From 595bd3b80f34a2d997f013be2a4bf890818c7956 Mon Sep 17 00:00:00 2001 From: Austin Songer Date: Mon, 23 Aug 2021 22:07:09 +0000 Subject: [PATCH] Updated --- .../m365/microsoft365_activity_by_terminated_user.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/rules/cloud/m365/microsoft365_activity_by_terminated_user.yml b/rules/cloud/m365/microsoft365_activity_by_terminated_user.yml index 4b60b111e..037dcd00c 100644 --- a/rules/cloud/m365/microsoft365_activity_by_terminated_user.yml +++ b/rules/cloud/m365/microsoft365_activity_by_terminated_user.yml @@ -1,7 +1,7 @@ title: Microsoft 365 - Activity performed by terminated user id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee status: experimental -description: Detects when a Microsoft Cloud App Security reported +description: Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company. author: Austin Songer @austinsonger date: 2021/08/23 references: @@ -17,8 +17,7 @@ detection: status: success condition: selection falsepositives: - - + - Unknown level: medium tags: - - attack.exfiltration - - attack.t1537 \ No newline at end of file + - attack.impact \ No newline at end of file