1200KM / tag
Office Suite — platform tag
205 related reference pages for platform: Office Suite.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- AADInternals · tool
- Active Directory Object Access · telemetry
- Active Directory Object Modification · telemetry
- Application Log Content · telemetry
- Cloud Service Disable · telemetry
- Cloud Service Enumeration · telemetry
- Cloud Service Metadata · telemetry
- Cloud Service Modification · telemetry
- Cloud Storage Access · telemetry
- Cloud Storage Metadata · telemetry
- Cloud Storage Modification · telemetry
- Command Execution · telemetry
- evilginx2 · tool
- File Access · telemetry
- File Creation · telemetry
- File Deletion · telemetry
- File Metadata · telemetry
- File Modification · telemetry
- Group Enumeration · telemetry
- Group Metadata · telemetry
- Group Modification · telemetry
- Logon Session Creation · telemetry
- Logon Session Metadata · telemetry
- MailSniper · tool
- Module Load · telemetry
- Network Connection Creation · telemetry
- Network Share Access · telemetry
- Network Traffic Content · telemetry
- Network Traffic Flow · telemetry
- OS API Execution · telemetry
- Process Access · telemetry
- Process Creation · telemetry
- Process Metadata · telemetry
- Ruler · tool
- Scheduled Job Creation · telemetry
- Scheduled Job Modification · telemetry
- Script Execution · telemetry
- Snapshot Creation · telemetry
- Snapshot Metadata · telemetry
- Snapshot Modification · telemetry
- T1021.007 Cloud Services · simulation
- T1021.007 Cloud Services detections · detection
- T1036.010 Masquerade Account Name · simulation
- T1036.010 Masquerade Account Name detections · detection
- T1048 Exfiltration Over Alternative Protocol · simulation
- T1048 Exfiltration Over Alternative Protocol detections · detection
- T1059 Command and Scripting Interpreter · simulation
- T1059 Command and Scripting Interpreter detections · detection
- T1059.009 Cloud API · simulation
- T1059.009 Cloud API detections · detection
- T1069 Permission Groups Discovery · simulation
- T1069 Permission Groups Discovery detections · detection
- T1069.003 Cloud Groups · simulation
- T1069.003 Cloud Groups detections · detection
- T1070 Indicator Removal · simulation
- T1070 Indicator Removal detections · detection
- T1070.008 Clear Mailbox Data · simulation
- T1070.008 Clear Mailbox Data detections · detection
- T1078 Valid Accounts · simulation
- T1078 Valid Accounts detections · detection
- T1078.001 Default Accounts · simulation
- T1078.001 Default Accounts detections · detection
- T1078.004 Cloud Accounts · simulation
- T1078.004 Cloud Accounts detections · detection
- T1080 Taint Shared Content · simulation
- T1080 Taint Shared Content detections · detection
- T1087 Account Discovery · simulation
- T1087 Account Discovery detections · detection
- T1087.003 Email Account · simulation
- T1087.003 Email Account detections · detection
- T1087.004 Cloud Account · simulation
- T1087.004 Cloud Account detections · detection
- T1098 Account Manipulation · simulation
- T1098 Account Manipulation detections · detection
- T1098.002 Additional Email Delegate Permissions · simulation
- T1098.002 Additional Email Delegate Permissions detections · detection
- T1098.003 Additional Cloud Roles · simulation
- T1098.003 Additional Cloud Roles detections · detection
- T1110 Brute Force · simulation
- T1110 Brute Force detections · detection
- T1110.001 Password Guessing · simulation
- T1110.001 Password Guessing detections · detection
- T1110.002 Password Cracking · simulation
- T1110.002 Password Cracking detections · detection
- T1110.003 Password Spraying · simulation
- T1110.003 Password Spraying detections · detection
- T1110.004 Credential Stuffing · simulation
- T1110.004 Credential Stuffing detections · detection
- T1114 Email Collection · simulation
- T1114 Email Collection detections · detection
- T1114.002 Remote Email Collection · simulation
- T1114.002 Remote Email Collection detections · detection
- T1114.003 Email Forwarding Rule · simulation
- T1114.003 Email Forwarding Rule detections · detection
- T1119 Automated Collection · simulation
- T1119 Automated Collection detections · detection
- T1136 Create Account · simulation
- T1136 Create Account detections · detection
- T1136.003 Cloud Account · simulation
- T1136.003 Cloud Account detections · detection
- T1137 Office Application Startup · simulation
- T1137 Office Application Startup detections · detection
- T1137.001 Office Template Macros · simulation
- T1137.001 Office Template Macros detections · detection
- T1137.002 Office Test · simulation
- T1137.002 Office Test detections · detection
- T1137.003 Outlook Forms · simulation
- T1137.003 Outlook Forms detections · detection
- T1137.004 Outlook Home Page · simulation
