security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Update Azure / M365 Mappings (#5153)

Browse Source 
* [Rule Tuning] Update Azure / M365 Mappings
<!--
Thank you for your interest in and contributing to Detection Rules!
There are a few simple things to check before submitting your pull request
that can help with the review process. You should delete these items
from your submission, but they are here to help bring them to your attention.
-->
# Pull Request

*Issue link(s)*:
* https://github.com/elastic/detection-rules/issues/5152

<!--
  Add Related Issues / PRs for context. Eg:
    Related to elastic/repo#999
    Resolves #123
  If there is no issue link, take extra care to write a clear summary and label the PR just as you would label an issue to give additional context to reviewers.
-->

## Summary - What I changed
Updates all mappings for Azure / M365 rules for accuracy and missing mappings.

<!--
  Summarize your PR. Animated gifs are 💯. Code snippets are ⚡️. Examples & screenshots are 🔥
-->

## How To Test

<!--
  Some examples of what you could include here are:
  * Links to GitHub action results for CI test improvements
  * Sample data before/after screenshots (or short videos showing how something works)
  * Copy/pasted commands and output from the testing you did in your local terminal window
  * If tests run in GitHub, you can 🪁or 🔱, respectively, to indicate tests will run in CI
  * Query used in your stack to verify the change
-->

## Checklist

<!-- Delete any items that are not applicable to this PR. -->

- [ ] Added a label for the type of pr: `bug`, `enhancement`, `schema`, `maintenance`, `Rule: New`, `Rule: Deprecation`, `Rule: Tuning`, `Hunt: New`, or `Hunt: Tuning` so guidelines can be generated
- [ ] Added the `meta:rapid-merge` label if planning to merge within 24 hours
- [ ] Secret and sensitive material has been managed correctly
- [ ] Automated testing was updated or added to match the most common scenarios
- [ ] Documentation and comments were added for features that require explanation

## Contributor checklist

- Have you signed the [contributor license agreement](https://www.elastic.co/contributor-agreement)?
- Have you followed the [contributor guidelines](https://github.com/elastic/detection-rules/blob/main/CONTRIBUTING.md)?

* reverting changes to unit test

* changed webhook rule back to persistence

* Update rules/integrations/azure/persistence_azure_automation_webhook_created.toml

