MITRE ATT&CK Technique
T1078.004
2 queries tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Smartconnect Session Without Signin
Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.
-
Identity
Whos Activating Roles Via PIM
PIM role activations from `AuditLogs` — useful for tracking privileged-role usage.