletion. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1485 score_category: protect score_value: minimal - attack_object_id: T1505 attack_object_name: Server Software Component capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against abuse of server software components for persistence. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1505.001 attack_object_name: SQL Stored Procedures capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: 'This control may provide recommendations to enable other Azure controls that provide information on potentially exploitable SQL stored procedures. Recommendations to reduce unnecessary privileges from accounts and stored procedures can mitigate exploitable of this technique. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1505 score_category: protect score_value: minimal - attack_object_id: T1537 attack_object_name: Transfer Data to Cloud Account capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable security controls that monitor and prevent malicious transfer of data to cloud accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: minimal - attack_object_id: T1021.007 attack_object_name: Cloud Services capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against abuse of remote cloud services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1021.008 attack_object_name: Direct Cloud VM Connections capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against abuse of direct cloud VM connections. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1021 score_category: protect score_value: partial - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable various Azure services that route traffic through secure networks, segment all network traffic, and enable TLS encryption where available. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - ' https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir' score_category: protect score_value: partial - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against brute force attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to implement multi-factor authentication, implement password security policies, and replacing password authentication with more secure authentication methods. This control can affect Azure, Azure cloud application, and endpoint credentials. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1110 score_category: protect score_value: partial - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to implement multi-factor authentication, implement password security policies, and replacing password authentication with more secure authentication methods. This control can affect Azure, Azure cloud application, and endpoint credentials. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1110 score_category: protect score_value: partial - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to implement multi-factor authentication, implement password security policies, and replacing password authentication with more secure authentication methods. This control can affect Azure, Azure cloud application, and endpoint credentials. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1110 score_category: protect score_value: partial - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to secure external remote services, such as restricting SSH access, enabling multi-factor authentication for VPN access, and auditing external remote services that are not necessary or updated. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to restrict access to applications that are public facing and providing information on vulnerable applications. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1526 attack_object_name: Cloud Service Discovery capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable Azure services that limit access to cloud services. Several Azure services and controls provide mitigations against cloud service discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1530 attack_object_name: Data from Cloud Storage capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: 'This control may provide recommendations to enable Azure Defender for Storage and other security controls to prevent access to data from cloud storage objects. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1535 attack_object_name: Unused/Unsupported Cloud Regions capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to restrict the allowed locations your organization can specify when deploying resources or creating resource groups. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1538 attack_object_name: Cloud Service Dashboard capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable Azure services that limit access to Azure Resource Manager and other Azure dashboards. Several Azure services and controls provide mitigations against this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1555.006 attack_object_name: Cloud Secrets Management Stores capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations for auditing and hardening Azure Key Vault to prevent malicious access and segment key access. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1555 score_category: protect score_value: partial - attack_object_id: T1580 attack_object_name: Cloud Infrastructure Discovery capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to enable Azure services that limit access to cloud infrastructure. Several Azure services and controls provide mitigations against cloud infrastructure discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1590 attack_object_name: Gather Victim Network Information capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control may provide recommendations to restrict access to cloud resources from public networks and to route traffic between resources through Azure. Recommendations are also provided to use private DNS zones. If these recommendations are implemented the visible network information should be reduced. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview - https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir score_category: protect score_value: partial - attack_object_id: T1590.002 attack_object_name: DNS capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against gathering victim networking information. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1590.004 attack_object_name: Network Topology capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against gathering victim networking information. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1590.005 attack_object_name: IP Addresses capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against gathering victim networking information. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1590.006 attack_object_name: Network Security Appliances capability_description: Azure Policy capability_group: azure_policy capability_id: azure_policy comments: This control can protect against gathering victim networking information. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/governance/policy/overview related_score: T1590 score_category: protect score_value: partial - attack_object_id: T1565 attack_object_name: Data Manipulation capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control provides partial protection for one of this technique's sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview score_category: protect score_value: minimal - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control reduces the likelihood of a network sniffing attack for traffic between remote users, cloud, and 3rd parties by routing the traffic via the Microsoft backbone rather than over the Internet. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview score_category: protect score_value: partial - attack_object_id: T1498 attack_object_name: Network Denial of Service capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: Prevents Denial of Service (DOS) against systems that would otherwise need to connect via an internet-traversing path (coverage partial, since doesn't apply to systems that must be directly exposed to the Internet) mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview score_category: protect score_value: partial - attack_object_id: T1498.001 attack_object_name: Direct Network Flood capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control can protect against network denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1498 score_category: protect score_value: partial - attack_object_id: T1498.002 attack_object_name: Reflection Amplification capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control can protect against network denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1498 score_category: protect score_value: partial - attack_object_id: T1499 attack_object_name: Endpoint Denial of Service capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: Prevents Denial of Service (DOS) against systems that would otherwise need to connect via an internet-traversing path (coverage partial, since doesn't apply to systems that must be directly exposed to the Internet) mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview score_category: protect score_value: partial - attack_object_id: T1499.001 attack_object_name: OS Exhaustion Flood capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1499.002 attack_object_name: Service Exhaustion Flood capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1499.003 attack_object_name: Application Exhaustion Flood capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1499.004 attack_object_name: Application or System Exploitation capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control can protect against endpoint denial of service attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1499 score_category: protect score_value: partial - attack_object_id: T1557 attack_object_name: Adversary-in-the-Middle capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control provides partial protection for this technique's sub-techniques resulting in an overall Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview score_category: protect score_value: partial - attack_object_id: T1557.001 attack_object_name: LLMNR/NBT-NS Poisoning and SMB Relay capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control reduces the likelihood of MiTM for traffic between remote users, cloud, and 3rd parties by routing the traffic via the Microsoft backbone rather than over the Internet. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1557 score_category: protect score_value: partial - attack_object_id: T1557.002 attack_object_name: ARP Cache Poisoning capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control reduces the likelihood of MiTM for traffic between remote users, cloud, and 3rd parties by routing the traffic via the Microsoft backbone rather than over the Internet. