Microsoft Corporation
Leading technology company providing cloud services, productivity software, and enterprise solutions
logforge templates install microsoft
Azure Active Directory vCurrent
Microsoft's cloud-based identity and access management service providing single sign-on, multi-factor authentication, and identity protection
Authentication
Azure AD Sign-in Logs
Azure Active Directory sign-in logs capturing user authentication events with detailed device, location, and security context
Defender for Identity vCurrent
Cloud-based security solution that identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions
Security-Alerts
Pass-the-Ticket Attack Detection
Microsoft Defender for Identity alert for pass-the-ticket attacks indicating lateral movement through stolen Kerberos tickets
Office 365 vAll
Microsoft Office 365 cloud productivity suite including Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory. Logs are captured via the Office 365 Management Activity API.
Azure-Active-Directory
Azure AD Role Assignment
Records Azure Active Directory role assignment operations, particularly additions to privileged roles like Global Administrator, which represent privilege escalation and potential security risks
Exchange
Inbox Rule Created with External Forwarding
Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data
Mailbox External Forwarding Configuration
Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data
Mailbox Permission Delegation
Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data
Sharepoint
SharePoint Anonymous Link Created
Records SharePoint Online anonymous link creation events where users create publicly accessible sharing links for files or folders, enabling external access without authentication
Windows vMultiple versions supported
Microsoft Windows Operating System - comprehensive desktop and server platform
System
CLOP Ransomware Service Installation
CLOP Ransomware Service Installation - Known persistence mechanism used by CLOP ransomware family