M1047Audit
Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.
ZT: verify explicitlyLogging & Audit PolicyWindowsLinuxmacOSCloudIdentity
TA0007Defense Plan
Discovery
Discovering the environment
Techniques in this tactic (1)
M1018User Account Management
Account lifecycle management: proper creation, assignment with least privilege, timely disabling, and periodic access reviews.
ZT: least privilegeIAM / Joiner-Mover-LeaverWindowsLinuxmacOSIdentityCloud