security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
871f41df73e68fc6b16403b3f8a53bbc8b2cd8eb
blue-team-tools/rules/cloud/azure
T
History
Mark Morowczynski f28b89c084 Merge PR #4445 from @MarkMorow - New Azure PIM Rules 
new: Stale Accounts In A Privileged Role
new: Invalid PIM License
new: Roles Assigned Outside PIM
new: Roles Activated Too Frequently
new: Roles Activation Doesn't Require MFA
new: Roles Are Not Being Used
new: Too Many Global Admins

---------

Co-authored-by: gleeiamglo <142270304+gleeiamglo@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
2023-09-14 22:02:30 +02:00
..
identity_protection
Merge PR #4429 from @MarkMorow - Add New Azure Identity Protection Rules
2023-09-11 22:53:52 +02:00
privileged_identity_management
Merge PR #4445 from @MarkMorow - New Azure PIM Rules
2023-09-14 22:02:30 +02:00
azure_aad_secops_ca_policy_removedby_bad_actor.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_aad_secops_ca_policy_updatedby_bad_actor.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_aad_secops_new_ca_policy_addedby_bad_actor.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_aadhybridhealth_adfs_new_server.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_aadhybridhealth_adfs_service_delete.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_account_lockout.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
azure_ad_account_created_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_ad_auth_failure_increase.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_ad_auth_sucess_increase.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_ad_auth_to_important_apps_using_single_factor_auth.yml
#4149 Fix ALA Rules Compilation (parser and broken azure rules) (#4150)
2023-03-29 23:07:40 +02:00
azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_ad_azurehound_discovery.yml
Create azure_ad_azurehound_discovery.yml (#3762)
2022-12-08 20:21:02 +01:00
azure_ad_bitlocker_key_retrieval.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_ad_device_registration_or_join_without_mfa.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_ad_device_registration_policy_changes.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml
#4149 Fix ALA Rules Compilation (parser and broken azure rules) (#4150)
2023-03-29 23:07:40 +02:00
azure_ad_only_single_factor_auth_required.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml
Rename azure_ad_risky_sign_ins_with_singlefactorauthencation_from_unknown_devices.yml to azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml
2023-01-10 20:37:56 +01:00
azure_ad_sign_ins_from_noncompliant_devices.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_ad_sign_ins_from_unknown_devices.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_ad_suspicious_signin_bypassing_mfa.yml
fix: wording
2023-03-21 08:58:22 +01:00
azure_ad_user_added_to_admin_role.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_ad_users_added_to_device_admin_roles.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_appid_uri_changes.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_credential_added.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_credential_modification.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_app_delegated_permissions_all_users.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_device_code_authentication.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_app_end_user_consent_blocked.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_end_user_consent.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_owner_added.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_permissions_msft.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_privileged_permissions.yml
#4149 Fix ALA Rules Compilation (parser and broken azure rules) (#4150)
2023-03-29 23:07:40 +02:00
azure_app_role_added.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_app_ropc_authentication.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_app_uri_modifications.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_application_deleted.yml
fix: rollback modified date
2023-01-09 21:14:42 +01:00
azure_application_gateway_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_application_security_group_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_blocked_account_attempt.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_change_to_authentication_method.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_conditional_access_failure.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_container_registry_created_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_creating_number_of_resources_detection.yml
fix: remove mitre link from the reference section
2023-01-09 22:21:21 +01:00
azure_device_no_longer_managed_or_compliant.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_device_or_configuration_modified_or_deleted.yml
fix: remove mitre links from ref section
2023-01-09 22:34:13 +01:00
azure_dns_zone_modified_or_deleted.yml
fix: remove mitre reference link
2023-01-09 22:19:57 +01:00
azure_federation_modified.yml
Remove mitre url
2023-01-10 18:09:04 +01:00
azure_firewall_modified_or_deleted.yml
fix: apply suggestions from code review
2023-01-09 22:23:19 +01:00
azure_firewall_rule_collection_modified_or_deleted.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_granting_permission_detection.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_group_user_addition_ca_modification.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_group_user_removal_ca_modification.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_guest_invite_failure.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_guest_to_member.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_keyvault_key_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_keyvault_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_keyvault_secrets_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_admission_controller.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
azure_kubernetes_cluster_created_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_cronjob.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_kubernetes_events_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_network_policy_change.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_pods_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_role_access.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_rolebinding_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_secret_or_config_object_access.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_kubernetes_service_account_modified_or_deleted.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_legacy_authentication_protocols.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_login_to_disabled_account.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_mfa_denies.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_mfa_disabled.yml
change status to test
2023-01-27 06:48:34 +01:00
azure_mfa_interrupted.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_network_firewall_policy_modified_or_deleted.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_network_firewall_rule_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_network_p2s_vpn_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_network_security_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_network_virtual_device_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_new_cloudshell_created.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_owner_removed_from_application_or_service_principal.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_pim_activation_approve_deny.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_pim_alerts_disabled.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_pim_change_settings.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_priviledged_role_assignment_add.yml
Updating MITRE Tactics & Techniques
2023-01-28 13:26:15 -08:00
azure_priviledged_role_assignment_bulk_change.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_privileged_account_creation.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_rare_operations.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_service_principal_created.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_service_principal_removed.yml
old experimental rule promotion
2022-10-09 16:54:04 +02:00
azure_subscription_permissions_elevation_via_activitylogs.yml
11 Files with updates Tactics/techniques/sub-techs (#3904)
2023-01-11 06:30:46 +01:00
azure_subscription_permissions_elevation_via_auditlogs.yml
Promotion rules (#3821)
2022-12-27 12:29:10 +01:00
azure_suppression_rule_created.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_tap_added.yml
fix: typos in multiple rules (#4011)
2023-02-06 13:53:23 +01:00
azure_unusual_authentication_interruption.yml
Refractor (#3794)
2022-12-18 21:00:14 +01:00
azure_user_login_blocked_by_conditional_access.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_user_password_change.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_users_authenticating_to_other_azure_ad_tenants.yml
Update tags for MITRE ATT&CK
2023-01-29 11:29:12 -08:00
azure_virtual_network_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00
azure_vpn_connection_modified_or_deleted.yml
Order yaml field
2022-10-25 07:34:10 +02:00