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1557 score_category: protect score_value: partial - attack_object_id: T1565.002 attack_object_name: Transmitted Data Manipulation capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This control reduces the likelihood of data manipulation for traffic between remote users, cloud, and 3rd parties by routing the traffic via the Microsoft backbone rather than over the Internet. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview related_score: T1565 score_category: protect score_value: partial - attack_object_id: T1659 attack_object_name: Content Injection capability_description: Azure Private Link capability_group: azure_private_link capability_id: azure_private_link comments: This capability provides protection against content inection. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/private-link/private-link-overview score_category: protect score_value: partial - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control only provides protection for one of this technique's sub-techniques while not providing any protection for its procedure examples (due to being specific to Azure AD) nor its remaining sub-technqiues. Consequently its coverage score factor is Minimal, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: minimal - attack_object_id: T1087 attack_object_name: Account Discovery capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control only provides protection for one of this technique's sub-techniques while not providing any protection for its procedure examples nor its remaining sub-technqiues and therefore its coverage score factor is Minimal, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: minimal - attack_object_id: T1136 attack_object_name: Create Account capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control only provides protection for one of this technique's sub-techniques while not providing any protection for the remaining and therefore its coverage score factor is Minimal, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: minimal - attack_object_id: T1078.004 attack_object_name: Cloud Accounts capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit what an adversary can do with a valid account. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1078 score_category: protect score_value: partial - attack_object_id: T1087.004 attack_object_name: Cloud Account capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the accounts that can be used for account discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1087 score_category: protect score_value: partial - attack_object_id: T1098 attack_object_name: Account Manipulation capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control provides protection for some of this technique's sub-techniques and therefore its coverage score factor is Partial, resulting in a Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1098.001 attack_object_name: Additional Cloud Credentials capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can modify accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1098 score_category: protect score_value: partial - attack_object_id: T1098.003 attack_object_name: Additional Cloud Roles capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can modify accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1098 score_category: protect score_value: partial - attack_object_id: T1098.006 attack_object_name: Additional Container Cluster Roles capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can modify accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1098 score_category: protect score_value: partial - attack_object_id: T1136.003 attack_object_name: Cloud Account capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can create accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1136 score_category: protect score_value: partial - attack_object_id: T1485.001 attack_object_name: Lifecycle-Triggered Deletion capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can provide protection against life-cycle triggered deletion by restricting access to those functions. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1485 score_category: protect score_value: partial - attack_object_id: T1528 attack_object_name: Steal Application Access Token capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to limit the number of users that are authorized to grant consent to applications for accessing organizational data. This can reduce the likelihood that a user is fooled into granting consent to a malicious application that then utilizes the user's OAuth access token to access organizational data. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1530 attack_object_name: Data from Cloud Storage capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to limit the number of users that have access to storage solutions except for the applications, users, and services that require access, thereby reducing the attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1538 attack_object_name: Cloud Service Dashboard capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to limit the number of users that have dashboard visibility thereby reducing the attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1556 attack_object_name: Modify Authentication Process capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can protect against modification of the authentication process by limiting access. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1578 attack_object_name: Modify Cloud Compute Infrastructure capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control provides partial protection for all of its sub-techniques and therefore its coverage score factor is Partial, resulting in a Partial score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1578.001 attack_object_name: Create Snapshot capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can perform these privileged operations. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1578 score_category: protect score_value: partial - attack_object_id: T1578.002 attack_object_name: Create Cloud Instance capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can perform these privileged operations. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1578 score_category: protect score_value: partial - attack_object_id: T1578.003 attack_object_name: Delete Cloud Instance capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can perform these privileged operations. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1578 score_category: protect score_value: partial - attack_object_id: T1578.004 attack_object_name: Revert Cloud Instance capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can perform these privileged operations. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1578 score_category: protect score_value: partial - attack_object_id: T1578.005 attack_object_name: Modify Cloud Compute Configurations capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can perform these privileged operations. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview related_score: T1578 score_category: protect score_value: partial - attack_object_id: T1580 attack_object_name: Cloud Infrastructure Discovery capability_description: Azure Role-Based Access Control capability_group: azure_role_based_access_control capability_id: azure_role_based_access_control comments: This control can be used to limit the number of users that have privileges to discover cloud infrastructure thereby reducing an organization's cloud infrastructure attack surface. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview score_category: protect score_value: partial - attack_object_id: T1072 attack_object_name: Software Deployment Tools capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides partial coverage of attacks that leverage software flaws in unpatched deployment tools since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: partial - attack_object_id: T1189 attack_object_name: Drive-by Compromise capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control protects against a subset of drive-by methods that leverage unpatched client software since it enables automated updates of software and rapid configuration change management mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides partial coverage for techniques that exploit vulnerabilities in (common) unpatched software since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: partial - attack_object_id: T1195 attack_object_name: Supply Chain Compromise capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides coverage of some aspects of software supply chain compromise since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: partial - attack_object_id: T1195.001 attack_object_name: Compromise Software Dependencies and Development Tools capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides coverage of some aspects of software supply chain compromise since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager related_score: T1195 score_category: protect score_value: partial - attack_object_id: T1195.002 attack_object_name: Compromise Software Supply Chain capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides coverage of some aspects of software supply chain compromise since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager related_score: T1195 score_category: protect score_value: partial - attack_object_id: T1499 attack_object_name: Endpoint Denial of Service capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides protection against the subset of Denial of Service (DOS) attacks that leverage system/application vulnerabilities as opposed to volumetric attacks since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: partial - attack_object_id: T1554 attack_object_name: Compromise Host Software Binary capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides partial protection against compromised client software binaries since it can provide a baseline to compare with potentially compromised/modified software binaries. