M1047 Audit: What to Review and How Often

Most intrusions use something that a scheduled review would have found first: an account nobody disabled, a key nobody rotated, a forwarding rule nobody checked. MITRE ATT&CK M1047 Audit treats that review work as a mitigation in its own right, and in ATT&CK v20 it is mapped to 111 techniques and sub-techniques, one of the widest footprints of any mitigation. This guide turns that list into a review programme: which audits stop which techniques, how often to run them, how to cover non-human identities such as service accounts, OAuth apps and keys, and how to measure whether the audits are working. It is for detection engineers, identity teams and internal audit. Audit logging itself is covered in the CIS Control 8 Audit Log Management Guide; this page is about the reviews.

Key takeaways

Audit means review, not just logging. ATT&CK defines M1047 as recording activity and systematically reviewing activity and system configurations, with five audit types: system, permission, software, configuration and network.
The footprint is huge. In ATT&CK v20, M1047 mitigates 111 entries (39 parent techniques plus sub-techniques) across 12 tactics, led by Persistence, Stealth, Defense Impairment, Credential Access and Execution.
Non-human identities dominate the high-value rows. OAuth apps, cloud and container accounts, private keys, code repository secrets and SaaS integrations all appear in ATT&CK's own audit guidance.
Frequency should follow blast radius. Privileged and machine credentials need monthly or continuous review; broad user access can run quarterly.
An audit that changes nothing is a report. Measure findings closed, not reviews completed.

What M1047 covers in ATT&CK

ATT&CK describes auditing as recording activity and systematically reviewing and analysing activity and configurations, primarily to detect anomalies and identify threats or weaknesses. It lists five audit activities:

Audit type (ATT&CK)	Use case	Implementation ATT&CK suggests
System audit	Check configurations against security policy	Scan for deviations from established benchmarks
Permission audit	Reduce unauthorised access and privilege escalation	Access reviews to find users or groups with excessive permissions
Software audit	Find outdated, unsupported or insecure software	Inventory and vulnerability scanning
Configuration audit	Confirm secure settings, for example SMBv1 disabled and MFA enabled	Automated scanning with SCAP-based tools
Network audit	Find unauthorised or insecure connections and firewall rules	Traffic and connection monitoring, for example with Zeek or Wireshark

NIST describes SCAP as a group of standards for expressing configuration and vulnerability data in machine-readable form so that tools report consistently; the current version is SCAP 1.4. MITRE D3FEND relates M1047 to D3-DAM Domain Account Monitoring, D3-LAM Local Account Monitoring and D3-SFA System File Analysis, and notes that the mitigation's scope touches a very wide range of D3FEND techniques.

Techniques M1047 mitigates: the priority 25

With 111 entries, a full table would hide the point. The 25 below (in 24 rows) are the ones where ATT&CK's audit guidance is most specific and where the technique most often appears in identity-led intrusions. The method: we kept entries whose ATT&CK usage text names a concrete review (not the generic "perform audits or scans" sentence) and ranked them by relevance to credentials and privileged access.

Tactic	Technique	What to audit (per ATT&CK)
Credential Access	T1528 Steal Application Access Token	All cloud and container accounts are necessary and correctly permissioned; all OAuth applications and their granted permissions
Lateral Movement	T1550.001 Application Access Token	Cloud and container accounts and their permissions
Credential Access	T1552.001 Credentials In Files	Search for files containing passwords and reduce exposure
Credential Access	T1552.004 Private Keys	Only authorised keys can access critical resources; audit access lists regularly
Credential Access	T1552.006 Group Policy Preferences	Search SYSVOL for existing GPPs containing credentials and remove them
Credential Access	T1552.008 Chat Messages	Search communication services for shared credentials
Collection	T1213.003 Code Repositories	Accounts and privileges on sensitive repositories; scan for exposed credentials
Reconnaissance	T1593.003 Code Repositories	Scan public repositories for credentials before commit; remove leaked credentials from history
Collection	T1530 Data from Cloud Storage	Cloud storage permissions deny open or unprivileged access
Persistence	T1671 Cloud Application Integration	SaaS integrations for unapproved or malicious applications
Credential Access	T1649 Steal or Forge Authentication Certificates	Unneeded certificates and abusable CA settings and permissions, such as AD CS templates
Credential Access	T1606.002 SAML Tokens	Advanced auditing on AD FS, including success and failure audits
Persistence, Credential Access	T1556.007 Hybrid Identity	Pass-through authentication agents and AD FS components for unapproved items
Persistence, Credential Access	T1556.006 Multi-Factor Authentication	MFA actions alongside authentication logs, and user MFA registrations
Privilege Escalation	T1484.001 Group Policy Modification	GPO permission abuse opportunities, using attack path tools
Defense Impairment	T1685 Disable or Modify Tools	All expected hosts check in to EDR and monitoring consoles; no unexpected EDR exclusions
Defense Impairment	T1685.001 Disable or Modify Windows Event Log	`auditpol` settings for administrator accounts, with SIEM baselining
Defense Impairment	T1578 Modify Cloud Compute Infrastructure	Only expected users can create, snapshot or delete cloud compute
Defense Impairment	T1666 Modify Cloud Resource Hierarchy	Resource groups and accounts near the top of the hierarchy
Collection, Stealth	T1114.003 Email Forwarding Rule; T1564.008 Email Hiding Rules	Auto-forwarding and inbox rules on a regular basis
Lateral Movement	T1021.001 Remote Desktop Protocol	Remote Desktop Users group membership
Stealth	T1036.010 Masquerade Account Name	Every user account has a defined purpose
Persistence	T1176.002 IDE Extensions	Installed extensions are the intended ones
Persistence	T1505.006 vSphere Installation Bundles	Only approved VIBs are installed on ESXi hosts

