MITRE ATT&CK Mapping in Defender

MITRE ATT&CK® (Adversarial Tactics, Techniques, and Common Knowledge) is a curated knowledge base that models adversary behavior. It categorizes attacks into tactics (the 'why' – the objective of a step) and techniques (the 'how' – the specific method used). For example, the tactic 'Initial Access' includes techniques like 'T1078 – Valid Accounts' and 'T1190 – Exploit Public-Facing Application.' The framework is updated regularly by MITRE, with the latest enterprise matrix (v14 as of early 2025) containing 14 tactics and over 200 techniques.

Microsoft Defender products—including Microsoft Defender for Cloud (MDC), Microsoft 365 Defender (M365D), and Microsoft Defender for Endpoint (MDE)—ingest telemetry from Azure, endpoints, identities, and cloud apps. When an alert fires, Defender's detection logic correlates multiple signals and assigns one or more MITRE technique IDs. This mapping is not arbitrary; it follows a deterministic mapping table maintained by Microsoft, which links specific detection rules to ATT&CK techniques.

- Tactic ID Format: TA0001 (Initial Access), TA0002 (Execution), TA0003 (Persistence), TA0004 (Privilege Escalation), TA0005 (Defense Evasion), TA0006 (Credential Access), TA0007 (Discovery), TA0008 (Lateral Movement), TA0009 (Collection), TA0010 (Exfiltration), TA0011 (Command and Control), TA0012 (Impact), TA0043 (Reconnaissance), TA0042 (Resource Development). - Technique ID Format: T1078 (Valid Accounts), T1078.001 (Default Accounts), T1078.002 (Domain Accounts), T1078.003 (Local Accounts), T1078.004 (Cloud Accounts). Sub-techniques are separated by a dot. - Default Mapping: Defender automatically maps alerts. There is no way to disable mapping, but you can add custom threat intelligence indicators that also get mapped if they match known techniques. - Reporting: The Microsoft Defender for Cloud 'Security posture' dashboard includes a 'MITRE ATT&CK coverage' view, which shows a heatmap of which techniques your environment is covered against (detected) vs. missing. This is based on the alerts that have fired in the last 30 days. - API Access: You can retrieve technique IDs via the Microsoft Graph Security API. Example:

GET https://graph.microsoft.com/v1.0/security/alerts/{alertId}

The response includes a mitreTechniques array.

While mapping is automatic, you can query it using KQL in Azure Sentinel (now part of Microsoft Sentinel) or in Advanced Hunting in M365D.

Advanced Hunting Query (M365D):

AlertInfo
| where Timestamp > ago(7d)
| where ServiceSource == "Microsoft Defender for Cloud"
| project AlertId, Title, MitreTechniques, Tactics
| evaluate bag_unpack(MitreTechniques)

Azure Sentinel KQL:

SecurityAlert
| where TimeGenerated > ago(7d)
| where AlertName contains "Malware"
| mv-expand todynamic(Entities)
| project AlertName, Tactics = tostring(parse_json(ExtendedProperties).["tactics"]), Techniques = tostring(parse_json(ExtendedProperties).["techniques"])

PowerShell (for Defender for Cloud):

Get-AzSecurityAlert -ResourceGroupName "myResourceGroup" | Select-Object AlertDisplayName, MitreTechniques

MITRE ATT&CK mapping in Defender is an automatic, rule-based assignment of technique IDs to alerts and incidents. It provides a common language for describing attacks, enables coverage analysis, and integrates across Microsoft's security products. For the AZ-500 exam, focus on knowing the tactics, understanding how mapping works (automatic, per detection rule), and being able to interpret coverage reports.

A large financial institution uses Microsoft 365 Defender to monitor 50,000 endpoints and 100,000 users. The SOC receives 500 alerts per day. To prioritize, they use the MITRE ATT&CK mapping to focus on techniques that indicate active compromise, such as T1078 (Valid Accounts) and T1485 (Data Destruction). They created a custom dashboard in Azure Sentinel that shows the number of incidents per technique. When an incident includes T1078, it is automatically escalated to Tier 2. This approach reduced mean time to respond (MTTR) by 40%. The challenge was false positives from legitimate admin logins; they tuned detection rules to exclude known administrative IP ranges.

A healthcare provider must demonstrate compliance with HIPAA security rules. They use Microsoft Defender for Cloud's MITRE ATT&CK coverage report to show auditors that they have detections for techniques like T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). The report is exported monthly and included in compliance documentation. However, they discovered that coverage for T1048 (Exfiltration Over Alternative Protocol) was low because they had not enabled Microsoft Cloud App Security. After enabling MCAS, they saw a 30% increase in coverage. The lesson: coverage is only as good as the products enabled.

A tech company's threat hunting team uses Advanced Hunting queries to search for techniques that have never triggered alerts. They run weekly queries like:

AlertInfo
| where TimeGenerated > ago(30d)
| summarize by MitreTechniques
| where MitreTechniques !contains "T1078"

This finds techniques with no recent alerts. Then they create custom analytics rules in Sentinel to detect those techniques. For example, they found no alerts for T1550 (Use Alternate Authentication Material) and built a rule that detects pass-the-hash behavior. This proactive approach improved their detection coverage from 45% to 72% over six months. The main performance consideration: the Advanced Hunting queries can be resource-intensive; they limit the time range to 30 days and use summarize to reduce data volume.