blue-team-tools

azure_aad_secops_ca_policy_removedby_bad_actor.yml

Update azure_aad_secops_ca_policy_removedby_bad_actor.yml

2022-07-27 10:43:27 +02:00

azure_aad_secops_ca_policy_updatedby_bad_actor.yml

Update azure_aad_secops_ca_policy_updatedby_bad_actor.yml

2022-07-27 10:43:44 +02:00

azure_aad_secops_new_ca_policy_addedby_bad_actor.yml

Add azure_aad_secops_new_ca_policy_addedby_bad_actor

2022-07-19 17:19:37 +02:00

azure_aad_secops_signin_failure_bad_password_threshold.yml

Rename azure_aad_secops _signin_failure_bad_password_threshold.yml to azure_aad_secops_signin_failure_bad_password_threshold.yml

2022-05-31 20:43:32 +02:00

azure_aadhybridhealth_adfs_new_server.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_aadhybridhealth_adfs_service_delete.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_account_lockout.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_ad_account_created_deleted_nonapproved_user.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_ad_account_created_deleted.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_ad_account_signin_outside_hours.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_ad_auth_failure_increase.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_ad_auth_sucess_increase.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_ad_auth_to_important_apps_using_single_factor_auth.yml

additional detections for Azure AD

2022-07-28 19:44:51 +02:00

azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml

additional detections for Azure AD

2022-07-28 19:44:51 +02:00

azure_ad_bitlocker_key_retrieval.yml

Update azure_ad_bitlocker_key_retrieval.yml

2022-06-29 06:34:11 +02:00

azure_ad_device_registration_or_join_without_mfa.yml

Update azure_ad_device_registration_or_join_without_mfa.yml

2022-07-01 14:25:20 +02:00

azure_ad_device_registration_policy_changes.yml

Update azure_ad_device_registration_policy_changes.yml

2022-07-01 14:17:21 +02:00

azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml

additional detections for Azure AD

2022-07-28 19:44:51 +02:00

azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml

additional detections for Azure AD

2022-07-28 19:44:51 +02:00

azure_ad_only_single_factor_auth_required.yml

Create azure_guest_to_member.yml

2022-07-28 07:04:13 +02:00

azure_ad_sign_ins_from_noncompliant_devices.yml

fix id

2022-07-01 21:04:56 +02:00

azure_ad_sign_ins_from_unknown_devices.yml

Update azure_ad_sign_ins_from_unknown_devices.yml

2022-06-29 06:33:24 +02:00

azure_ad_user_added_to_admin_role.yml

fix: old azure notation

2022-03-22 18:15:33 +01:00

azure_ad_users_added_to_device_admin_roles.yml

Update azure_ad_users_added_to_device_admin_roles.yml

2022-07-01 14:18:26 +02:00

azure_app_appid_uri_changes.yml

Create azure_app_appid_uri_changes.yml

2022-06-02 09:46:23 -07:00

azure_app_credential_added.yml

Update azure_app_credential_added.yml

2022-05-27 06:56:07 +02:00

azure_app_credential_modification.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_app_delegated_permissions_all_users.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_device_code_authentication.yml

Update azure_app_device_code_authentication.yml

2022-06-02 13:58:37 +02:00

azure_app_end_user_consent_blocked.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_end_user_consent.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_owner_added.yml

Create azure_app_owner_added.yml

2022-06-02 13:37:00 -07:00

azure_app_permissions_for_api.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_permissions_msft.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_privileged_permissions.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_role_added.yml

Azure AD SecOps Guide

2022-07-29 19:27:31 +02:00

azure_app_ropc_authentication.yml

Update azure_app_ropc_authentication.yml

2022-06-01 09:35:45 -07:00

azure_app_uri_modifications.yml

Create azure_app_uri_modifications.yml

2022-06-02 06:44:35 -07:00

azure_application_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_application_gateway_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_application_security_group_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_blocked_account_attempt.yml