The remaining entries cover execution flow hijacking (T1574 and its path interception sub-techniques), scheduled tasks (T1053), cloud and container images (T1525, T1610, T1204.003), fileless storage (T1027.011), hidden virtual machines (T1564.006) and network device images (T1542.004, T1542.005). Related technique guides include the T1528 Steal Application Access Token, T1552 Unsecured Credentials, T1671 Cloud Application Integration and T1649 Steal or Forge Authentication Certificates guides.

A review calendar: what to audit and how often

ATT&CK says "regularly" and "periodically" without numbers. The frequencies below are NHI Mgmt Group recommendations, set by how quickly an abused item turns into a breach.

Review	Frequency	Techniques addressed
New OAuth consents, app registrations and credentials added to apps	Continuous alerting, monthly review of high-risk permissions	T1528, T1550.001, T1671
Secret scanning of repositories, chat and file shares	Continuous on commit, monthly sweep of history and chat	T1552.001, T1552.008, T1213.003, T1593.003
Privileged and machine identities: owners, last use, permissions	Monthly	T1528, T1552.004, T1578, T1666
Mailbox forwarding, transport and inbox rules	Weekly for executives and finance, monthly elsewhere	T1114.003, T1564.008, T1070.008
Security tool health: agents checking in, exclusions, audit policy	Daily automated, monthly human review	T1685, T1685.001, T1685.004
Identity infrastructure: AD CS templates, GPO permissions, PTA agents, AD FS	Quarterly and after any change	T1649, T1484.001, T1556.007, T1606.002
User and group access reviews, RDP group membership	Quarterly, monthly for privileged groups	T1021.001, T1036.010, T1213
Cloud storage exposure	Continuous posture checks, quarterly review of exceptions	T1530
Configuration baselines and installed software, extensions, VIBs	Monthly automated scan	T1059, T1176, T1505, T1574

Where identity fits: auditing non-human identities and keys

A large share of the 111 entries are reviews of machine credentials. The audits that make the difference:

Unused access: AWS IAM Access Analyzer produces unused access findings for roles with no activity, IAM user access keys and passwords not used in the chosen window, and service and action permissions a role has not used. Equivalent reports exist on other clouds. Unused credentials are the first thing to remove. See the How to Run an Access Review for Service Accounts guide.
Every identity has an owner and a purpose: ATT&CK's guidance for T1036.010 is that each account should have a defined purpose. For service principals and API keys, that means a named owner, a system and a review date.
Applications and integrations: Microsoft Entra access reviews cover group membership, enterprise app assignments, Entra roles and Azure resource roles (through PIM), with weekly, monthly, quarterly or annual recurrence; Microsoft lists Entra ID Governance or Entra Suite licensing as the requirement. App permissions granted to service principals need a separate review of consents and roles. See the How to audit GitHub Apps and OAuth apps in an organisation guide and the How to audit Slack apps, bots and tokens guide.
Keys and certificates: T1552.004 and T1649 call for regular audit of authorised keys and certificates. Include SSH authorised keys, signing keys and AD CS templates. See How to audit AD CS certificate templates.
Legacy credentials in shared places: Microsoft's MS14-025 (May 2014) removed the ability to set passwords through Group Policy Preferences but did not remove existing GPOs containing them, and called for additional action to clean them up. That is exactly the T1552.006 audit.

