blue-team-tools

azure_aadhybridhealth_adfs_new_server.yml

adding basic rules to detect behavior around AAD health agents and AAD Hybrid Health AD FS services in Azure

2021-08-26 16:10:42 -04:00

azure_aadhybridhealth_adfs_service_delete.yml

adding basic rules to detect behavior around AAD health agents and AAD Hybrid Health AD FS services in Azure

2021-08-26 16:10:42 -04:00

azure_account_lockout.yml

Change the service to the form service: azure._a_name_ and add falsepositives field

2021-10-13 15:12:36 +04:00

azure_ad_user_added_to_admin_role.yml

change title and tags in order to match sigmarules

2021-10-05 09:40:25 +02:00

azure_app_credential_modification.yml

Update azure_app_credential_modification.yml

2021-09-02 21:00:21 -05:00

azure_application_deleted.yml

Update azure_application_deleted.yml

2021-09-03 22:28:53 -05:00

azure_application_gateway_modified_or_deleted.yml

Create azure_application_gateway_modified_or_deleted.yml

2021-08-16 23:30:30 -05:00

azure_application_security_group_modified_or_deleted.yml

Delete azure_application_security_group_modified_or_deleted.yml

2021-08-16 23:42:15 -05:00

azure_change_to_authentication_method.yml

Change the service to the form service: azure._a_name_ and add falsepositives field

2021-10-13 15:12:36 +04:00

azure_container_registry_created_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_creating_number_of_resources_detection.yml

fix titles

2021-08-15 19:05:00 +02:00

azure_device_no_longer_managed_or_compliant.yml

Update azure_device_no_longer_managed_or_compliant.yml

2021-09-03 22:42:26 -05:00

azure_device_or_configuration_modified_or_deleted.yml

Update and rename azure_device_or_configuration_deleted.yml to azure_device_or_configuration_modified_or_deleted.yml

2021-09-03 22:28:35 -05:00

azure_dns_zone_modified_or_deleted.yml

move azure rules

2021-08-13 15:42:54 +02:00

azure_federation_modified.yml

Update azure_federation_modified.yml

2021-09-06 11:31:52 -05:00

azure_firewall_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_firewall_rule_collection_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_granting_permission_detection.yml

fix more errors

2021-08-15 19:17:56 +02:00

azure_keyvault_key_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_keyvault_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_keyvault_secrets_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_kubernetes_cluster_created_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_kubernetes_events_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_kubernetes_network_policy_change.yml

move azure rules

2021-08-13 15:42:54 +02:00

azure_kubernetes_pods_deleted.yml

fix status

2021-08-20 06:08:28 +02:00

azure_kubernetes_role_access.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_kubernetes_rolebinding_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_kubernetes_secret_or_config_object_access.yml

Fixed Spelling

2021-08-18 18:53:28 +00:00

azure_kubernetes_service_account_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_login_to_disabled_account.yml

Change the service to the form service: azure._a_name_ and add falsepositives field

2021-10-13 15:12:36 +04:00

azure_mfa_interrupted.yml

Change the service to the form service: azure._a_name_ and add falsepositives field

2021-10-13 15:12:36 +04:00

azure_network_firewall_policy_modified_or_deleted.yml

Create azure_network_firewall_policy_modified_or_deleted.yml

2021-09-02 20:31:27 -05:00

azure_network_firewall_rule_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_network_p2s_vpn_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_network_security_modified_or_deleted.yml

move azure rules

2021-08-13 15:42:54 +02:00

azure_network_virtual_device_modified_or_deleted.yml

Forgot to add my username to some of the rules.

2021-08-20 02:09:31 +00:00

azure_new_cloudshell_created.yml

Create azure_new_cloudshell_created.yml

2021-09-12 20:00:08 -05:00

azure_owner_removed_from_application_or_service_principal.yml

Update azure_owner_removed_from_application_or_service_principal.yml

2021-09-03 22:29:12 -05:00

azure_rare_operations.yml

fix more errors

2021-08-15 19:17:56 +02:00

azure_service_principal_created.yml

Update azure_service_principal_created.yml

2021-09-02 21:00:02 -05:00

azure_service_principal_removed.yml

Update azure_service_principal_removed.yml

2021-09-03 22:43:11 -05:00

azure_suppression_rule_created.yml

Update azure_suppression_rule_created.yml

2021-08-17 00:04:11 -05:00

azure_user_login_blocked_by_conditional_access.yml

Change the service to the form service: azure._a_name_ and add falsepositives field

2021-10-13 15:12:36 +04:00

azure_virtual_network_modified_or_deleted.yml

move azure rules

2021-08-13 15:42:54 +02:00

azure_vpn_connection_modified_or_deleted.yml

move azure rules

2021-08-13 15:42:54 +02:00