MITRE ATT&CK compliance framework
MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler azure --compliance mitre_attack_azureRequirements (46)
T1190Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.28
Attributes
- Value
Partial
- Comment
This control provides recommendations to patch if SQL server is out of date and to disable unneeded features to reduce exploitable surface area.
- Category
Protect
- Azure Service
Azure SQL Database
T1199Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.4
Attributes
- Value
Partial
- Comment
This control can isolate portions of network that do not require network-wide access, limiting some attackers that leverage trusted relationships such as remote access for vendor maintenance. Coverage partial, Temporal Immediate.
- Category
Protect
- Azure Service
Azure Virtual Network
T1078Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.[1] Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.16
Attributes
- Value
Minimal
- Comment
This control only protects cloud accounts and therefore its overall coverage is minimal resulting in a Minimal respond score for this technique.
- Category
Respond
- Azure Service
Azure AD
T1059Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.2
Attributes
- Value
Minimal
- Comment
This control provides Minimal detection for one of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
- Category
Detect
- Azure Service
Microsoft Defender for Identity
T1648Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.0
Attributes
- Value
Minimal
- Comment
Azure Policy can enforce governance requirements on serverless resources, such as requiring specific configurations for Functions, Logic Apps, and Automation accounts. Policies can restrict deployment locations, require encryption, and enforce tagging. However, protection is Minimal against serverless execution abuse as policies focus on configuration compliance rather than preventing malicious code execution within properly configured serverless resources.
- Category
Protect
- Azure Service
Azure Policy
T1204An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.2
Attributes
- Value
Minimal
- Comment
This control only provides meaningful detection for one of the technique's two sub-techniques, and the temporal factor is unknown, resulting in a score of Minimal.
- Category
Protect
- Azure Service
Microsoft Antimalware for Azure
T1098Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.15
Attributes
- Value
Partial
- Comment
This control provides protection for some of this technique's sub-techniques and therefore its coverage score factor is Partial, resulting in a Partial score.
- Category
Protect
- Azure Service
Azure Resource Manager
T1136Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.0
Attributes
- Value
Minimal
- Comment
This control only provides protection for one of this technique's sub-techniques while not providing any protection for the remaining and therefore its coverage score factor is Minimal, resulting in a Minimal score.
- Category
Protect
- Azure Service
Azure Resource Manager
T1546Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.0
Attributes
- Value
Minimal
- Comment
This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal.
- Category
Detect
- Azure Service
Azure Defender
T1651Adversaries may abuse cloud management services to execute commands within virtual machines or hybrid-joined devices. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. Similarly, in Azure AD environments, Microsoft Endpoint Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to the Azure AD.0
Attributes
- Value
Minimal
- Comment
Microsoft Intune provides script deployment capabilities that can be protected through administrative role assignments and compliance policies. However, protection is Minimal against command execution abuse as Intune is designed specifically for remote management and script execution. Authorized Intune administrators have legitimate need for these capabilities, making it difficult to prevent malicious use without impacting normal operations.
- Category
Protect
- Azure Service
Microsoft Intune
T1525Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike Upload Malware, this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.2
Attributes
- Value
Partial
- Comment
This control may alert on suspicious container images running mining software or SSH servers. Privileged Docker containers and privileged commands running within containers may also be detected. These alerts are only generated on containers in Linux endpoint machines and not for containers running from Azure Docker deployment.
- Category
Detect
- Azure Service
Azure Monitor
T1556Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.5
Attributes
- Value
Minimal
- Comment
This control provides minimal detection for one of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
- Category
Detect
- Azure Service
Microsoft Defender for Identity
T1562Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.1
Attributes
- Value
Minimal
- Comment
TDue to low detection coverage, this technique is scored as minimal.
- Category
Detect
- Azure Service
Microsoft Defender for Cloud File Integrity Monitoring
T1578An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.9
Attributes
- Value
Minimal
- Comment
The Azure Sentinel Hunting "Azure Resources assigned Public IP addresses" query detect suspicious IP address changes.
- Category
Detect
- Azure Service
Azure Sentinel
T1535Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.0
Attributes
- Value
Partial
- Comment
This control can detect unusual region and activity for cloud resources (preview feature as of this writing). Relevant alert is "Suspicious creation activity for cloud region".
- Category
Detect
- Azure Service
Microsoft Cloud App Security
T1550Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.10
Attributes
- Value
Partial
- Comment
This control provides recommendations that lead to protections for some of the sub-techniques of this technique. Due to it only providing a recommendation, its score has been capped at Partial.
- Category
Protect
- Azure Service
Azure AD Identity Secure Score
T1110Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.0
Attributes
- Value
Significant
- Comment
This control provides significant protection against this brute force technique by completing obviating the need for passwords by replacing it with passwordless credentials.
