{
  "name": "TheCloud.Events — cloud log evidence (Azure)",
  "versions": {
    "attack": "19",
    "navigator": "5.1.0",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Techniques scored by how many cloud audit events in the TheCloud.Events catalog (79 Azure events) produce log evidence for them. Each technique's links open the event pages with sample logs, analyst notes, and key fields. Generated from https://thecloud.events/.",
  "sorting": 0,
  "layout": {
    "layout": "side",
    "aggregateFunction": "max",
    "showID": true,
    "showName": true,
    "showAggregateScores": false,
    "countUnscored": false
  },
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1021",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: Azure Microsoft.ContainerService/managedClusters/runCommand/action, Azure Microsoft.SerialConsole/serialPorts/connect/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.ContainerService/managedClusters/runCommand/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-runcommand-action/"
        },
        {
          "label": "Azure Microsoft.SerialConsole/serialPorts/connect/action",
          "url": "https://thecloud.events/events/azure-microsoft-serialconsole-serialports-connect-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1021.004",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Compute/sshPublicKeys/write",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Compute/sshPublicKeys/write",
          "url": "https://thecloud.events/events/azure-microsoft-compute-sshpublickeys-write/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1059",
      "score": 8,
      "color": "",
      "comment": "8 events in the catalog produce evidence for this technique: Azure Microsoft.Automation/automationAccounts/jobs/write, Azure Microsoft.Automation/automationAccounts/runbooks/write, Azure Microsoft.Automation/automationAccounts/webhooks/action, Azure Microsoft.Compute/virtualMachines/extensions/write, Azure Microsoft.Compute/virtualMachines/runCommand/action, Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension), Azure Microsoft.ContainerService/managedClusters/runCommand/action, Azure Microsoft.SerialConsole/serialPorts/connect/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Automation/automationAccounts/jobs/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-jobs-write/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/runbooks/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-runbooks-write/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/webhooks/action",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-action/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/extensions/write",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-extensions-write/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/runCommand/action",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-runcommand-action/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-write-customscript/"
        },
        {
          "label": "Azure Microsoft.ContainerService/managedClusters/runCommand/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-runcommand-action/"
        },
        {
          "label": "Azure Microsoft.SerialConsole/serialPorts/connect/action",
          "url": "https://thecloud.events/events/azure-microsoft-serialconsole-serialports-connect-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1072",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: Azure Microsoft.Automation/automationAccounts/jobs/write, Azure Microsoft.Automation/automationAccounts/runbooks/write, Azure Microsoft.Automation/automationAccounts/webhooks/action, Azure Microsoft.Automation/automationAccounts/webhooks/write",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Automation/automationAccounts/jobs/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-jobs-write/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/runbooks/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-runbooks-write/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/webhooks/action",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-action/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/webhooks/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-write/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1078.004",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Authorization/elevateAccess/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Authorization/elevateAccess/action",
          "url": "https://thecloud.events/events/azure-microsoft-authorization-elevateaccess-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098",
      "score": 9,
      "color": "",
      "comment": "9 events in the catalog produce evidence for this technique: Azure Add Owner To Application, Azure Add Owner To Group, Azure Add User, Azure Admin Registered Security Info, Azure Consent To Application, Azure Microsoft.KeyVault/vaults/accessPolicies/write, Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action, Azure Reset User Password, Azure Update User Authentication Methods",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Add Owner To Application",
          "url": "https://thecloud.events/events/azure-add-owner-to-application/"
        },
        {
          "label": "Azure Add Owner To Group",
          "url": "https://thecloud.events/events/azure-add-owner-to-group/"
        },
        {
          "label": "Azure Add User",
          "url": "https://thecloud.events/events/azure-add-user/"
        },
        {
          "label": "Azure Admin Registered Security Info",
          "url": "https://thecloud.events/events/azure-admin-registered-security-info/"
