security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix minstack version for O365 prod rules (#3565)

Browse Source
This commit is contained in:
shashank-elastic
2024-04-02 21:33:18 +05:30
committed by GitHub
parent 4ab7c9b178
commit 0e2eb5a84c
29 changed files with 88 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/o365/collection_microsoft_365_new_inbox_rule.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/03/29"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic", "Gary Blackwell", "Austin Songer"]
rules/integrations/o365/credential_access_microsoft_365_brute_force_user_account_attempt.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/30"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/17"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic", "Willem D'Haese", "Austin Songer"]
rules/integrations/o365/credential_access_microsoft_365_potential_password_spraying_attack.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/12/01"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/05"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/credential_access_user_excessive_sso_logon_errors.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/05/17"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2024/01/05"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic", "Austin Songer"]
rules/integrations/o365/defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/20"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/defense_evasion_microsoft_365_mailboxauditbypassassociation.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2022/01/13"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/exfiltration_microsoft_365_exchange_transport_rule_creation.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/18"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/exfiltration_microsoft_365_exchange_transport_rule_mod.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/impact_microsoft_365_potential_ransomware_activity.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/07/15"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Austin Songer"]
rules/integrations/o365/impact_microsoft_365_unusual_volume_of_file_deletion.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/07/15"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Austin Songer"]
rules/integrations/o365/initial_access_microsoft_365_abnormal_clientappid.toml
+4 -4
View File
@@ -1,10 +1,10 @@
[metadata]
creation_date = "2023/07/18"
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term"
min_stack_version = "8.6.0"
integration = ["o365"]
updated_date = "2023/07/18"
maturity = "production"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/initial_access_microsoft_365_exchange_safelinks_disabled.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/18"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/initial_access_microsoft_365_user_restricted_from_sending_email.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/07/15"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Austin Songer"]
rules/integrations/o365/initial_access_o365_user_reported_phish_malware.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2022/01/12"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/lateral_movement_malware_uploaded_onedrive.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2022/01/10"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/lateral_movement_malware_uploaded_sharepoint.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2022/01/10"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/persistence_exchange_suspicious_mailbox_right_delegation.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/05/17"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic", "Austin Songer"]
rules/integrations/o365/persistence_microsoft_365_exchange_dkim_signing_config_disabled.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/18"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/persistence_microsoft_365_exchange_management_role_assignment.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/20"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/persistence_microsoft_365_global_administrator_role_assign.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2022/01/06"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/persistence_microsoft_365_teams_custom_app_interaction_allowed.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/30"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/persistence_microsoft_365_teams_external_access_enabled.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/30"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/persistence_microsoft_365_teams_guest_access_enabled.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2020/11/20"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Elastic"]
rules/integrations/o365/privilege_escalation_new_or_modified_federation_domain.toml
+3 -3
View File
@@ -2,9 +2,9 @@
creation_date = "2021/05/17"
integration = ["o365"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
min_stack_version = "8.8.0"
updated_date = "2024/04/02"
[rule]
author = ["Austin Songer"]