Vendor
Microsoft Corporation
Leading technology company providing cloud services, productivity software, and enterprise solutions
meltr templates install microsoft
Product
Azure Active Directory vCurrent
Microsoft's cloud-based identity and access management service providing single sign-on, multi-factor authentication, and identity protection
Product
Defender for Identity vCurrent
Cloud-based security solution that identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions
Product
Office 365 vAll
Microsoft Office 365 cloud productivity suite including Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory. Logs are captured via the Office 365 Management Activity API.
Azure-Active-Directory
1 template →Exchange
3 templates →inbox_rule_created
Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data
mailbox_forwarding
Records Set-Mailbox operations that configure external email forwarding, a common data exfiltration technique where emails are automatically forwarded to external addresses
mailbox_permission_added
Records Add-MailboxPermission operations that grant mailbox access rights (FullAccess, SendAs, SendOnBehalf) to other users, providing persistent access that survives password resets
Microsoft Windows Operating System - comprehensive desktop and server platform