- Category
Protect
- Azure Service
Azure AD Passwordless Authentication
T1606Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.5
Attributes
- Value
Partial
- Comment
This control's "Turn on sign-in risk policy" and "Turn on user risk policy" recommendations recommend the usage of Azure AD Identity Protection which can detect one of the sub-techniques of this technique. This is a recommendation and therefore the score is capped at Partial.
- Category
Detect
- Azure Service
Azure AD Identity Secure Score
T1621Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.0
Attributes
- Value
Partial
- Comment
Azure AD Identity Protection can detect risk associated with unusual authentication patterns and repeated MFA attempts. Identity Protection's risk detections can identify anomalous user behavior that may indicate MFA bombing. However, coverage is Partial as Identity Protection focuses on broader authentication risks and may not specifically identify all MFA fatigue attack patterns, especially those that mimic legitimate behavior.
- Category
Detect
- Azure Service
Azure AD Identity Protection
T1040Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.21
Attributes
- Value
Minimal
- Comment
This control may recommend usage of TLS to encrypt communication between the Docker daemon and clients. This can prevent possible leakage of sensitive information through network sniffing.
- Category
Protect
- Azure Service
Azure Security Center Docker Host Hardening
T1552Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Bash History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).1
Attributes
- Value
Minimal
- Comment
This control provides protection for one of this technique's sub-techniques, while not providing any protection for its procedure examples nor its remaining sub-techniques, resulting in an overall Minimal score.
- Category
Protect
- Azure Service
Managed identities for Azure resources
T1048Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.6
Attributes
- Value
Minimal
- Comment
This control provides Partial detection for one of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
- Category
Detect
- Azure Service
Network Security Groups
T1537Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.1
Attributes
- Value
Minimal
- Comment
This control may provide recommendations to enable security controls that monitor and prevent malicious transfer of data to cloud accounts.
- Category
Protect
- Azure Service
Azure Policy
T1119Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools.4
Attributes
- Value
Minimal
- Comment
The following Azure Sentinel Hunting queries can identify potentially malicious automated collection: "Multiple large queries made by user" and "Query data volume anomolies" can identify that automated queries are being used to collect data in bulk. "New ServicePrincipal running queries" can indicate that an application is performing automated collection via queries.The following Azure Sentinel Analytics queries can identify potentially malicious automated collection: "Mass secret retrieval from Azure Key Vault" and "Azure Key Vault access TimeSeries anomaly" can detect a sudden increase in access counts, which may indicate that an adversary is dumping credentials via automated methods. "Users searching for VIP user activity" can identify potentially suspicious Log Analytics queries by users looking for a listing of 'VIP' activity.The coverage for these queries is minimal (applicable to specific technologies) resulting in an overall Minimal score.
- Category
Detect
- Azure Service
Azure Sentinel
T1530Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.[5][6][7] There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.16
Attributes
- Value
Partial
- Comment
This control can be used to limit the number of users that have access to storage solutions except for the applications, users, and services that require access, thereby reducing the attack surface.
- Category
Protect
- Azure Service
Azure Resource Manager
T1213Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.0
Attributes
- Value
Minimal
- Comment
This control only provides the ability to restrict an adversary from collecting valuable information for a limited set of applications (SharePoint, Exchange, OneDrive) and therefore its overall Coverage score is minimal.
- Category
Protect
- Azure Service
Conditional Access
T1074Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.0
Attributes
- Value
Minimal
- Comment
This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can lead to mitigating a sub-technique of this technique by preventing modification of the local filesystem. Due to it being a recommendation, its score is capped at Partial.
- Category
Detect
- Azure Service
Azure Sentinel
T1485Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.[1][2][3][4][5][6] Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.7
Attributes
- Value
Partial
- Comment
This control can identify deletion activity which could be potential malicious data destruction. Relevant Alerts include "Multiple storage deletion activities", "Multiple VM deletion activity", "Unusual file deletion activity (by user), "Suspicous email deletion activiy", and "Ransomware activity".
- Category
Detect
- Azure Service
Cloud App Security Policies
T1486Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.17
Attributes
- Value
Partial
- Comment
This control can detect a range of ransomware-related activities including encryption. Relevant alert include "Ransomware activities" and "Unusual file deletion activity (by user)".
- Category
Detect
- Azure Service
Cloud App Security Policies
T1491Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.0
Attributes
- Value
Significant
- Comment
Data backups provide a significant response to data defacement attacks by enabling the restoration of data from backup.
