security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update impact_azure_service_principal_credentials_added.toml (#1802)

Browse Source 
(cherry picked from commit 8a9b52f7e1)
This commit is contained in:
Jonhnathan
2022-03-02 05:36:21 -03:00
committed by github-actions[bot]
parent 73b3bec457
commit 31f75bd7e6
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/azure/impact_azure_service_principal_credentials_added.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/05/05"
maturity = "production"
updated_date = "2021/07/20"
updated_date = "2022/02/28"
integration = "azure"
[rule]
@@ -37,7 +37,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal credentials." and event.outcome:(success or Success)
event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Add service principal credentials" and event.outcome:(success or Success)
'''