M365 DO365-TE-E5 Mappings

With Threat Explorer tools, you can see malware detected by Microsoft 365 security features, view phishing URL and click verdict data, start an automated investigation and response process from a view in Explorer, investigate malicious email, and more.

Mappings

Capability ID Capability Description Category Value ATT&CK ID ATT&CK Name Notes
DO365-TE-E5 Threat Explorer detect partial T1656 Impersonation
Comments
Threat Explorer helps your security operations team investigate and respond to threats efficiently. With these tools, you can: See malware detected by Microsoft 365 security features, View phishing URL and click verdict data, Start an automated investigation and response process from a view in Explorer, Investigate malicious email, and more. Threat Explorer Detects Impersonation attacks by their dashboard capturing and enabling the user to view phishing attempts, including a list of URLs that were allowed, blocked, and overridden. With an organization blocking URL's for users, it mitigates users visiting a website that is used to host the adversary controlled content. License Requirements: Microsoft Defender for Office 365 plan 1 and plan 2, Microsoft Defender XDR
References
DO365-TE-E5 Threat Explorer detect partial T1189 Drive-by Compromise
Comments
Threat Explorer helps your security operations team investigate and respond to threats efficiently. With these tools, you can: See malware detected by Microsoft 365 security features, View phishing URL and click verdict data, Start an automated investigation and response process from a view in Explorer, Investigate malicious email, and more. Threat Explorer Detects Drive-by-Compromise attacks by their dashboard capturing and enabling the user to view phishing attempts, including a list of URLs that were allowed, blocked, and overridden. With an organization blocking URL's for users, it mitigates users visiting a website that is used to host the adversary controlled content. License Requirements: Microsoft Defender for Office 365 plan 1 and plan 2, Microsoft Defender XDR
References
DO365-TE-E5 Threat Explorer detect partial T1566 Phishing
Comments
Threat Explorer helps your security operations team investigate and respond to threats efficiently. With these tools, you can: See malware detected by Microsoft 365 security features, View phishing URL and click verdict data, Start an automated investigation and response process from a view in Explorer, Investigate malicious email, and more. Threat Explorer Detects Phishing attacks by their dashboard capturing and enabling the user to view phishing attempts, including a list of URLs that were allowed, blocked, and overridden. License Requirements: Microsoft Defender for Office 365 plan 1 and plan 2, Microsoft Defender XDR
References
DO365-TE-E5 Threat Explorer detect partial T1566.002 Spearphishing Link
Comments
Threat Explorer helps your security operations team investigate and respond to threats efficiently. With these tools, you can: See malware detected by Microsoft 365 security features, View phishing URL and click verdict data, Start an automated investigation and response process from a view in Explorer, Investigate malicious email, and more. Threat Explorer Detects Spearphishing Link attacks by their dashboard capturing and enabling the user to view phishing attempts, including a list of URLs that were allowed, blocked, and overridden. License Requirements: Microsoft Defender for Office 365 plan 1 and plan 2, Microsoft Defender XDR
References
DO365-TE-E5 Threat Explorer detect partial T1566.001 Spearphishing Attachment
Comments
Threat Explorer helps your security operations team investigate and respond to threats efficiently. With these tools, you can: See malware detected by Microsoft 365 security features, View phishing URL and click verdict data, Start an automated investigation and response process from a view in Explorer, Investigate malicious email, and more. Threat Explorer Detects Spearphishing Attachment attacks by using Threat Explorer's System Override feature. The File extension blocked by org policy value, enables An organization's security team to block a file name extension through the anti-malware policy settings. These values will now be displayed in email details to help with investigations. Secops teams can also use the rich-filtering capability to filter on blocked file extensions. License Requirements: Microsoft Defender for Office 365 plan 1 and plan 2, Microsoft Defender XDR
References