- T1137.004 Outlook Home Page detections · detection
- T1137.005 Outlook Rules · simulation
- T1137.005 Outlook Rules detections · detection
- T1137.006 Add-ins · simulation
- T1137.006 Add-ins detections · detection
- T1199 Trusted Relationship · simulation
- T1199 Trusted Relationship detections · detection
- T1201 Password Policy Discovery · simulation
- T1201 Password Policy Discovery detections · detection
- T1213 Data from Information Repositories · simulation
- T1213 Data from Information Repositories detections · detection
- T1213.002 Sharepoint · simulation
- T1213.002 Sharepoint detections · detection
- T1213.005 Messaging Applications · simulation
- T1213.005 Messaging Applications detections · detection
- T1526 Cloud Service Discovery · simulation
- T1526 Cloud Service Discovery detections · detection
- T1528 Steal Application Access Token · simulation
- T1528 Steal Application Access Token detections · detection
- T1530 Data from Cloud Storage · simulation
- T1530 Data from Cloud Storage detections · detection
- T1531 Account Access Removal · simulation
- T1531 Account Access Removal detections · detection
- T1534 Internal Spearphishing · simulation
- T1534 Internal Spearphishing detections · detection
- T1537 Transfer Data to Cloud Account · simulation
- T1537 Transfer Data to Cloud Account detections · detection
- T1538 Cloud Service Dashboard · simulation
- T1538 Cloud Service Dashboard detections · detection
- T1539 Steal Web Session Cookie · simulation
- T1539 Steal Web Session Cookie detections · detection
- T1546 Event Triggered Execution · simulation
- T1546 Event Triggered Execution detections · detection
- T1548 Abuse Elevation Control Mechanism · simulation
- T1548 Abuse Elevation Control Mechanism detections · detection
- T1548.005 Temporary Elevated Cloud Access · simulation
- T1548.005 Temporary Elevated Cloud Access detections · detection
- T1550 Use Alternate Authentication Material · simulation
- T1550 Use Alternate Authentication Material detections · detection
- T1550.001 Application Access Token · simulation
- T1550.001 Application Access Token detections · detection
- T1550.004 Web Session Cookie · simulation
- T1550.004 Web Session Cookie detections · detection
- T1552 Unsecured Credentials · simulation
- T1552 Unsecured Credentials detections · detection
- T1552.008 Chat Messages · simulation
- T1552.008 Chat Messages detections · detection
- T1556 Modify Authentication Process · simulation
- T1556 Modify Authentication Process detections · detection
- T1556.006 Multi-Factor Authentication · simulation
- T1556.006 Multi-Factor Authentication detections · detection
- T1556.007 Hybrid Identity · simulation
- T1556.007 Hybrid Identity detections · detection
- T1564 Hide Artifacts · simulation
- T1564 Hide Artifacts detections · detection
- T1564.008 Email Hiding Rules · simulation
- T1564.008 Email Hiding Rules detections · detection
- T1566 Phishing · simulation
- T1566 Phishing detections · detection
- T1566.002 Spearphishing Link · simulation
- T1566.002 Spearphishing Link detections · detection
- T1567 Exfiltration Over Web Service · simulation
- T1567 Exfiltration Over Web Service detections · detection
- T1567.004 Exfiltration Over Webhook · simulation
- T1567.004 Exfiltration Over Webhook detections · detection
- T1606 Forge Web Credentials · simulation
- T1606 Forge Web Credentials detections · detection
- T1606.002 SAML Tokens · simulation
- T1606.002 SAML Tokens detections · detection
- T1621 Multi-Factor Authentication Request Generation · simulation
- T1621 Multi-Factor Authentication Request Generation detections · detection
- T1648 Serverless Execution · simulation
- T1648 Serverless Execution detections · detection
- T1657 Financial Theft · simulation
- T1657 Financial Theft detections · detection
- T1667 Email Bombing · simulation
- T1667 Email Bombing detections · detection
- T1671 Cloud Application Integration · simulation
- T1671 Cloud Application Integration detections · detection
- T1684 Social Engineering · simulation
- T1684 Social Engineering detections · detection
- T1684.001 Impersonation · simulation
- T1684.001 Impersonation detections · detection
- T1684.002 Email Spoofing · simulation
- T1684.002 Email Spoofing detections · detection
- T1685.002 Disable or Modify Cloud Log · simulation
- T1685.002 Disable or Modify Cloud Log detections · detection
- User Account Authentication · telemetry
- User Account Creation · telemetry
- User Account Deletion · telemetry
- User Account Metadata · telemetry
- User Account Modification · telemetry
- Web Credential Creation · telemetry
- Web Credential Usage · telemetry
- Windows Registry Key Modification · telemetry
- WMI Creation · telemetry
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.