AzureTrafficAnalytics.json

{
    "name": "Azure Network Traffic Analytics",
    "versions": {
        "attack": "8",
        "navigator": "4.2",
        "layer": "4.2"
    },
    "domain": "enterprise-attack",
    "description": "Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud.  It can identify security threats to, and secure your network, with information such as open-ports, applications attempting internet access, and virtual machines (VM) connecting to rogue networks.",
    "filters": {
        "platforms": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "Azure AD",
            "AWS",
            "GCP",
            "Azure",
            "SaaS",
            "PRE",
            "Network"
        ]
    },
    "sorting": 0,
    "layout": {
        "layout": "side",
        "showID": false,
        "showName": true,
        "showAggregateScores": false,
        "countUnscored": false,
        "aggregateFunction": "average"
    },
    "hideDisabled": false,
    "techniques": [
        {
            "techniqueID": "T1199",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can be used to gain insight into normal traffic from trusted third parties which can then be used to detect anomalous traffic that may be indicative of a threat."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1602",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic with respect to configuration repositories or identified configuration management ports."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1602.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1602.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1542",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic related to one of its sub-techniques (TFTP boot)."
                }
            ],
            "color": "#AEEEEE",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Detect"
        },
        {
            "techniqueID": "T1542.005",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can be used to identify anomalous TFTP boot traffic."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1563",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can be used to identify anomalous traffic related to RDP and SSH sessions or blocked attempts to access these management ports."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1563.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1563.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1048",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to specific protocols/ports."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1048.003",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption)."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1048.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption)."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1048.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption)."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1190",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic to and from externally facing systems with respect to network security group (NSG) policy."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic or attempts related to network security group (NSG) for remote services."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021.006",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to remote access protocols and groups."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021.005",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to remote access protocols and groups."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021.004",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to remote access protocols and groups."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to remote access protocols and groups."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to remote access protocols and groups."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1021.003",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to remote access protocols and groups."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1072",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic with respect to critical systems and software deployment ports."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1133",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous access to external remote services."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1046",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Significant"
                },
                {
                    "name": "comment",
                    "value": "This control can detect network service scanning/discovery activity."
                }
            ],
            "color": "#00FFFF",
            "score_num": 100,
            "score_display": "Significant",
            "category": "Detect"
        },
        {
            "techniqueID": "T1571",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Significant"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic that utilizes non-standard application ports."
                }
            ],
            "color": "#00FFFF",
            "score_num": 100,
            "score_display": "Significant",
            "category": "Detect"
        },
        {
            "techniqueID": "T1071",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify anomalous traffic with respect to NSG and application layer protocols."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1071.004",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful)."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1071.003",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful)."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1071.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous application protocol traffic with respect to network security group (NSG) (though web traffic would be typically too commonplace for this control to be useful)."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1499",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can identify volumetric and multi-sourced denial-of-service attacks."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1499.003",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1499.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1499.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1090",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "This control can detect anomalous traffic between systems and external networks."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1090.003",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1090.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1090.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "n/a"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        }
    ],
    "gradient": {
        "colors": [
            "#ff6666",
            "#ffe766",
            "#8ec843"
        ],
        "minValue": 0,
        "maxValue": 100
    },
    "legendItems": [
        {
            "label": "Protect - Minimal",
            "color": "#9CBA7F"
        },
        {
            "label": "Protect - Partial",
            "color": "#659D32"
        },
        {
            "label": "Protect - Significant",
            "color": "#7FFF00"
        },
        {
            "label": "Detect - Minimal",
            "color": "#AEEEEE"
        },
        {
            "label": "Detect - Partial",
            "color": "#5F9F9F"
        },
        {
            "label": "Detect - Significant",
            "color": "#00FFFF"
        },
        {
            "label": "Respond - Minimal",
            "color": "#ff6b6b"
        },
        {
            "label": "Respond - Partial",
            "color": "#ff0505"
        },
        {
            "label": "Respond - Significant",
            "color": "#b80000"
        },
        {
            "label": "Mixed - Minimal",
            "color": "#bf6bff"
        },
        {
            "label": "Mixed - Partial",
            "color": "#9305ff"
        },
        {
            "label": "Mixed - Significant",
            "color": "#5c00a3"
        }
    ],
    "metadata": [],
    "showTacticRowBackground": false,
    "tacticRowBackground": "#dddddd",
    "selectTechniquesAcrossTactics": true,
    "selectSubtechniquesWithParent": false
}