        },
        {
          "label": "Azure Consent To Application",
          "url": "https://thecloud.events/events/azure-consent-to-application/"
        },
        {
          "label": "Azure Microsoft.KeyVault/vaults/accessPolicies/write",
          "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-accesspolicies-write/"
        },
        {
          "label": "Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
          "url": "https://thecloud.events/events/azure-microsoft-managedidentity-userassignedidentities-assign-action/"
        },
        {
          "label": "Azure Reset User Password",
          "url": "https://thecloud.events/events/azure-reset-user-password/"
        },
        {
          "label": "Azure Update User Authentication Methods",
          "url": "https://thecloud.events/events/azure-update-user-authentication-methods/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.001",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: Azure Add Federated Identity Credential, Azure Microsoft.Directory/servicePrincipals/credentials/update",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Add Federated Identity Credential",
          "url": "https://thecloud.events/events/azure-add-federated-identity-credential/"
        },
        {
          "label": "Azure Microsoft.Directory/servicePrincipals/credentials/update",
          "url": "https://thecloud.events/events/azure-microsoft-directory-serviceprincipals-credentials-update/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.003",
      "score": 7,
      "color": "",
      "comment": "7 events in the catalog produce evidence for this technique: Azure Add App Role Assignment To Service Principal, Azure Add Eligible Member To Role In Pim Completed, Azure Add Member To Role, Azure Add Role Definition, Azure Microsoft.Authorization/roleAssignments/write, Azure Microsoft.Directory/groups/members/update, Azure Update Role Definition",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Add App Role Assignment To Service Principal",
          "url": "https://thecloud.events/events/azure-add-app-role-assignment-to-service-principal/"
        },
        {
          "label": "Azure Add Eligible Member To Role In Pim Completed",
          "url": "https://thecloud.events/events/azure-add-eligible-member-to-role-in-pim-completed/"
        },
        {
          "label": "Azure Add Member To Role",
          "url": "https://thecloud.events/events/azure-add-member-to-role/"
        },
        {
          "label": "Azure Add Role Definition",
          "url": "https://thecloud.events/events/azure-add-role-definition/"
        },
        {
          "label": "Azure Microsoft.Authorization/roleAssignments/write",
          "url": "https://thecloud.events/events/azure-microsoft-authorization-roleassignments-write/"
        },
        {
          "label": "Azure Microsoft.Directory/groups/members/update",
          "url": "https://thecloud.events/events/azure-microsoft-directory-groups-members-update/"
        },
        {
          "label": "Azure Update Role Definition",
          "url": "https://thecloud.events/events/azure-update-role-definition/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.004",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Compute/sshPublicKeys/write",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Compute/sshPublicKeys/write",
          "url": "https://thecloud.events/events/azure-microsoft-compute-sshpublickeys-write/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1136.003",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: Azure Add Application, Azure Add Service Principal, Azure Add User, Azure Invite External User",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Add Application",
          "url": "https://thecloud.events/events/azure-add-application/"
        },
        {
          "label": "Azure Add Service Principal",
          "url": "https://thecloud.events/events/azure-add-service-principal/"
        },
        {
          "label": "Azure Add User",
          "url": "https://thecloud.events/events/azure-add-user/"
        },
        {
          "label": "Azure Invite External User",
          "url": "https://thecloud.events/events/azure-invite-external-user/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1484.002",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Add Verified Domain",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Add Verified Domain",
          "url": "https://thecloud.events/events/azure-add-verified-domain/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1485",
      "score": 10,
      "color": "",
      "comment": "10 events in the catalog produce evidence for this technique: Azure Microsoft.Authorization/locks/delete, Azure Microsoft.Compute/virtualMachines/delete, Azure Microsoft.EventHub/namespaces/eventhubs/delete, Azure Microsoft.KeyVault/vaults/delete, Azure Microsoft.KeyVault/vaults/secrets/delete, Azure Microsoft.OperationalInsights/workspaces/delete, Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete, Azure Microsoft.Sql/servers/databases/delete, Azure Microsoft.Storage/storageAccounts/blobServices/containers/delete, Azure Microsoft.Storage/storageAccounts/delete",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Authorization/locks/delete",
          "url": "https://thecloud.events/events/azure-microsoft-authorization-locks-delete/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/delete",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-delete/"
        },
        {
          "label": "Azure Microsoft.EventHub/namespaces/eventhubs/delete",