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides significant coverage of methods that leverage vulnerabilities in unpatched software since it enables automated updates of software and rapid configuration change management mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/overview - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager?tabs=azure-vms%2Cupdate-win score_category: protect score_value: significant - attack_object_id: T1203 attack_object_name: Exploitation for Client Execution capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides significant coverage for Exploitation for client execution methods that leverage unpatched vulnerabilities since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: significant - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides significant coverage of techniques that leverage vulnerabilities in unpatched remote services since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: significant - attack_object_id: T1211 attack_object_name: Exploitation for Defense Evasion capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides significant coverage of defensive evasion methods that exploit unpatched vulnerabilities in software/systems since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: significant - attack_object_id: T1212 attack_object_name: Exploitation for Credential Access capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides significant coverage of credential access techniques that leverage unpatched software vulnerabilities since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager score_category: protect score_value: significant - attack_object_id: T1499.004 attack_object_name: Application or System Exploitation capability_description: Azure Update Manager capability_group: azure_update_manager capability_id: azure_update_manager comments: This control provides significant protection against Denial of Service (DOS) attacks that leverage system/application vulnerabilities as opposed to volumetric attacks since it enables automated updates of software and rapid configuration change management. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager related_score: T1499 score_category: protect score_value: significant - attack_object_id: T1565 attack_object_name: Data Manipulation capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This control provides significant protection against one sub-technique (Transmitted Data Manipulation) of this technique while not providing protection for its remaining sub-techniques resulting in overall score of Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways score_category: protect score_value: partial - attack_object_id: T1040 attack_object_name: Network Sniffing capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This control encrypts traffic traversing over untrusted networks which can prevent information from being gathered via network sniffing. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways score_category: protect score_value: significant - attack_object_id: T1557 attack_object_name: Adversary-in-the-Middle capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This control can mitigate Man-in-the-Middle attacks that manipulate network protocol data in transit. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways score_category: protect score_value: significant - attack_object_id: T1557.001 attack_object_name: LLMNR/NBT-NS Poisoning and SMB Relay capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This control can protect against adversary in the middle attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways related_score: T1557 score_category: protect score_value: significant - attack_object_id: T1557.002 attack_object_name: ARP Cache Poisoning capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This control can protect against adversary in the middle attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways related_score: T1557 score_category: protect score_value: significant - attack_object_id: T1565.002 attack_object_name: Transmitted Data Manipulation capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This control can protect against transmitted data manipulation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways related_score: T1565 score_category: protect score_value: significant - attack_object_id: T1659 attack_object_name: Content Injection capability_description: Azure VPN Gateway capability_group: azure_vpn_gateway capability_id: azure_vpn_gateway comments: This capability can mitigate content injection attacks that manipulate data in transit. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways score_category: protect score_value: significant - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can detect one of the sub-techniques of this technique while not providing detection for the remaining, resulting in a Minimal overall score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: detect score_value: minimal - attack_object_id: T1071 attack_object_name: Application Layer Protocol capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can protect against one of the sub-techniques of this technique while not providing protection for the remaining, resulting in a Minimal overall score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: protect score_value: minimal - attack_object_id: T1046 attack_object_name: Network Service Discovery capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can detect network service scanning of web applications by an adversary. Because this detection is specific to web applications (although frequent targets) and not other application types enumerated in the procedure examples of this technique (e.g. Active Directory), it has been scored as Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: detect score_value: partial - attack_object_id: T1071.001 attack_object_name: Web Protocols capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can detect protocol attacks targeting web applications that may be indicative of adversary activity. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview related_score: T1071 score_category: detect score_value: partial - attack_object_id: T1595.002 attack_object_name: Vulnerability Scanning capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can detect active scanning. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview related_score: T1595 score_category: detect score_value: partial - attack_object_id: T1046 attack_object_name: Network Service Discovery capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can protect web applications from network service scanning by an adversary. Because this protection is specific to web applications (although frequent targets) and not other application types enumerated in the procedure examples of this technique (e.g. Active Directory), it has been scored as Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: protect score_value: partial - attack_object_id: T1071.001 attack_object_name: Web Protocols capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can protect web applications from protocol attacks that may be indicative of adversary activity. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview related_score: T1071 score_category: protect score_value: partial - attack_object_id: T1595 attack_object_name: Active Scanning capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can protect web applications from active scanning by an adversary. Because this protection is specific to web applications (although frequent targets) and not other application types, it has been scored as Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: protect score_value: partial - attack_object_id: T1595.002 attack_object_name: Vulnerability Scanning capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: Focuses on web vulnerability scanning of OWASP Core Rule Set (CRS). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview related_score: T1595 score_category: protect score_value: partial - attack_object_id: T1595.003 attack_object_name: Wordlist Scanning capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can detect active scanning. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview related_score: T1595 score_category: protect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can detect common web application attack vectors. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: detect score_value: significant - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Azure Web Application Firewall capability_group: azure_web_application_firewall capability_id: azure_web_application_firewall comments: This control can protect web applications from common attacks (e.g. SQL injection, XSS). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/web-application-firewall/overview score_category: protect score_value: significant - attack_object_id: T1003 attack_object_name: OS Credential Dumping capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only addresses a minority of this technique's procedure examples and one of its sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1003.001 attack_object_name: LSASS Memory capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Exfiltration modules, but does not address other procedures, and temporal factor is unknown, so score is Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1003 score_category: detect score_value: minimal - attack_object_id: T1005 attack_object_name: Data from Local System capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Exfiltration modules on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1012 attack_object_name: Query Registry capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Privesc-PowerUp modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1027 attack_object_name: Obfuscated Files or Information capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only covers one platform and procedure for one of this technique's sub-techniques, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1027.005 attack_object_name: Indicator Removal from Tools capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Find-AVSignature AntivirusBypass module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: detect score_value: minimal - attack_object_id: T1036 attack_object_name: Masquerading capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only addresses a minority of this technique's procedure examples and one of its sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1047 attack_object_name: Windows Management Instrumentation capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Invoke-WmiCommand module, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://learn.microsoft.com/en-us/azure/app-service/overview - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1053 attack_object_name: Scheduled Task/Job capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control does not address this technique's procedure examples and only one of its sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1053.005 attack_object_name: Scheduled Task capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the New-UserPersistenceOption Persistence module on Windows, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1053 score_category: detect score_value: minimal - attack_object_id: T1056 attack_object_name: Input Capture capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only covers one platform and procedure for one of this technique's sub-techniques, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1056.001 attack_object_name: Keylogging capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Get-Keystrokes Exfiltration module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1056 score_category: detect score_value: minimal - attack_object_id: T1057 attack_object_name: Process Discovery capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Get-ProcessTokenPrivilege PowerUp module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1059 attack_object_name: Command and Scripting Interpreter capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control provides minimal detection for this technique's procedure examples and only two of its sub-techniques (only certain specific sub-technique behaviors), resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1059.001 attack_object_name: PowerShell capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control monitors for execution of known malicious PowerShell PowerSploit cmdlets. Temporal factor is uknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1059.004 attack_object_name: Unix Shell capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control monitors host data for potential reverse shells used for command and control. