MITRE ATT&CK Techniques in the Microsoft 365 Audit Log

Mapping ATT&CK to What Microsoft 365 Actually Records

MITRE ATT&CK describes adversary behaviour in the abstract. The Microsoft 365 unified audit log records concrete operations: a file downloaded, a sharing link created, a sign-in from a new country, an audit setting changed. Detection work is the translation between the two, and that translation is rarely written down.

This is a reference for that translation. For each technique, it gives the operations in SharePoint, OneDrive and Entra ID that evidence it, and the signal that distinguishes the technique from ordinary activity producing the same events.

The technique IDs are the stable part. Names occasionally change between ATT&CK versions, so each entry links to attack.mitre.org as the source of truth.

Impact

Technique	ID	What it looks like in Microsoft 365
Data Encrypted for Impact	T1486	Encrypt-and-replace: modify, delete and upload against the same content in one window. Or an encrypt-in-place burst, high modification volume across many distinct files. Files carrying known ransomware extensions are the unambiguous marker.
Data Destruction	T1485	A deleted-file count crossing a threshold for that account. The hard part is separating destruction from a folder move, since SharePoint has no move-between-sites operation.

The two are distinct and worth keeping distinct. A plain bulk delete is recoverable from the recycle bin; an encrypt-in-place rewrite is not. Treating every large delete as ransomware is how teams learn to ignore the alert. See SharePoint mass deletion for the signals that separate them.

Exfiltration

Technique	ID	What it looks like in Microsoft 365
Exfiltration to Cloud Storage	T1567.002	Download volume crossing an envelope threshold: total bytes, manual downloads with sync excluded, or downloads of sensitivity-labelled files.
Exfiltration Over Web Service	T1567	An anonymous sharing link being used. The content left the tenant to somebody who never authenticated.
Data from Cloud Storage	T1530	Risky sharing: anonymous link creation, sharing to an external party, sharing to a partner domain, or organisation-wide sharing. Four different risks, worth four different severities.

The measurement trap here is that most apparent downloads are not downloads. Office Online fetches a document's bytes repeatedly while rendering it, browsers pull large PDFs in chunks, and preview generation reads files in bulk. None of it leaves the tenant. See SharePoint audit log noise.

Valid Accounts and Account Manipulation

Technique	ID	What it looks like in Microsoft 365
Valid Accounts: Cloud Accounts	T1078.004	Sign-ins from two countries too far apart for the elapsed time, a first-ever country for that account, or SharePoint activity spanning several geographies. Also a site collection administrator grant.
Valid Accounts	T1078	The behavioural family: activity outside an account's established hours, an unfamiliar user agent, a velocity burst, access from an unmanaged device, deviation from the account's own baseline or from its peer group. Also a DLP policy override.
Account Manipulation	T1098	An external user being added to a group, which quietly extends access to everything that group can reach.

T1078 is the one that carries most of the practical weight, and it is also the hardest, because "valid account behaving unusually" only means anything relative to a baseline of that account's own normal. Absolute thresholds cannot express it: 200 downloads is routine for one role and alarming for another.

Note the geography traps. Most sign-ins egress through Microsoft's infrastructure, an office gateway or a cloud proxy, so the country in the log is often the network's rather than the person's. Impossible travel in Microsoft 365 covers the discriminators.

Credential Access

Technique	ID	What it looks like in Microsoft 365
Brute Force: Password Spraying	T1110.003	Multiple accounts failing authentication from one source. Lockouts following the same pattern raise it further.
Multi-Factor Authentication Request Generation	T1621	Repeated MFA prompts against one account, the fatigue attack: push until the user approves to make it stop.
Steal Application Access Token	T1528	An OAuth consent grant to an application. Severity scales with the scopes requested, because consent to read all mail is a different event from consent to read a profile.

T1528 is the most under-watched of the three. Consent phishing needs no password and survives a password reset, because the attacker holds a token rather than a credential. It also generates almost no volume, so threshold-based alerting misses it entirely.

Two false-positive patterns on T1110.003 are worth knowing: colleagues behind one office NAT gateway each mistyping a password, and clients automatically retrying with an expired token, which Microsoft surfaces with an error code such as FlowTokenExpired. Neither is an attack.

Discovery and Reconnaissance

Technique	ID	What it looks like in Microsoft 365
File and Directory Discovery	T1083	Search enumeration: an unusual volume of searches, searches against sensitive terms, first access to many sites, or search behaviour departing from the account's own baseline.
Gather Victim Identity Information: Email Addresses	T1589.002	Username enumeration, probing which addresses exist by observing how authentication responds.

Search is a genuinely useful early signal, because reconnaissance precedes collection. Somebody working out where the sensitive material lives searches before they download. The trap is that the SharePoint start page fetches a __siteIcon__ resource per site card, which registers as visiting many sites in seconds.

Command and Control

Technique	ID	What it looks like in Microsoft 365
Proxy: Multi-hop Proxy	T1090.003	Access originating from Tor or a known anonymising network.
Application Layer Protocol	T1071	Access from an IP on a threat intelligence list.