* updated date

* updating date

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
Terrance DeJesus
2025-09-30 12:58:25 -04:00
committed by GitHub
parent dcb4334e6f
commit b451ff8e4c
46 changed files with 608 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/azure/credential_access_azure_entra_suspicious_signin.toml
+17 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/28"
integration = ["azure"]
maturity = "production"
updated_date = "2025/09/26"
updated_date = "2025/09/30"
[rule]
author = ["Elastic"]
@@ -145,4 +145,20 @@ reference = "https://attack.mitre.org/techniques/T1528/"
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
rules/integrations/azure/credential_access_storage_account_key_regenerated.toml
+24 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/19"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -85,13 +85,33 @@ event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOF
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
rules/integrations/azure/defense_evasion_azure_diagnostic_settings_deletion.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/17"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -86,6 +86,10 @@ id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"
[rule.threat.tactic]
rules/integrations/azure/defense_evasion_event_hub_deletion.toml
+4 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -85,9 +85,9 @@ id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"
rules/integrations/azure/defense_evasion_firewall_policy_deletion.toml
+4 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -87,9 +87,9 @@ id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"
rules/integrations/azure/defense_evasion_frontdoor_firewall_policy_deletion.toml
+4 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2021/08/01"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Austin Songer"]
@@ -90,9 +90,9 @@ id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
id = "T1562.007"
name = "Disable or Modify Cloud Firewall"
reference = "https://attack.mitre.org/techniques/T1562/007/"
rules/integrations/azure/discovery_blob_container_access_mod.toml
+22 -10
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/20"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -76,9 +76,9 @@ event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOF
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"
id = "T1619"
name = "Cloud Storage Object Discovery"
reference = "https://attack.mitre.org/techniques/T1619/"
[rule.threat.tactic]
@@ -88,13 +88,25 @@ reference = "https://attack.mitre.org/tactics/TA0007/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
rules/integrations/azure/persistence_azure_automation_runbook_created_or_modified.toml → rules/integrations/azure/execution_azure_automation_runbook_created_or_modified.toml
+14 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -63,7 +63,7 @@ references = [
risk_score = 21
rule_id = "16280f1e-57e6-4242-aa21-bb4d16f13b2f"
severity = "low"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Configuration Audit", "Tactic: Persistence", "Resources: Investigation Guide"]
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Configuration Audit", "Tactic: Execution", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"
@@ -78,3 +78,15 @@ event.dataset:azure.activitylogs and
event.outcome:(Success or success)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1648"
name = "Serverless Execution"
reference = "https://attack.mitre.org/techniques/T1648/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
rules/integrations/azure/execution_command_virtual_machine.toml
+4 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/17"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -84,9 +84,9 @@ event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOF
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"
[rule.threat.tactic]
rules/integrations/azure/impact_kubernetes_pod_deleted.toml
+11 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2021/06/24"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Austin Songer"]
@@ -78,6 +78,16 @@ event.outcome:(Success or success)
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1489"
name = "Service Stop"
reference = "https://attack.mitre.org/techniques/T1489/"
[[rule.threat.technique]]
id = "T1529"
name = "System Shutdown/Reboot"
reference = "https://attack.mitre.org/techniques/T1529/"
[rule.threat.tactic]
id = "TA0040"
rules/integrations/azure/initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2021/10/18"
integration = ["azure"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2025/09/26"
[rule]
author = ["Austin Songer"]
@@ -89,6 +89,10 @@ framework = "MITRE ATT&CK"
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
rules/integrations/azure/initial_access_azure_active_directory_powershell_signin.toml
+18 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/12/14"
integration = ["azure"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -105,4 +105,21 @@ reference = "https://attack.mitre.org/techniques/T1078/004/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
rules/integrations/azure/credential_access_entra_id_device_code_auth_with_broker_client.toml → rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client.toml
+36 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2024/06/24"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -30,7 +30,7 @@ tags = [
"Data Source: Azure",
"Data Source: Microsoft Entra ID",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
"Tactic: Initial Access",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -84,13 +84,41 @@ Entra ID Device Code Authentication allows users to authenticate devices using a
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/azure/initial_access_entra_id_high_risk_signin.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2021/01/04"
integration = ["azure"]
maturity = "production"
updated_date = "2025/09/26"
updated_date = "2025/09/30"
[rule]
author = ["Elastic", "Willem D'Haese"]
@@ -87,6 +87,10 @@ framework = "MITRE ATT&CK"
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
rules/integrations/azure/defense_evasion_entra_id_oauth_user_impersonation_scope.toml → rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope.toml
+23 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/07/03"
integration = ["azure"]
maturity = "production"
updated_date = "2025/07/03"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -69,7 +69,6 @@ tags = [
"Data Source: Azure",
"Data Source: Microsoft Entra ID",