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1059 score_category: detect score_value: minimal - attack_object_id: T1087 attack_object_name: Account Discovery capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only covers one platform and procedure for one of this technique's sub-techniques, and minimal coverage of its procedure examples resulting in a Minimal overall score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1087.001 attack_object_name: Local Account capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Get-ProcessTokenGroup module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1087 score_category: detect score_value: minimal - attack_object_id: T1113 attack_object_name: Screen Capture capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Get-TimedScreenshot module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1123 attack_object_name: Audio Capture capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Get-MicrophoneAudio module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1134 attack_object_name: Access Token Manipulation capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Invoke-TokenManipulation module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1204 attack_object_name: User Execution capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only provides meaningful detection for one of the technique's two sub-techniques, and the temporal factor is unknown, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1204.001 attack_object_name: Malicious Link capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control monitors for references to suspicious domain names and file downloads from known malware sources, and monitors processes for downloads from raw-data websites like Pastebin, all of which are relevant for detecting users' interactions with malicious download links, but malicious links which exploit browser vulnerabilities for execution are unlikely to be detected, and temporal factor is unknown, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1204 score_category: detect score_value: minimal - attack_object_id: T1482 attack_object_name: Domain Trust Discovery capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the Get-NetDomainTrust and Get-NetForestTrust modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1543 attack_object_name: Create or Modify System Process capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only addresses a minority of this technique's procedure examples and one of its sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1543.003 attack_object_name: Windows Service capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Privesc-PowerUp modules on Windows, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1543 score_category: detect score_value: minimal - attack_object_id: T1547 attack_object_name: Boot or Logon Autostart Execution capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only covers one platform and procedure for two of this technique's many sub-techniques, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1547.001 attack_object_name: Registry Run Keys / Startup Folder capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via New-UserPersistenceOption on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1547.005 attack_object_name: Security Support Provider capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Install-SSP module on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1547 score_category: detect score_value: minimal - attack_object_id: T1552 attack_object_name: Unsecured Credentials capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control does not address this technique's procedure example and provides minimal detection for some of its sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1552.002 attack_object_name: Credentials in Registry capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and RegistryAutoLogon modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1552 score_category: detect score_value: minimal - attack_object_id: T1552.006 attack_object_name: Group Policy Preferences capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Exfiltration modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1552 score_category: detect score_value: minimal - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this technique via the PowerSploit Exfiltration modules on Windows, but does not address other procedures or platforms, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1558 attack_object_name: Steal or Forge Kerberos Tickets capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only covers one procedure for one of this technique's sub-techniques, resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1558.003 attack_object_name: Kerberoasting capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of this sub-technique via the Invoke-Kerberoast module, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1558 score_category: detect score_value: minimal - attack_object_id: T1574 attack_object_name: Hijack Execution Flow capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only addresses a minority of this technique's procedure examples and provides minimal detection of some of its sub-techniques resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1574.001 attack_object_name: DLL Search Order Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of these sub-techniques via the Privesc-PowerUp modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1574.007 attack_object_name: Path Interception by PATH Environment Variable capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of these sub-techniques via the Privesc-PowerUp modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1574.008 attack_object_name: Path Interception by Search Order Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of these sub-techniques via the Privesc-PowerUp modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1574.009 attack_object_name: Path Interception by Unquoted Path capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect execution of known malicious PowerShell PowerSploit cmdlets. This covers execution of these sub-techniques via the Privesc-PowerUp modules, but does not address other procedures, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1574 score_category: detect score_value: minimal - attack_object_id: T1595 attack_object_name: Active Scanning capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only provides detection for one of its two sub-techniques, resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: minimal - attack_object_id: T1566 attack_object_name: Phishing capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only provides (minimal) protection for one of the technique's sub-techniques, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: protect score_value: minimal - attack_object_id: T1566.002 attack_object_name: Spearphishing Link capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control monitors for known phishing links on the Azure App Services website and generates alerts if they are detected, potentially preventing their access by users. This is a very specific avenue, only covers known links, and temporal factor is unknown, resulting in a Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1566 score_category: protect score_value: minimal - attack_object_id: T1584 attack_object_name: Compromise Infrastructure capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control only addresses one of the technique's sub-techniques, resulting in a score of Minimal. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: protect score_value: minimal - attack_object_id: T1036.005 attack_object_name: Match Legitimate Name or Location capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect processes with suspicious names, including those named in a way that is suggestive of attacker tools that try to hide in plain sight. False positives are probable, and temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1036 score_category: detect score_value: partial - attack_object_id: T1055 attack_object_name: Process Injection capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection covers all relevant sub-techniques. The control also specifically detects process hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-overview score_category: detect score_value: partial - attack_object_id: T1055.001 attack_object_name: Dynamic-link Library Injection capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.002 attack_object_name: Portable Executable Injection capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.003 attack_object_name: Thread Execution Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.004 attack_object_name: Asynchronous Procedure Call capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.005 attack_object_name: Thread Local Storage capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.008 attack_object_name: Ptrace System Calls capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.009 attack_object_name: Proc Memory capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.011 attack_object_name: Extra Window Memory Injection capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.012 attack_object_name: Process Hollowing capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.013 attack_object_name: "Process Doppelg\xE4nging" capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1055.014 attack_object_name: VDSO Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Injection attacks are specifically cited as a detection focus for Fileless Attack Detection, which is part of this control, with even more specific references to Process Hollowing, executable image injection, and threads started in a dynamically allocated code segment. