Update azure_keyvault_key_modified_or_deleted.yml

2021-08-17 08:44:39 -05:00
parent 16e0def41d
commit 309e71491b
1 changed files with 3 additions and 0 deletions
@@ -24,6 +24,9 @@ detection:
 level: medium
 tags:
    - attack.impact
+    - attack.credential_access
+    - attack.t1552
+    - attack.t1552.001
 falsepositives:
 - Key being modified or deleted may be performed by a system administrator. 
 - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.