          "url": "https://thecloud.events/events/azure-microsoft-eventhub-namespaces-eventhubs-delete/"
        },
        {
          "label": "Azure Microsoft.KeyVault/vaults/delete",
          "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-delete/"
        },
        {
          "label": "Azure Microsoft.KeyVault/vaults/secrets/delete",
          "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-secrets-delete/"
        },
        {
          "label": "Azure Microsoft.OperationalInsights/workspaces/delete",
          "url": "https://thecloud.events/events/azure-microsoft-operationalinsights-workspaces-delete/"
        },
        {
          "label": "Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete",
          "url": "https://thecloud.events/events/azure-microsoft-recoveryservices-vaults-backupprotecteditems-delete/"
        },
        {
          "label": "Azure Microsoft.Sql/servers/databases/delete",
          "url": "https://thecloud.events/events/azure-microsoft-sql-servers-databases-delete/"
        },
        {
          "label": "Azure Microsoft.Storage/storageAccounts/blobServices/containers/delete",
          "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-blobservices-containers-delete/"
        },
        {
          "label": "Azure Microsoft.Storage/storageAccounts/delete",
          "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-delete/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1490",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete",
          "url": "https://thecloud.events/events/azure-microsoft-recoveryservices-vaults-backupprotecteditems-delete/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1526",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-listclusteradmincredential-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1528",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Consent To Application",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Consent To Application",
          "url": "https://thecloud.events/events/azure-consent-to-application/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1530",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: Azure CopyBlob, Azure Microsoft.Compute/disks/beginGetAccess/action, Azure Microsoft.Compute/snapshots/beginGetAccess/action, Azure Microsoft.Sql/servers/databases/export/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure CopyBlob",
          "url": "https://thecloud.events/events/azure-copyblob/"
        },
        {
          "label": "Azure Microsoft.Compute/disks/beginGetAccess/action",
          "url": "https://thecloud.events/events/azure-microsoft-compute-disks-begingetaccess-action/"
        },
        {
          "label": "Azure Microsoft.Compute/snapshots/beginGetAccess/action",
          "url": "https://thecloud.events/events/azure-microsoft-compute-snapshots-begingetaccess-action/"
        },
        {
          "label": "Azure Microsoft.Sql/servers/databases/export/action",
          "url": "https://thecloud.events/events/azure-microsoft-sql-servers-databases-export-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1531",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: Azure Microsoft.Authorization/roleAssignments/delete, Azure Microsoft.Storage/storageAccounts/regenerateKey/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Authorization/roleAssignments/delete",
          "url": "https://thecloud.events/events/azure-microsoft-authorization-roleassignments-delete/"
        },
        {
          "label": "Azure Microsoft.Storage/storageAccounts/regenerateKey/action",
          "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-regeneratekey-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1537",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: Azure CopyBlob, Azure Microsoft.Compute/disks/beginGetAccess/action, Azure Microsoft.Compute/snapshots/beginGetAccess/action, Azure Microsoft.Sql/servers/databases/export/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure CopyBlob",
          "url": "https://thecloud.events/events/azure-copyblob/"
        },
        {
          "label": "Azure Microsoft.Compute/disks/beginGetAccess/action",
          "url": "https://thecloud.events/events/azure-microsoft-compute-disks-begingetaccess-action/"
        },
        {
          "label": "Azure Microsoft.Compute/snapshots/beginGetAccess/action",
          "url": "https://thecloud.events/events/azure-microsoft-compute-snapshots-begingetaccess-action/"
        },
        {
          "label": "Azure Microsoft.Sql/servers/databases/export/action",
          "url": "https://thecloud.events/events/azure-microsoft-sql-servers-databases-export-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1546",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: Azure Microsoft.Automation/automationAccounts/runbooks/write, Azure Microsoft.Automation/automationAccounts/webhooks/write, Azure Microsoft.Compute/virtualMachines/extensions/write, Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Automation/automationAccounts/runbooks/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-runbooks-write/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/webhooks/write",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-write/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/extensions/write",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-extensions-write/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-write-customscript/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1552",
      "score": 11,
      "color": "",