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1055 score_category: detect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://learn.microsoft.com/en-us/azure/app-service/overview - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control detects binary downloads via certutil, monitors for FTP access from IP addresses found in threat intelligence, monitors for references to suspicious domain names and file downloads from known malware sources, and monitors processes for downloads from raw-data websites like Pastebin. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1140 attack_object_name: Deobfuscate/Decode Files or Information capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control analyzes host data to detect base-64 encoded executables within command sequences. It also monitors for use of certutil to decode executables. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1189 attack_object_name: Drive-by Compromise capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode injected into browser or other process memory as part of a drive-by attack. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode injected to exploit a vulnerability in a public-facing application. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1203 attack_object_name: Exploitation for Client Execution capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode injected to exploit a vulnerability in an exposed service. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1211 attack_object_name: Exploitation for Defense Evasion capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1212 attack_object_name: Exploitation for Credential Access capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1496 attack_object_name: Resource Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control detects file downloads associated with digital currency mining as well as host data related to process and command execution associated with mining. It also includes fileless attack detection, which specifically targets crypto mining activity. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1496.001 attack_object_name: Compute Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control detects file downloads associated with digital currency mining as well as host data related to process and command execution associated with mining. It also includes fileless attack detection, which specifically targets crypto mining activity. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1496.004 attack_object_name: Cloud Service Hijacking capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control detects file downloads associated with digital currency mining as well as host data related to process and command execution associated with mining. It also includes fileless attack detection, which specifically targets crypto mining activity. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1496 score_category: detect score_value: partial - attack_object_id: T1559 attack_object_name: Inter-Process Communication capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection covers the command execution aspects of both of this technique's sub-techniques. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1559.001 attack_object_name: Component Object Model capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies suspicious command execution within process memory. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1559 score_category: detect score_value: partial - attack_object_id: T1559.002 attack_object_name: Dynamic Data Exchange capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control's Fileless Attack Detection identifies suspicious command execution within process memory. Detection is periodic at an unknown rate. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1559 score_category: detect score_value: partial - attack_object_id: T1594 attack_object_name: Search Victim-Owned Websites capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control monitors for accesses of potentially sensitive web pages from source IP addresses whose access pattern resembles that of a web scanner or have not been logged before. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers score_category: detect score_value: partial - attack_object_id: T1595.002 attack_object_name: Vulnerability Scanning capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control monitors for web fingerprinting tools including nmap and Blind Elephant, as well as scanners looking for vulnerability in applications like Drupal, Joomla, and WordPress. Temporal factor is unknown. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1595 score_category: detect score_value: partial - attack_object_id: T1595.003 attack_object_name: Wordlist Scanning capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect web applications from active scanning by an adversary. Because this protection is specific to web applications (although frequent targets) and not other application types, it has been scored as Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction - https://azure.microsoft.com/en-us/services/app-service/ - https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers related_score: T1595 score_category: detect score_value: partial - attack_object_id: T1620 attack_object_name: Reflective Code Loading capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This capability analyzes host data to detect processes with suspicious attributes, including those created anonymously. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction score_category: detect score_value: partial - attack_object_id: T1027.006 attack_object_name: HTML Smuggling capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect against HTML smuggling. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.007 attack_object_name: Dynamic API Resolution capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect against abuse of dynamic API resolution. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.009 attack_object_name: Embedded Payloads capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect against embedded payloads. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.010 attack_object_name: Command Obfuscation capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect against command obfuscation attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.013 attack_object_name: Encrypted/Encoded File capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect against obsfucation via encrypted/encoded files. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.014 attack_object_name: Polymorphic Code capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This control can protect against obsfucation via polymorphic code. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1648 attack_object_name: Serverless Execution capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: This capability can protect against abuse of Azure Functions. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts score_category: protect score_value: partial - attack_object_id: T1584.001 attack_object_name: Domains capability_description: 'Microsoft Defender for Cloud: Defender for App Service' capability_group: defender_for_app_service capability_id: defender_for_app_service comments: Subdomain hijacking is a focus of this control, and its Dangling DNS detection alert feature is activated when an App Service website is decommissioned and its corresponding DNS entry is not deleted, allowing users to remove those entries before they can be leveraged by an adversary. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction related_score: T1584 score_category: protect score_value: significant - attack_object_id: T1078 attack_object_name: Valid Accounts capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: This control can protect against abuse of valid accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction score_category: protect score_value: minimal - attack_object_id: T1112 attack_object_name: Modify Registry capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: This control may scan for any stored procedures that can access the Registry and checks that permission to execute those stored procedures have been revoked from all users (other than dbo). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction score_category: protect score_value: minimal - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: This control provides recommendations to patch if SQL server is out of date and to disable unneeded features to reduce exploitable surface area. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction score_category: protect score_value: minimal - attack_object_id: T1505 attack_object_name: Server Software Component capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: This control can protect against abuse of server software components for persistence. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction score_category: protect score_value: minimal - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: 'This control may scan for users with unnecessary permissions and if SQL Server is out of date. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction score_category: protect score_value: partial - attack_object_id: T1078.001 attack_object_name: Default Accounts capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: This control may provide recommendations to disable default accounts and restrict permissions for existing accounts. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction related_score: T1078 score_category: protect score_value: partial - attack_object_id: T1505.001 attack_object_name: SQL Stored Procedures capability_description: Microsoft Defender for Azure SQL Databases capability_group: defender_for_azure_sql_databases capability_id: defender_for_azure_sql_databases comments: This control may scan for users with unnecessary access to SQL stored procedures. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction related_score: T1505 score_category: protect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may provide recommendations to avoid privileged containers and running containers as root. