From a7208e7f699fa2a76b11ddefe90f38a21440ddda Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Mon, 9 Jan 2023 15:27:15 -0500 Subject: [PATCH] Update azure_dns_zone_modified_or_deleted.yml Added sub-tech and reference to the page. Didn't modify the date per earlier discussion. --- rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml b/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml index 66597f9a7..1b6d2b1e4 100644 --- a/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml +++ b/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml @@ -4,11 +4,13 @@ status: experimental description: Identifies when DNS zone is modified or deleted. references: - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes + - https://attack.mitre.org/techniques/T1565/001/ author: Austin Songer @austinsonger date: 2021/08/08 modified: 2022/08/23 tags: - attack.impact + - attack.t1565.001 logsource: product: azure service: activitylogs