security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update azure_legacy_authentication_protocols.yml

Browse Source
This commit is contained in:
frack113
2022-07-01 14:32:09 +02:00
committed by GitHub
parent 558a80ac4b
commit 2aaaeed7c3
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cloud/azure/azure_legacy_authentication_protocols.yml
+2 -2
View File
@@ -1,4 +1,4 @@
title: Use of legacy authentication protocols
title: Use of Legacy Authentication Protocols
id: 60f6535a-760f-42a9-be3f-c9a0a025906e
description: Alert on when legecy authentication has been used on an account
author: Yochana Henderson, '@Yochana-H'
@@ -13,10 +13,10 @@ detection:
- Activity Details: Sign-ins
- Client App: Other client, IMAP, POP3, MAPI, SMTP, Exchange ActiveSync, Exchange Web Services
condition: selection
level: high
falsepositives:
- User has been put in acception group so they can use legacy authentication
status: experimental
level: high
tags:
- attack.credential_access
- attack.t1552