security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wrap azure operation name (#981)

Browse Source
This commit is contained in:
Brent Murphy
2021-03-04 17:50:19 -05:00
committed by GitHub
parent 4d3ef43b01
commit 3b7eedcc31
14 changed files with 41 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/azure/collection_update_event_hub_auth_rule.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -34,7 +34,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/WRITE" and event.outcome:(Success or success)
'''
rules/azure/credential_access_key_vault_modified.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/31"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -35,7 +35,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.KEYVAULT/VAULTS/WRITE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.KEYVAULT/VAULTS/WRITE" and event.outcome:(Success or success)
'''
rules/azure/credential_access_storage_account_key_regenerated.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/19"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -34,7 +34,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION" and event.outcome:(Success or success)
'''
rules/azure/defense_evasion_azure_diagnostic_settings_deletion.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/17"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE" and event.outcome:(Success or success)
'''
rules/azure/defense_evasion_event_hub_deletion.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -35,7 +35,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE" and event.outcome:(Success or success)
'''
rules/azure/defense_evasion_firewall_policy_deletion.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -31,7 +31,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE" and event.outcome:(Success or success)
'''
rules/azure/defense_evasion_network_watcher_deletion.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/31"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.NETWORK/NETWORKWATCHERS/DELETE" and event.outcome:(Success or success)
'''
rules/azure/discovery_blob_container_access_mod.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/20"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -31,7 +31,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE" and event.outcome:(Success or success)
'''
rules/azure/execution_command_virtual_machine.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/17"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -38,7 +38,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" and event.outcome:(Success or success)
'''
rules/azure/impact_azure_automation_runbook_deleted.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/09/01"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -29,6 +29,6 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DELETE" and event.outcome:(Success or success)
'''
rules/azure/impact_resource_group_deletion.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/17"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -35,7 +35,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE" and event.outcome:(Success or success)
'''
rules/azure/persistence_azure_automation_account_created.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -30,7 +30,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WRITE and event.outcome:(Success or success)
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WRITE" and event.outcome:(Success or success)
'''
rules/azure/persistence_azure_automation_runbook_created_or_modified.toml
+9 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -29,6 +29,13 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE or MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE or MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION) and event.outcome:(Success or success)
event.dataset:azure.activitylogs and
azure.activitylogs.operation_name:
(
"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/WRITE" or
"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE" or
"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/PUBLISH/ACTION"
) and
event.outcome:(Success or success)
'''
rules/azure/persistence_azure_automation_webhook_created.toml
+8 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/18"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/04"
[rule]
author = ["Elastic"]
@@ -31,6 +31,12 @@ to = "now-25m"
type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/ACTION or MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE) and event.outcome:(Success or success)
event.dataset:azure.activitylogs and
azure.activitylogs.operation_name:
(
"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/ACTION" or
"MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE"
) and
event.outcome:(Success or success)
'''