      "comment": "11 events in the catalog produce evidence for this technique: Azure Microsoft.AppConfiguration/configurationStores/listKeys/action, Azure Microsoft.Automation/automationAccounts/credentials/read, Azure Microsoft.Batch/batchAccounts/listKeys/action, Azure Microsoft.ContainerRegistry/registries/listCredentials/action, Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action, Azure Microsoft.ContainerService/managedClusters/listClusterUserCredential/action, Azure Microsoft.OperationalInsights/workspaces/sharedKeys/action, Azure Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action, Azure Microsoft.Storage/storageAccounts/listKeys/action, Azure Microsoft.Storage/storageAccounts/regenerateKey/action, Azure Microsoft.Web/sites/host/listKeys/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.AppConfiguration/configurationStores/listKeys/action",
          "url": "https://thecloud.events/events/azure-microsoft-appconfiguration-configurationstores-listkeys-action/"
        },
        {
          "label": "Azure Microsoft.Automation/automationAccounts/credentials/read",
          "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-credentials-read/"
        },
        {
          "label": "Azure Microsoft.Batch/batchAccounts/listKeys/action",
          "url": "https://thecloud.events/events/azure-microsoft-batch-batchaccounts-listkeys-action/"
        },
        {
          "label": "Azure Microsoft.ContainerRegistry/registries/listCredentials/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerregistry-registries-listcredentials-action/"
        },
        {
          "label": "Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-listclusteradmincredential-action/"
        },
        {
          "label": "Azure Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-listclusterusercredential-action/"
        },
        {
          "label": "Azure Microsoft.OperationalInsights/workspaces/sharedKeys/action",
          "url": "https://thecloud.events/events/azure-microsoft-operationalinsights-workspaces-sharedkeys-action/"
        },
        {
          "label": "Azure Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action",
          "url": "https://thecloud.events/events/azure-microsoft-servicebus-namespaces-authorizationrules-listkeys-action/"
        },
        {
          "label": "Azure Microsoft.Storage/storageAccounts/listKeys/action",
          "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-listkeys-action/"
        },
        {
          "label": "Azure Microsoft.Storage/storageAccounts/regenerateKey/action",
          "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-regeneratekey-action/"
        },
        {
          "label": "Azure Microsoft.Web/sites/host/listKeys/action",
          "url": "https://thecloud.events/events/azure-microsoft-web-sites-host-listkeys-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1555.006",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: Azure Microsoft.KeyVault/vaults/certificates/read, Azure Microsoft.KeyVault/vaults/keys/read, Azure Microsoft.KeyVault/vaults/secrets/read, Azure VaultPatch",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.KeyVault/vaults/certificates/read",
          "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-certificates-read/"
        },
        {
          "label": "Azure Microsoft.KeyVault/vaults/keys/read",
          "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-keys-read/"
        },
        {
          "label": "Azure Microsoft.KeyVault/vaults/secrets/read",
          "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-secrets-read/"
        },
        {
          "label": "Azure VaultPatch",
          "url": "https://thecloud.events/events/azure-vaultpatch/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1556.006",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: Azure Admin Registered Security Info, Azure Disable Strong Authentication, Azure Update User Authentication Methods",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Admin Registered Security Info",
          "url": "https://thecloud.events/events/azure-admin-registered-security-info/"
        },
        {
          "label": "Azure Disable Strong Authentication",
          "url": "https://thecloud.events/events/azure-disable-strong-authentication/"
        },
        {
          "label": "Azure Update User Authentication Methods",
          "url": "https://thecloud.events/events/azure-update-user-authentication-methods/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1556.009",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: Azure Update Conditional Access Policy, Azure Update named location",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Update Conditional Access Policy",
          "url": "https://thecloud.events/events/azure-update-conditional-access-policy/"
        },
        {
          "label": "Azure Update named location",
          "url": "https://thecloud.events/events/azure-update-named-location/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1578.003",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Compute/virtualMachines/delete",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Compute/virtualMachines/delete",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-delete/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1599",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
          "url": "https://thecloud.events/events/azure-microsoft-network-virtualnetworkpeerings-write/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1609",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.ContainerService/managedClusters/runCommand/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.ContainerService/managedClusters/runCommand/action",
