Updated

2021-08-23 22:07:09 +00:00
parent 1fa32fcd1a
commit 595bd3b80f
1 changed files with 3 additions and 4 deletions
@@ -1,7 +1,7 @@
 title: Microsoft 365 - Activity performed by terminated user
 id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee
 status: experimental
-description: Detects when a Microsoft Cloud App Security reported 
+description: Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
 author: Austin Songer @austinsonger
 date: 2021/08/23
 references:
@@ -17,8 +17,7 @@ detection:
        status: success
    condition: selection
 falsepositives:
-    - 
+    - Unknown
 level: medium
 tags:
-    - attack.exfiltration
-    - attack.t1537
+    - attack.impact