Update azure_blocked_account_attempt.yml

2022-06-18 18:22:43 +02:00

azure_change_to_authentication_method.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_conditional_access_failure.yml

fix title case

2022-06-01 17:37:17 +02:00

azure_container_registry_created_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_creating_number_of_resources_detection.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

azure_device_no_longer_managed_or_compliant.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_device_or_configuration_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_dns_zone_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_federation_modified.yml

Update modification date

2022-06-08 18:54:03 +02:00

azure_firewall_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_firewall_rule_collection_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_granting_permission_detection.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

azure_group_user_addition_ca_modification.yml

Create azure_group_user_addition_ca_modification.yml

2022-08-05 13:46:51 -07:00

azure_group_user_removal_ca_modification.yml

Update azure_group_user_removal_ca_modification.yml

2022-08-05 06:05:24 -07:00

azure_guest_invite_failure.yml

Create azure_guest_invite_failure.yml

2022-08-10 11:01:40 -07:00

azure_guest_to_member.yml

Create azure_guest_to_member.yml

2022-07-28 07:04:13 +02:00

azure_keyvault_key_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_keyvault_modified_or_deleted.yml

fix: remove . from title

2022-04-06 17:04:10 +02:00

azure_keyvault_secrets_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_admission_controller.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

azure_kubernetes_cluster_created_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_cronjob.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

azure_kubernetes_events_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_network_policy_change.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_pods_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_role_access.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_rolebinding_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_secret_or_config_object_access.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_kubernetes_service_account_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_legacy_authentication_protocols.yml

Update azure_legacy_authentication_protocols.yml

2022-08-04 17:19:24 +01:00

azure_login_to_disabled_account.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_mfa_denies.yml

Update azure_mfa_denies.yml

2022-03-24 21:26:13 +01:00

azure_mfa_disabled.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_mfa_interrupted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_network_firewall_policy_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_network_firewall_rule_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_network_p2s_vpn_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_network_security_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_network_virtual_device_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_new_cloudshell_created.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_owner_removed_from_application_or_service_principal.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_pim_activation_approve_deny.yml

Create azure_pim_activation_approve_deny.yml

2022-08-09 10:01:01 -07:00

azure_pim_alerts_disabled.yml

Update azure_pim_alerts_disabled.yml

2022-08-09 08:39:45 -07:00

azure_pim_change_settings.yml

Create azure_pim_change_settings.yml

2022-08-09 12:42:29 -07:00

azure_priviledged_role_assignment_add.yml

Create azure_priviledged_role_assignment_add.yml

2022-08-06 07:04:33 -07:00

azure_priviledged_role_assignment_bulk_change.yml

Create azure_priviledged_role_assignment_bulk_change.yml

2022-08-05 16:06:41 -07:00

azure_privileged_account_creation.yml

Fixes spelling mistake of success (missing a c)

2022-08-16 19:27:06 +00:00

azure_privileged_account_no_saw_paw.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_privileged_account_sigin_expected_controls.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_privileged_account_signin_outside_hours.yml

Last remaining AAD SecOps Guide rules (#3364 )

2022-08-17 20:57:58 +02:00

azure_rare_operations.yml

Reference Update [Batch 1]

2022-07-07 15:24:15 +01:00

azure_service_principal_created.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_service_principal_removed.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_subscription_permissions_elevation_via_activitylogs.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

azure_subscription_permissions_elevation_via_auditlogs.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_suppression_rule_created.yml

chore: test rules: reactivate single value list check

2022-05-10 17:13:04 +02:00

azure_tap_added.yml

Create azure_tap_added.yml

2022-08-10 07:09:09 -07:00

azure_unusual_authentication_interruption.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_user_login_blocked_by_conditional_access.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_user_password_change.yml

Update azure_user_password_change.yml

2022-08-05 13:21:12 +01:00

azure_users_authenticating_to_other_azure_ad_tenants.yml

Create azure_guest_to_member.yml

2022-07-28 07:04:13 +02:00

azure_virtual_network_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00

azure_vpn_connection_modified_or_deleted.yml

refactor: first bigger log source refactoring

2022-03-22 17:58:29 +01:00