- Category
Respond
- Azure Service
Azure Backup
T1499Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes[1] and to support other malicious activities, including distraction[2], hacktivism, and extortion.20
Attributes
- Value
Partial
- Comment
This control provides partial protection for a majority of this control's sub-techinques and procedure examples resulting in overall score of Partial.
- Category
Protect
- Azure Service
Network Security Groups
T1490Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.[1][2] This may deny access to available backups and recovery options.0
Attributes
- Value
Minimal
- Comment
The Azure Sentinel Analytics "Sensitive Azure Key Vault Operations" query can identify potential attacker activity intended to interfere with backups.
- Category
Detect
- Azure Service
Azure Sentinel
T1496Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems, which may impact system and/or hosted service availability.10
Attributes
- Value
Partial
- Comment
This control can identify some behaviors that are potential instances of resource hijacking. Relevant alerts include "Multiple VM Creation activities" and "Suspicious creation activity for cloud region".
- Category
Detect
- Azure Service
Cloud App Security Policies
T1498Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes[1] and to support other malicious activities, including distraction[2], hacktivism, and extortion.5
Attributes
- Value
Partial
- Comment
This control can be used to restrict access to endpoints and thereby mitigate low-end network DOS attacks.
- Category
Protect
- Azure Service
Network Security Groups
T1087Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts).2
Attributes
- Value
Minimal
- Comment
This control only provides protection for one of this technique's sub-techniques while not providing any protection for its procedure examples nor its remaining sub-technqiues and therefore its coverage score factor is Minimal, resulting in a Minimal score.
- Category
Detect
- Azure Service
Azure Resource Manager Role Based Access Control
T1580An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.9
Attributes
- Value
Partial
- Comment
This control can be used to limit the number of users that have privileges to discover cloud infrastructure thereby reducing an organization's cloud infrastructure attack surface.
- Category
Protect
- Azure Service
Azure Resource Manager Role Based Access Control
T1538An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.2
Attributes
- Value
Partial
- Comment
This control may provide recommendations to enable Azure services that limit access to Azure Resource Manager and other Azure dashboards. Several Azure services and controls provide mitigations against this technique.
- Category
Protect
- Azure Service
Azure Policy
T1526An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.1
Attributes
- Value
Partial
- Comment
This control can detect anomalous user activity that may be associated with cloud service discovery. Relevant alert is "Unusual file share activty (by user)".
- Category
Detect
- Azure Service
Cloud App Security Policies
T1619Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.0
Attributes
- Value
Minimal
- Comment
Azure Activity Log captures control plane operations for storage accounts but provides only Minimal detection for storage object enumeration. Activity Log records storage account management operations like creating containers but does not capture data plane operations like listing individual blobs. For comprehensive enumeration detection, Storage Analytics Logs are required.
- Category
Detect
- Azure Service
Azure Activity Log
T1046Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.5
Attributes
- Value
Partial
- Comment
This control can be used to restrict access to trusted networks.
- Category
Protect
- Azure Service
Network Security Groups
T1201Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).3
Attributes
- Value
Minimal
- Comment
This control's "Active Directory attributes reconnaissance (LDAP) (external ID 2210)" alert may be able to detect this operation. There are statements in the documentation for the alert, such as: "Active Directory LDAP reconnaissance is used by attackers to gain critical information about the domain environment. This information can help attackers map the domain structure ...", that may indicate support for detecting this technique. The level of detection though is unknown and therefore a conservative assessment of a Minimal score is assigned.
- Category
Detect
- Azure Service
Microsoft Defender for Identity
T1049Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.1
Attributes
- Value
Minimal
- Comment
The Azure Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can enumerate the current network connections of a host, but does not address other procedures.
- Category
Detect
- Azure Service
Azure Sentinel
T1614Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.0
Attributes
- Value
Minimal
- Comment
Azure Virtual Network provides Minimal protection against system location discovery. While network security groups and virtual network configurations can restrict network access, adversaries with VM access can still query location information through Azure APIs and the Azure Instance Metadata Service. Network controls focus on connectivity rather than preventing location enumeration.
- Category
Protect
- Azure Service
Azure Virtual Network
T1082An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.0
Attributes
- Value
Minimal
- Comment
This control may detect local reconnaissance activity specific to using the systeminfo commands. The following alerts may be generated: "Detected possible local reconnaissance activity".
- Category
Detect
- Azure Service
Azure Sentinel
T1518Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.0
Attributes
- Value
Minimal
- Comment
This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures.
- Category
Detect
- Azure Service
Azure Sentinel
T1069Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.1
Attributes
- Value
Minimal
- Comment
This control provides significant detection for one of this technique's sub-techniques, while not providing any detection for the remaining, resulting in a Minimal score.
- Category
Detect
- Azure Service
Microsoft Defender for Identity