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: minimal - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may provide provide information about vulnerabilities within container images. The limited scope of containers and registries that are applicable to this control contribute to the lower score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: minimal - attack_object_id: T1053.007 attack_object_name: Container Orchestration Job capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control can detect when containers are created. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction related_score: T1053 score_category: detect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may alert on detection of new privileged containers and high privilege roles. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1070 attack_object_name: Indicator Removal capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may alert on deletion of Kubernetes events. Attackers might delete those events for hiding their operations in the cluster. There is no relevant sub-technique for this control but the parent applies. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1098.006 attack_object_name: Additional Container Cluster Roles capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control can detect when changes are made to containers that indicate account manipulation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction related_score: T1098 score_category: detect score_value: partial - attack_object_id: T1204 attack_object_name: User Execution capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control can detect container behavior associated with this technique. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1204.003 attack_object_name: Malicious Image capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect when containers are created or started. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction related_score: T1204 score_category: detect score_value: partial - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may scan and alert on import or creation of container images with known vulnerabilities or a possible expanded surface area for exploitation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may alert on containers with sensitive volume mounts, unneeded privileges, or running an image with digital currency mining software. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1611 attack_object_name: Escape to Host capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect escape to host. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1612 attack_object_name: Build Image on Host capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect building a container image on the host. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may alert on publicly exposed Kubernetes services. This may provide context on services that should be patched or hardened for public access. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: partial - attack_object_id: T1525 attack_object_name: Implant Internal Image capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This control may prevent adversaries from implanting malicious container images through fine grained permissions and use of container image tag signing. Image tag signing allows for verifiable container images that have been signed with legitimate keys. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: partial - attack_object_id: T1552.007 attack_object_name: Container API capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can be integrated with others to secure credentials. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction related_score: T1552 score_category: protect score_value: partial - attack_object_id: T1611 attack_object_name: Escape to Host capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can protect against escape to host attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: partial - attack_object_id: T1612 attack_object_name: Build Image on Host capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can protect against building a container image on the host. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: partial - attack_object_id: T1609 attack_object_name: Container Administration Command capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect abuse of container administration services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: significant - attack_object_id: T1610 attack_object_name: Deploy Container capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect unauthorized deployment of containers. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: significant - attack_object_id: T1613 attack_object_name: Container and Resource Discovery capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect container discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: significant - attack_object_id: T1619 attack_object_name: Cloud Storage Object Discovery capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can detect cloud storage object (blob) discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: detect score_value: significant - attack_object_id: T1609 attack_object_name: Container Administration Command capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can protect against abuse of container administration services. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: significant - attack_object_id: T1610 attack_object_name: Deploy Container capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can protect against unauthorized deployment of containers. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: significant - attack_object_id: T1613 attack_object_name: Container and Resource Discovery capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can protect against container discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: significant - attack_object_id: T1619 attack_object_name: Cloud Storage Object Discovery capability_description: Microsoft Defender for Containers capability_group: defender_for_containers capability_id: defender_for_containers comments: This capability can protect against cloud object storage (blob) discovery. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction score_category: protect score_value: significant - attack_object_id: T1580 attack_object_name: Cloud Infrastructure Discovery capability_description: Microsoft Defender for Key Vault capability_group: defender_for_key_vault capability_id: defender_for_key_vault comments: This control may alert on suspicious access of key vaults, including suspicious listing of key vault contents. This control does not alert on discovery of other cloud services, such as VMs, snapshots, cloud storage and therefore has minimal coverage. Suspicious activity based on patterns of access from certain users and applications allows for managing false positive rates. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurekv score_category: detect score_value: minimal - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: Microsoft Defender for Key Vault capability_group: defender_for_key_vault capability_id: defender_for_key_vault comments: This control may detect suspicious secret access from Azure key vaults. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-azurekv score_category: detect score_value: partial - attack_object_id: T1555.006 attack_object_name: Cloud Secrets Management Stores capability_description: Microsoft Defender for Key Vault capability_group: defender_for_key_vault capability_id: defender_for_key_vault comments: This control may detect suspicious secret access from Azure key vaults. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction related_score: T1555 score_category: detect score_value: partial - attack_object_id: T1110 attack_object_name: Brute Force capability_description: Microsoft Defender for Open-Source Relational Databases capability_group: defender_for_open_source_databases capability_id: defender_for_open_source_databases comments: This control can detect attempted or successful brute force attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases score_category: detect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: Microsoft Defender for Open-Source Relational Databases capability_group: defender_for_open_source_databases capability_id: defender_for_open_source_databases comments: This control can detect artifacts of common exploit traffic. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases score_category: detect score_value: partial - attack_object_id: T1213 attack_object_name: Data from Information Repositories capability_description: Microsoft Defender for Open-Source Relational Databases capability_group: defender_for_open_source_databases capability_id: defender_for_open_source_databases comments: This control can detect suspicious login activity. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases score_category: detect score_value: partial - attack_object_id: T1580 attack_object_name: Cloud Infrastructure Discovery capability_description: Microsoft Defender for Open-Source Relational Databases capability_group: defender_for_open_source_databases capability_id: defender_for_open_source_databases comments: This control can detect unusual activity related to cloud data object storage enumeration. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases score_category: detect score_value: partial - attack_object_id: T1595 attack_object_name: Active Scanning capability_description: Microsoft Defender for Open-Source Relational Databases capability_group: defender_for_open_source_databases capability_id: defender_for_open_source_databases comments: This control can detect traffic patterns and packet inspection associated to protocols that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows). mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases score_category: detect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on escalation attempts from Azure AD to Azure accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "PowerZure exploitation toolkit used to elevate access from Azure AD to Azure".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: minimal - attack_object_id: T1069 attack_object_name: Permission Groups Discovery capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: This control may alert on Azure domain cloud groups discovery activity but may not provide alerts for other account types or undocumented exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: minimal - attack_object_id: T1087 attack_object_name: Account Discovery capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: This control may alert on Azure cloud account discovery activity but may not provide alerts for other account types or undocumented exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: minimal - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on credential dumping from Azure Key Vaults, App Services Configurations, and Automation accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "MicroBurst exploitation toolkit used to extract secrets from your Azure key vaults", "MicroBurst exploitation toolkit used to extract keys to your storage accounts".