diff --git a/rules/cloud/azure/azure_federation_modified.yml b/rules/cloud/azure/azure_federation_modified.yml index f5b0eee44..bc627c97b 100644 --- a/rules/cloud/azure/azure_federation_modified.yml +++ b/rules/cloud/azure/azure_federation_modified.yml @@ -5,7 +5,7 @@ author: Austin Songer status: experimental date: 2021/09/06 references: - - https://attack.mitre.org/techniques/T1078/ + - https://attack.mitre.org/techniques/T1078 logsource: service: azure.signinlogs detection: @@ -20,4 +20,4 @@ falsepositives: - Federation Settings being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. - +