Techniques › T1697 › AN2076
AN2076 Analytic 2076
Office Suite · attack.mitre.org · ATT&CK Enterprise v20.0
<p>Detect successful Office Suite access using an authentication method that does not perform the account's expected MFA flow, correlated within ASPActivityWindow with first-seen client/application access, an anomalous source/device, or an ASP-related account credential change where available.</p>
- Detects
- T1697 Steal Application Specific Passwords
- Part of
- DET0926 Suspicious Acquisition and Use of Application-Specific Passwords
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| m365:unified | Authentication/account audit event identifying app-password or applicable legacy-authentication activity | DC0038 Application Log Content |
| azure:signinlogs | Successful account authentication with authentication/client properties inconsistent with normal MFA-backed access | DC0002 User Account Authentication |
| idp:audit | ASP added/created where exposed by provider | DC0010 User Account Modification |