Implementation approach

Pick scope by technique: start with the priority 25 above, mark which ones your environment has (no AD FS means no T1606.002 review), and assign each review an owner.
Automate collection first: configuration scanning, secret scanning, cloud posture and unused access reports produce the raw findings so reviewers spend time on decisions, not gathering.
Pilot with one domain: run a full cycle for machine identities in one cloud account or tenant, measure how many findings close, then extend.
Decide in the review: each finding ends as keep (with justification and owner), reduce, rotate or remove. Use auto-apply of results only once false positive rates are known.
Roll back safely: disable before you delete. Disabled accounts and revoked consents can be restored if a forgotten dependency breaks; deleted keys cannot.
Feed detection: anything a review finds that should never exist (a new forwarding rule to an external domain, a new PTA agent) becomes an alert so the next one is caught in minutes, not months.

What audit does not stop

Fast attacks: a monthly review does not stop an adversary who abuses a new OAuth consent the same day. Pair periodic audit with real-time alerting on the same objects.
Reviews that rubber-stamp: reviewers approving everything make the control look complete while changing nothing. Track deny rates.
Exploitation: audit finds weaknesses and misuse, it does not block exploitation of unpatched software. That needs M1051 Update Software and the other prevention mitigations; see the M1048 Application Isolation and Sandboxing guide for containment.
Unknown assets: you cannot review what is not in the inventory. Test and legacy tenants are the usual blind spot.

Measuring whether audit works

Metric	Why it matters
Percentage of non-human identities with an owner and a review in the last 90 days	Coverage of the identities behind T1528, T1552 and T1671
Unused credentials older than the usage window, count and trend	Direct measure of dormant access
Median age of open audit findings by severity	Shows whether reviews lead to change
Deny or reduce rate in access reviews	A 0% rate usually means rubber-stamping
Hosts with security agents not checking in	Coverage for T1685
External forwarding rules found that were not approved	Signal for T1114.003

Common failure patterns

Dormant accounts never disabled: the Colonial Pipeline attack started from a legacy VPN profile that was no longer used but had never been disabled, with no MFA and a password that had appeared in a leak.
Test environments outside the review: in the Midnight Blizzard intrusion at Microsoft, a password spray on a legacy test tenant account and a legacy test OAuth application with elevated access led to the full_access_as_app permission being used to read mailboxes.
Partial rotation after exposure: in the Internet Archive breach, Zendesk API tokens found in stolen source code were not rotated, and were used weeks later to read more than 800,000 support tickets.
Checking settings but not permissions: configuration scans pass while the identities able to change those settings, such as firewall and logging administrators (T1686, T1685.004), are never reviewed.
Annual reviews of high-churn objects: OAuth consents, forwarding rules and API keys change daily; an annual certification misses almost all of it.

Framework mapping

Framework	Reference	Link to M1047
NIST SP 800-53 Rev. 5	AU-6 Audit Record Review, Analysis, and Reporting	Review of recorded activity
NIST SP 800-53 Rev. 5	AC-6(7) Review of User Privileges; AC-2(3) Disable Accounts	Permission audits and dormant account removal
NIST SP 800-53 Rev. 5	CM-2 Baseline Configuration; CM-6 Configuration Settings; CM-8 System Component Inventory; RA-5 Vulnerability Monitoring and Scanning	System, configuration and software audits
NIST CSF 2.0	ID.AM-01; ID.AM-02; ID.RA-01; PR.AA-05; PR.PS-01	Inventories, vulnerability identification, access permissions, configuration management
MITRE D3FEND	D3-DAM; D3-LAM; D3-SFA	Related defensive techniques listed by D3FEND for M1047

Practitioner checklist

Map the priority techniques above to named reviews, owners and frequencies.
Run unused access reports for every cloud and remove credentials outside the usage window.
Review OAuth apps, service principals and SaaS integrations monthly, with alerts on new high-risk consents.
Scan repositories, chat and file shares for secrets continuously, and rotate everything found.
Audit forwarding and inbox rules, EDR check-in and exclusions, and audit policy settings.
Review AD CS templates, GPO permissions and hybrid identity components quarterly.
Include test, legacy and acquired tenants in every review.
Report findings closed and their age, not reviews completed.

M1047 Audit: Audit as a Mitigation: What to Review and How Often