diff --git a/rules/cloud/azure/azure_ad_account_created_deleted.yml b/rules/cloud/azure/azure_ad_account_created_deleted.yml index 811982001..0b6b8049b 100644 --- a/rules/cloud/azure/azure_ad_account_created_deleted.yml +++ b/rules/cloud/azure/azure_ad_account_created_deleted.yml @@ -2,8 +2,9 @@ title: Account Created And Deleted Within A Close Time Frame id: 6f583da0-3a90-4566-a4ed-83c09fe18bbf status: experimental description: Detects when an account was created and deleted in a short period of time. -author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1' +author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton date: 2022/08/11 +modified: 2022/08/18 references: - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-accounts logsource: @@ -14,11 +15,11 @@ detection: properties.message: - Add user - Delete user - Status: Sucess + Status: Success condition: selection falsepositives: - Legit administrative action tags: - attack.defense_evasion - attack.t1078 -level: high \ No newline at end of file +level: high