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: minimal - attack_object_id: T1562 attack_object_name: Impair Defenses capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: This control may alert on Windows Defender security features being disabled but does not alert on other security tools or logging being disabled or tampered with. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: minimal - attack_object_id: T1069.003 attack_object_name: Cloud Groups capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on Permission Groups Discovery of Cloud Groups activity generated by specific toolkits, such as MicroBurst, PowerZure, etc. It may not generate alerts on undocumented discovery techniques or exploitation toolkits. The following alerts may be generated: "MicroBurst exploitation toolkit used to enumerate resources in your subscriptions", "Azurite toolkit run detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction related_score: T1069 score_category: detect score_value: partial - attack_object_id: T1087.004 attack_object_name: Cloud Account capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on Account Discovery of Cloud Accounts activity generated by specific toolkits, such as MicroBurst, PowerZure, etc. It may not generate alerts on undocumented discovery techniques or exploitation toolkits. The following alerts may be generated: "PowerZure exploitation toolkit used to enumerate storage containers, shares, and tables", "PowerZure exploitation toolkit used to enumerate resources", "MicroBurst exploitation toolkit used to enumerate resources in your subscriptions", "Azurite toolkit run detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction related_score: T1087 score_category: detect score_value: partial - attack_object_id: T1526 attack_object_name: Cloud Service Discovery capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on Cloud Service Discovery activity generated by specific toolkits, such as MicroBurst, PowerZure, etc. It may not generate alerts on undocumented discovery techniques or exploitation toolkits. The following alerts may be generated: "PowerZure exploitation toolkit used to enumerate storage containers, shares, and tables", "PowerZure exploitation toolkit used to enumerate resources", "MicroBurst exploitation toolkit used to enumerate resources in your subscriptions".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: partial - attack_object_id: T1538 attack_object_name: Cloud Service Dashboard capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on suspicious management activity based on IP, time, anomalous behaviour, or PowerShell usage. Machine learning algorithms are used to reduce false positives. The following alerts may be generated: "Activity from a risky IP address", "Activity from infrequent country", "Impossible travel activity", "Suspicious management session using PowerShell detected", "Suspicious management session using an inactive account detected", "Suspicious management session using Azure portal detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: partial - attack_object_id: T1562.001 attack_object_name: Disable or Modify Tools capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'The following alerts are available for Windows Defender security features being disabled but none for third party security tools: "Antimalware broad files exclusion in your virtual machine", "Antimalware disabled and code execution in your virtual machine", "Antimalware disabled in your virtual machine", "Antimalware file exclusion and code execution in your virtual machine", "Antimalware file exclusion in your virtual machine", "Antimalware real-time protection was disabled in your virtual machine", "Antimalware real-time protection was disabled temporarily in your virtual machine", "Antimalware real-time protection was disabled temporarily while code was executed in your virtual machine", "Antimalware temporarily disabled in your virtual machine", "Antimalware unusual file exclusion in your virtual machine".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction related_score: T1562 score_category: detect score_value: partial - attack_object_id: T1580 attack_object_name: Cloud Infrastructure Discovery capability_description: Microsoft Defender for Resource Manager capability_group: defender_for_resource_manager capability_id: defender_for_resource_manager comments: 'This control may alert on Cloud Infrastructure Discovery activity generated by specific toolkits, such as MicroBurst, PowerZure, etc. It may not generate alerts on undocumented discovery techniques or exploitation toolkits. The following alerts may be generated: "PowerZure exploitation toolkit used to enumerate storage containers, shares, and tables", "PowerZure exploitation toolkit used to enumerate resources", "MicroBurst exploitation toolkit used to enumerate resources in your subscriptions", "Azurite toolkit run detected".' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-resourcemanager score_category: detect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control can be configured to completely block inbound access to selected ports until access is requested. This prevents any attempt at exploitation of a public-facing application unless the attacker has the credentials and permissions to request such access. Even if permission has been granted to an authorized user to access the virtual machine, a list of authorized IP addresses for that access can be configured. The score is minimal, since this control only applies to specific applications requiring credentialed access, as opposed to a public webserver mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-api - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview score_category: protect score_value: minimal - attack_object_id: T1110 attack_object_name: Brute Force capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control can be configured to completely block inbound access to selected ports until access is requested. This prevents any attempt at brute forcing a protocol, such as RDP or SSH, unless the attacker has the credentials and permissions to request such access. Even if permission has been granted to an authorized user to access the virtual machine, a list of authorized IP addresses for that access can be configured. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-api - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview score_category: protect score_value: significant - attack_object_id: T1110.001 attack_object_name: Password Guessing capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control can be configured to completely block inbound access to selected ports until access is requested. This prevents any attempt at brute forcing a protocol, such as RDP or SSH, unless the attacker has the credentials and permissions to request such access. Even if permission has been granted to an authorized user to access the virtual machine, a list of authorized IP addresses for that access can be configured. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks related_score: T1110 score_category: protect score_value: significant - attack_object_id: T1110.003 attack_object_name: Password Spraying capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control can be configured to completely block inbound access to selected ports until access is requested. This prevents any attempt at brute forcing a protocol, such as RDP or SSH, unless the attacker has the credentials and permissions to request such access. Even if permission has been granted to an authorized user to access the virtual machine, a list of authorized IP addresses for that access can be configured. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks related_score: T1110 score_category: protect score_value: significant - attack_object_id: T1110.004 attack_object_name: Credential Stuffing capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control can be configured to completely block inbound access to selected ports until access is requested. This prevents any attempt at brute forcing a protocol, such as RDP or SSH, unless the attacker has the credentials and permissions to request such access. Even if permission has been granted to an authorized user to access the virtual machine, a list of authorized IP addresses for that access can be configured. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks related_score: T1110 score_category: protect score_value: significant - attack_object_id: T1133 attack_object_name: External Remote Services capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control can be configured to completely block inbound access to selected ports until access is requested. This prevents any attempt at utilizing external remote services, such as RDP or a VPN, unless the attacker has the credentials and permissions to request such access. Even if permission has been granted to an authorized user to access the virtual machine, a list of authorized IP addresses for that access can be configured. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-api - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview score_category: protect score_value: significant - attack_object_id: T1548.005 attack_object_name: Temporary Elevated Cloud Access capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This control may mitigate unauthorized elevated cloud access. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks related_score: T1548 score_category: protect score_value: significant - attack_object_id: T1651 attack_object_name: Cloud Administration Command capability_description: 'Microsoft Defender for Cloud: Just-in-Time VM Access' capability_group: just-in-time_vm_access capability_id: just-in-time_vm_access comments: This capability can protect against unauthorized cloud administration. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks score_category: protect score_value: significant - attack_object_id: T1027 attack_object_name: Obfuscated Files or Information capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can detect file obfuscation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: detect score_value: minimal - attack_object_id: T1027.002 attack_object_name: Software Packing capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control may detect malware that has been packed by well known software packing utilities. These utilities can provide signatures that apply to a variety of malware. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: detect score_value: minimal - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control may scan created files for malware. This control is dependent on a signature being available. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: detect score_value: minimal - attack_object_id: T1204.002 attack_object_name: Malicious File capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: 'This control monitors activity in cloud services and on virtual machines to detect malware execution. This is dependent on a signature being available. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1204 score_category: detect score_value: minimal - attack_object_id: T1566 attack_object_name: Phishing capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can detect phishing. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: detect score_value: minimal - attack_object_id: T1027 attack_object_name: Obfuscated Files or Information capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can prevent file obfuscation. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: protect score_value: minimal - attack_object_id: T1027.002 attack_object_name: Software Packing capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control may quarantine and/or delete malware that has been packed by well known software packing utilities. These utilities can provide signatures that apply to a variety of malware. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: minimal - attack_object_id: T1105 attack_object_name: Ingress Tool Transfer capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control may scan created files for malware and proceed to quarantine and/or delete the file. This control is dependent on a signature being available. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: protect score_value: minimal - attack_object_id: T1204 attack_object_name: User Execution capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against user execution. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: protect score_value: minimal - attack_object_id: T1204.002 attack_object_name: Malicious File capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: 'This control monitors activity in cloud services and on virtual machines to block malware execution. This is dependent on a signature being available. ' mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1204 score_category: protect score_value: minimal - attack_object_id: T1566 attack_object_name: Phishing capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against phishing. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples score_category: protect score_value: minimal - attack_object_id: T1566.001 attack_object_name: Spearphishing Attachment capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control may quarantine and/or delete any spearphishing attachment that has been downloaded and matches a malware signature. Customized malware without a matching signature may not generate an alert. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1566 score_category: protect score_value: minimal - attack_object_id: T1566.001 attack_object_name: Spearphishing Attachment capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control may detect any spearphishing attachment that has been downloaded and matches a malware signature. Customized malware without a matching signature may not generate an alert. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1566 score_category: detect score_value: partial - attack_object_id: T1027.006 attack_object_name: HTML Smuggling capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against HTML smuggling. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.009 attack_object_name: Embedded Payloads capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against embedded payloads. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.010 attack_object_name: Command Obfuscation capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against command obfuscation attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.011 attack_object_name: Fileless Storage capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against fileless storage attacks. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.012 attack_object_name: LNK Icon Smuggling capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against LNK icon smuggling. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.013 attack_object_name: Encrypted/Encoded File capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against obsfucation via encrypted/encoded files. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1027.014 attack_object_name: Polymorphic Code capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect against obsfucation via polymorphic code. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1027 score_category: protect score_value: partial - attack_object_id: T1036.008 attack_object_name: Masquerade File Type capability_description: Microsoft Antimalware for Azure capability_group: microsoft_antimalware_for_azure capability_id: microsoft_antimalware_for_azure comments: This control can protect from malware. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware related_score: T1036 score_category: protect score_value: partial - attack_object_id: T1059.009 attack_object_name: Cloud API capability_description: 'Microsoft Defender for Cloud: Microsoft Defender for APIs' capability_group: defender_for_apis capability_id: defender_for_apis comments: This control can detect when anomalous parameters are passed to a cloud API that could indicate abuse of a command and scripting interpreter. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-defender-for-apis related_score: T1059 score_category: detect score_value: partial - attack_object_id: T1552.007 attack_object_name: Container API capability_description: 'Microsoft Defender for Cloud: Microsoft Defender for APIs' capability_group: defender_for_apis capability_id: defender_for_apis comments: This capability can detect anomalous usage of APIs. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-introduction related_score: T1552 score_category: detect score_value: significant - attack_object_id: T1552.007 attack_object_name: Container API capability_description: 'Microsoft Defender for Cloud: Microsoft Defender for APIs' capability_group: defender_for_apis capability_id: defender_for_apis comments: This capability can support configuration of APIs to protect against access to unsecured credentials. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-introduction related_score: T1552 score_category: protect score_value: significant - attack_object_id: T1555 attack_object_name: Credentials from Password Stores capability_description: 'Microsoft Defender for Cloud: Microsoft Defender for APIs' capability_group: defender_for_apis capability_id: defender_for_apis comments: This control can protect APIs from adversaries attempting to access credentials. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-introduction score_category: protect score_value: partial - attack_object_id: T1068 attack_object_name: Exploitation for Privilege Escalation capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial - attack_object_id: T1189 attack_object_name: Drive-by Compromise capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial - attack_object_id: T1190 attack_object_name: Exploit Public-Facing Application capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial - attack_object_id: T1203 attack_object_name: Exploitation for Client Execution capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial - attack_object_id: T1210 attack_object_name: Exploitation of Remote Services capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial - attack_object_id: T1211 attack_object_name: Exploitation for Defense Evasion capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial - attack_object_id: T1212 attack_object_name: Exploitation for Credential Access capability_description: 'Microsoft Defender for Cloud: Vulnerability Management' capability_group: vulnerability_management capability_id: vulnerability_management comments: Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial. mapping_type: technique_scores references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment score_category: protect score_value: partial metadata: attack_version: '16.1' author: null capability_groups: advanced_threat_protection_for_azure_sql_database: Advanced Threat Protection for Azure SQL Database ai_security_recommendations: 'Microsoft Defender for Cloud: AI Security Recommendations' ai_threat_protection: 'Microsoft Defender for Cloud: AI Threat Protection' alerts_for_azure_cosmos_db: Alerts for Azure Cosmos DB alerts_for_azure_network_layer: Alerts for Azure Network Layer alerts_for_dns: Alerts for DNS alerts_for_linux_machines: Alerts for Linux Machines alerts_for_windows_machines: Alerts for Windows Machines azure_backup: Azure Backup azure_ddos_protection: Azure DDoS Protection azure_dedicated_hsm: Azure Dedicated HSM azure_dns_alias_records: Azure DNS Alias Records azure_dns_analytics: Azure DNS Analytics azure_firewall: Azure Firewall azure_key_vault: Azure Key Vault azure_network_security_groups: Azure Network Security Groups azure_network_watcher_traffic_analytics: 'Azure Network Watcher: Traffic Analytics' azure_policy: Azure Policy azure_private_link: Azure Private Link azure_role_based_access_control: Azure Role-Based Access Control azure_update_manager: Azure Update Manager azure_vpn_gateway: Azure VPN Gateway azure_web_application_firewall: Azure Web Application Firewall defender_for_apis: 'Microsoft Defender for Cloud: Microsoft Defender for APIs' defender_for_app_service: 'Microsoft Defender for Cloud: Defender for App Service' defender_for_azure_sql_databases: Microsoft Defender for Azure SQL Databases defender_for_containers: Microsoft Defender for Containers defender_for_key_vault: Microsoft Defender for Key Vault defender_for_open_source_databases: Microsoft Defender for Open-Source Relational Databases defender_for_resource_manager: Microsoft Defender for Resource Manager defender_for_storage: 'Microsoft Defender for Cloud: Defender for Storage' devops_security: 'Microsoft Defender for Cloud: DevOps Security' docker_host_hardening: Docker Host Hardening file_integrity_monitoring: File Integrity Monitoring just-in-time_vm_access: Just-in-Time VM Access microsoft_antimalware_for_azure: Microsoft Antimalware for Azure microsoft_sentinel: Microsoft Sentinel vulnerability_management: 'Microsoft Defender for Cloud: Vulnerability Management' contact: ctid@mitre.org creation_date: 04/26/2025 last_update: 05/29/2025 mapping_framework: azure mapping_framework_version: 04/26/2025 mapping_types: technique_scores: description: '' name: technique_scores mapping_version: '' organization: null technology_domain: enterprise