KQL Search

# MITRE ATT&CK Mapping

This page includes the mapping of KQL queries to the [MITRE ATT&CK](https://attack.mitre.org/) framework. The framework is a knowledge base of adversary tactics and techniques based on real-world observations.

This section only includes references to queries that can be mapped in the MITRE ATT&CK Framework. Reconnaissance and Resource Development are out of scope.

## Initial Access

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Execution

| Technique ID | Title    | Query    |
| ---  | --- | --- |
| T1546.003 | Windows Management Instrumentation Event Subscription |[WMI Event Subscriptions](../Defender%20For%20Endpoint/MDE-WMIEventSubscription.md) |

## Persistence

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Privilege Escalation

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Defense Evasion

| Technique ID | Title    | Query    |
| ---  | --- | --- |
| T1564.004 | Hide Artifacts: NTFS File Attributes | [NTFS File Attributes - alternate data streams](../Defender%20For%20Endpoint/MDE-NTFS%20File%20Attributes%20-%20alternate%20data%20streams.md) |
| T1484.001 | Domain Policy Modification: Group Policy Modification | [AD Group Policy changes on devices](../Defender%20For%20Endpoint/MDE-GroupPolicyModificationEvents.md) |

## Credential Access

| Technique ID | Title    | Query    |
| ---  | --- | --- |
| T1110.003 | Brute Force: Password Spraying | [password spray attacks](/Defender%20365/MD365-PasswordSprayAttacks.md) |

## Discovery

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Lateral Movement

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Collection

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Command and Control

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Exfiltration

| Technique ID | Title    | Query    |
| ---  | --- | --- |

## Impact

| Technique ID | Title    | Query    |
| ---  | --- | --- |