          "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-runcommand-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1651",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: Azure Microsoft.Compute/virtualMachines/extensions/write, Azure Microsoft.Compute/virtualMachines/runCommand/action, Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Compute/virtualMachines/extensions/write",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-extensions-write/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/runCommand/action",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-runcommand-action/"
        },
        {
          "label": "Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)",
          "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-write-customscript/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1685",
      "score": 7,
      "color": "",
      "comment": "7 events in the catalog produce evidence for this technique: Azure Microsoft.HybridCompute/machines/extensions/delete, Azure Microsoft.Insights/activityLogAlerts/delete, Azure Microsoft.Insights/metricAlerts/delete, Azure Microsoft.Security/alertsSuppressionRules/write, Azure Microsoft.Security/autoProvisioningSettings/write, Azure Microsoft.Security/pricings/write, Azure Microsoft.Security/securitySolutions/delete",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.HybridCompute/machines/extensions/delete",
          "url": "https://thecloud.events/events/azure-microsoft-hybridcomputer-machines-extensions-delete/"
        },
        {
          "label": "Azure Microsoft.Insights/activityLogAlerts/delete",
          "url": "https://thecloud.events/events/azure-microsoft-insights-activitylogalerts-delete/"
        },
        {
          "label": "Azure Microsoft.Insights/metricAlerts/delete",
          "url": "https://thecloud.events/events/azure-microsoft-insights-metricalerts-delete/"
        },
        {
          "label": "Azure Microsoft.Security/alertsSuppressionRules/write",
          "url": "https://thecloud.events/events/azure-microsoft-security-alertssuppressionrules-write/"
        },
        {
          "label": "Azure Microsoft.Security/autoProvisioningSettings/write",
          "url": "https://thecloud.events/events/azure-microsoft-security-autoprovisioningsettings-write/"
        },
        {
          "label": "Azure Microsoft.Security/pricings/write",
          "url": "https://thecloud.events/events/azure-microsoft-security-pricings-write/"
        },
        {
          "label": "Azure Microsoft.Security/securitySolutions/delete",
          "url": "https://thecloud.events/events/azure-microsoft-security-securitysolutions-delete/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1685.002",
      "score": 5,
      "color": "",
      "comment": "5 events in the catalog produce evidence for this technique: Azure Microsoft.EventHub/namespaces/eventhubs/delete, Azure Microsoft.Insights/diagnosticSettings/delete, Azure Microsoft.Network/networkWatchers/flowLogs/delete, Azure Microsoft.OperationalInsights/workspaces/delete, Azure Microsoft.Storage/storageAccounts/stopLogging/action",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.EventHub/namespaces/eventhubs/delete",
          "url": "https://thecloud.events/events/azure-microsoft-eventhub-namespaces-eventhubs-delete/"
        },
        {
          "label": "Azure Microsoft.Insights/diagnosticSettings/delete",
          "url": "https://thecloud.events/events/azure-microsoft-insights-diagnosticsettings-delete/"
        },
        {
          "label": "Azure Microsoft.Network/networkWatchers/flowLogs/delete",
          "url": "https://thecloud.events/events/azure-microsoft-network-networkwatchers-flowlogs-delete/"
        },
        {
          "label": "Azure Microsoft.OperationalInsights/workspaces/delete",
          "url": "https://thecloud.events/events/azure-microsoft-operationalinsights-workspaces-delete/"
        },
        {
          "label": "Azure Microsoft.Storage/storageAccounts/stopLogging/action",
          "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-stoplogging-action/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1686.001",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: Azure Microsoft.Network/networkSecurityGroups/delete, Azure Microsoft.Network/networkSecurityGroups/securityRules/write, Azure VaultPatch",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "Azure Microsoft.Network/networkSecurityGroups/delete",
          "url": "https://thecloud.events/events/azure-microsoft-network-networksecuritygroups-delete/"
        },
        {
          "label": "Azure Microsoft.Network/networkSecurityGroups/securityRules/write",
          "url": "https://thecloud.events/events/azure-microsoft-network-networksecuritygroups-securityrules-write/"
        },
        {
          "label": "Azure VaultPatch",
          "url": "https://thecloud.events/events/azure-vaultpatch/"
        }
      ],
      "showSubtechniques": false
    }
  ],
  "gradient": {
    "colors": [
      "#ffffff",
      "#5c6b73"
    ],
    "minValue": 0,
    "maxValue": 11
  },
  "legendItems": [
    {
      "label": "More catalog events produce evidence for this technique",
      "color": "#5c6b73"
    }
  ],
  "metadata": [
    {
      "name": "source",
      "value": "https://thecloud.events"
    },
    {
      "name": "scope",
      "value": "Azure"
    }
  ],
  "links": [
    {
      "label": "TheCloud.Events",
      "url": "https://thecloud.events/"
    }
  ],
  "showTacticRowBackground": false,
  "tacticRowBackground": "#dddddd",
  "selectTechniquesAcrossTactics": true,
  "selectSubtechniquesWithParent": false
}