Atomic Red Team doc generator
1.2 KiB
1.2 KiB
| 1 | Tactic | Technique # | Technique Name | Test # | Test Name | Test GUID | Executor Name |
|---|---|---|---|---|---|---|---|
| 2 | collection | T1114.003 | Email Collection: Email Forwarding Rule | 1 | Office365 - Email Forwarding | 3234117e-151d-4254-9150-3d0bac41e38c | powershell |
| 3 | collection | T1114.002 | Email Collection: Remote Email Collection | 1 | Office365 - Remote Mail Collected | 36657d95-d9d6-4fbf-8a31-f4085607bafd | powershell |
| 4 | defense-evasion | T1564.008 | Hide Artifacts: Email Hiding Rules | 1 | New-Inbox Rule to Hide E-mail in M365 | 30f7d3d1-78e2-4bf0-9efa-a175b5fce2a9 | powershell |
| 5 | defense-evasion | T1562.008 | Impair Defenses: Disable Cloud Logs | 3 | Office 365 - Exchange Audit Log Disabled | 1ee572f3-056c-4632-a7fc-7e7c42b1543c | powershell |
| 6 | defense-evasion | T1562.008 | Impair Defenses: Disable Cloud Logs | 9 | Office 365 - Set Audit Bypass For a Mailbox | c9a2f6fe-7197-488c-af6d-10c782121ca6 | powershell |
| 7 | persistence | T1098.002 | Account Manipulation: Additional Email Delegate Permissions | 1 | EXO - Full access mailbox permission granted to a user | 17d046be-fdd0-4cbb-b5c7-55c85d9d0714 | powershell |
| 8 | privilege-escalation | T1098.002 | Account Manipulation: Additional Email Delegate Permissions | 1 | EXO - Full access mailbox permission granted to a user | 17d046be-fdd0-4cbb-b5c7-55c85d9d0714 | powershell |