Both are unusual in this set because they need no baseline. A single event is meaningful: there is no legitimate business reason for tenant access to arrive over Tor.

Defense Evasion

Technique	ID	What it looks like in Microsoft 365
Impair Defenses: Disable or Modify Cloud Logs	T1562.008	Audit configuration being altered. Somebody turning off the recording of their own activity.
Impair Defenses	T1562	Sensitivity label tampering, downgrading or removing a label to move content past controls keyed to it.
Indicator Removal	T1070	A burst of recycle bin restores.

T1562.008 deserves the highest severity in any Microsoft 365 detection set. Every other technique here is evidenced by audit data. This one attacks the evidence itself, and if it succeeds, subsequent activity leaves no trace to alert on.

T1070 is the subtle one. A restore burst on its own is usually benign, somebody undoing a mistake. Following a bulk delete by the same account on the same day, it is either a correction or an attempt to tidy up after one, and both are worth knowing about.

Execution

Technique	ID	What it looks like in Microsoft 365
User Execution: Malicious File	T1204.002	Malware detected in a document library.

Why the Audit Log Alone Does Not Give You This

The unified audit log records every operation above. It does not classify them, and three gaps make manual mapping impractical at scale.

No alerting. It is a queryable record, not a monitoring system. Nothing tells you a technique was evidenced; somebody has to go and look.

No correlation. Several techniques are only visible in combination. A new-country sign-in is weak evidence alone and strong evidence followed by a bulk download. Correlating those means joining Entra ID sign-in data to SharePoint file activity across a window, per account.

A retention limit. Audit data does not persist indefinitely, and the window is usually shorter than the interval between an incident happening and anyone noticing.

The methods and their limits are covered in SharePoint audit log.

Where Burrow Fits

Burrow implements this mapping as detection rules over SharePoint and Entra ID audit events, with per-user behavioural baselines for the T1078 family that absolute thresholds cannot express. Every alert carries the ATT&CK technique it represents, so it arrives in vocabulary your analysts, your incident response runbook and your compliance evidence pack already use. Alerts are delivered by email, and Burrow is a SaaS addon to the Squirrel platform rather than a separate deployment.

The full per-rule reference, including thresholds and tuning guidance, is in the Burrow rule catalog.

Frequently Asked Questions

Which MITRE ATT&CK techniques apply to Microsoft 365?

The commonly evidenced set in SharePoint, OneDrive and Entra ID audit data is T1486 and T1485 for ransomware and destruction; T1567, T1567.002 and T1530 for exfiltration and risky sharing; T1078 and T1078.004 for valid account abuse; T1098 for account manipulation; T1110.003 and T1621 for credential attacks; T1528 for OAuth token theft; T1083 and T1589.002 for discovery and reconnaissance; T1090.003 and T1071 for anonymised access; T1562, T1562.008 and T1070 for defence evasion; and T1204.002 for malicious files.

What MITRE technique covers ransomware in SharePoint?

T1486, Data Encrypted for Impact. It is distinct from T1485, Data Destruction, which covers deletion intended to make data unavailable. The distinction matters operationally: content deleted to the recycle bin is generally recoverable, content encrypted in place is not.

What technique covers data exfiltration from Microsoft 365?

T1567.002, Exfiltration to Cloud Storage, is the usual mapping for bulk download activity. T1567, Exfiltration Over Web Service, fits anonymous link usage where content leaves the tenant to an unauthenticated party. T1530, Data from Cloud Storage, covers risky sharing that exposes content without a download having occurred yet.

Which ATT&CK technique covers audit log tampering?

T1562.008, Disable or Modify Cloud Logs, a sub-technique of T1562 Impair Defenses. It warrants the highest severity in a Microsoft 365 detection set, because every other detection depends on the audit data this technique targets.

Can the Microsoft 365 audit log detect ATT&CK techniques on its own?

It records the underlying operations but does not classify or alert on them. It has no alerting, no cross-source correlation between Entra ID sign-ins and SharePoint activity, and a finite retention window. Mapping events to techniques and raising alerts requires a tool that reads the log continuously.

What is the difference between T1078 and T1078.004?

T1078, Valid Accounts, is the parent covering adversary use of legitimate credentials. T1078.004, Cloud Accounts, is the sub-technique specific to cloud identities such as Entra ID. Geography-based detections like impossible travel and first-time-country sign-ins map to the sub-technique; behavioural deviation on an authenticated account generally maps to the parent.

Related reading

• SharePoint audit log noise: platform activity that looks like an attack
• SharePoint mass deletion: telling an attack from a folder move
• Impossible travel in Microsoft 365: why the alerts cry wolf
• SharePoint audit log monitoring and alerts
• SharePoint external sharing: secure configuration guide

From Technique to Alert

A mapping is only useful if something acts on it. See how Burrow turns Microsoft 365 audit events into MITRE-tagged alerts. Questions: sales@smikar.com.