SC-200 · Question #325
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the…
The correct answer is E. Tactic1, Tactic2, and Tactic3. The MicrosoftGraphActivityLogs table in Microsoft Defender XDR provides insights into activities performed via the Microsoft Graph API, which attackers can leverage for various malicious actions spanning multiple MITRE ATT&CK tactics.
Question
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table. You need to search for malicious activities in your organization. Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?
Exhibit
Options
- ATactic1 only
- BTactic2 only
- CTactic1 and Tactic3 only
- DTactic2 and Tactic3 only
- ETactic1, Tactic2, and Tactic3
How the community answered
(23 responses)- B13% (3)
- C9% (2)
- D4% (1)
- E74% (17)
Why each option
The `MicrosoftGraphActivityLogs` table in Microsoft Defender XDR provides insights into activities performed via the Microsoft Graph API, which attackers can leverage for various malicious actions spanning multiple MITRE ATT&CK tactics.
Restricting the analysis to only two specific tactics is incorrect because the Microsoft Graph API's extensive capabilities mean that its logs can reveal attacker activities across a wide range of MITRE ATT&CK tactics.
The Microsoft Graph API is a comprehensive interface to data and services across the Microsoft 365 ecosystem, allowing attackers to perform actions relevant to a broad spectrum of MITRE ATT&CK tactics, including initial access, execution, persistence, privilege escalation, and data collection. Consequently, activities recorded in the `MicrosoftGraphActivityLogs` table can provide evidence for malicious actions across many different tactics, making it possible to analyze Tactic1, Tactic2, and Tactic3.
Concept tested: Defender XDR KQL table for Graph API activities and MITRE ATT&CK mapping
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-microsoft-graph-api?view=o365-worldwide
Community Discussion
No community discussion yet for this question.