"Data Source: Microsoft Entra ID Sign-In Logs",
"Tactic: Defense Evasion",
"Tactic: Initial Access",
"Resources: Investigation Guide",
]
@@ -87,6 +86,23 @@ event.dataset: azure.signinlogs and
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
@@ -98,6 +114,11 @@ id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"
[[rule.threat.technique]]
id = "T1656"
name = "Impersonation"
reference = "https://attack.mitre.org/techniques/T1656/"
[rule.threat.tactic]
rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml
+22 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/30"
integration = ["azure"]
maturity = "production"
updated_date = "2025/09/26"
updated_date = "2025/09/30"
[rule]
author = ["Elastic"]
@@ -193,6 +193,15 @@ from logs-azure.signinlogs-* metadata _id, _version, _index
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
@@ -208,4 +217,16 @@ reference = "https://attack.mitre.org/techniques/T1566/002/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
rules/integrations/azure/initial_access_entra_id_user_reported_risk.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/05/21"
integration = ["azure"]
maturity = "production"
updated_date = "2025/09/08"
updated_date = "2025/09/26"
[rule]
author = ["Elastic", "Willem D'Haese"]
@@ -84,6 +84,10 @@ framework = "MITRE ATT&CK"
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
rules/integrations/azure/initial_access_entra_oauth_phishing_via_vscode_client.toml
+13 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/23"
integration = ["azure"]
maturity = "production"
updated_date = "2025/04/30"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -118,4 +118,16 @@ reference = "https://attack.mitre.org/techniques/T1566/002/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
rules/integrations/azure/initial_access_entra_rare_app_id_for_principal_auth.toml
+13 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/03/10"
integration = ["azure"]
maturity = "production"
updated_date = "2025/03/10"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -107,6 +107,18 @@ reference = "https://attack.mitre.org/techniques/T1078/004/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.new_terms]
field = "new_terms_fields"
rules/integrations/azure/initial_access_entra_rare_authentication_requirement_for_principal_user.toml
+13 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/03/10"
integration = ["azure"]
maturity = "production"
updated_date = "2025/03/25"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -127,6 +127,18 @@ reference = "https://attack.mitre.org/techniques/T1110/003/"
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.new_terms]
field = "new_terms_fields"
rules/integrations/azure/credential_access_first_time_seen_device_code_auth.toml → rules/integrations/azure/initial_access_first_time_seen_device_code_auth.toml
+21 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2024/10/14"
integration = ["azure"]
maturity = "production"
updated_date = "2025/02/21"
updated_date = "2025/09/26"
[rule]
author = ["Elastic", "Matteo Potito Giorgio"]
@@ -89,7 +89,7 @@ tags = [
"Data Source: Azure",
"Data Source: Microsoft Entra ID",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
"Tactic: Initial Access",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -109,15 +109,28 @@ event.dataset:(azure.activitylogs or azure.signinlogs)
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[rule.new_terms]
field = "new_terms_fields"
rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml
+13 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/23"
integration = ["azure"]
maturity = "production"
updated_date = "2025/09/08"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -117,6 +117,18 @@ reference = "https://attack.mitre.org/techniques/T1078/004/"
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.new_terms]
field = "new_terms_fields"
rules/integrations/azure/defense_evasion_azure_application_credential_modification.toml → rules/integrations/azure/persistence_azure_application_credential_modification.toml
+11 -12
View File
@@ -2,7 +2,7 @@
creation_date = "2020/12/14"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -74,7 +74,7 @@ tags = [
"Domain: Cloud",
"Data Source: Azure",
"Use Case: Identity and Access Audit",
"Tactic: Defense Evasion",
"Tactic: Persistence",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -88,18 +88,17 @@ event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update applica
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"
id = "T1098.001"
name = "Additional Cloud Credentials"
reference = "https://attack.mitre.org/techniques/T1098/001/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
rules/integrations/azure/persistence_azure_automation_webhook_created.toml
+24 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -77,3 +77,26 @@ event.dataset:azure.activitylogs and
event.outcome:(Success or success)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1608"
name = "Stage Capabilities"
reference = "https://attack.mitre.org/techniques/T1608/"
[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"
rules/integrations/azure/persistence_azure_pim_user_added_global_admin.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/24"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -88,6 +88,10 @@ framework = "MITRE ATT&CK"
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"
[rule.threat.tactic]
rules/integrations/azure/persistence_azure_privileged_identity_management_role_modified.toml
+8 -4
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/01"
integration = ["azure"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -86,9 +86,13 @@ event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Update role se
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"
[rule.threat.tactic]
rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device.toml
+13 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/06/24"
integration = ["azure"]
maturity = "production"
updated_date = "2025/06/24"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -132,6 +132,18 @@ name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[rule.threat.tactic]
id = "TA0001"
rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml
+10 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/30"
integration = ["azure"]
maturity = "production"
updated_date = "2025/04/30"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -91,6 +91,15 @@ id = "T1098.005"
name = "Device Registration"
reference = "https://attack.mitre.org/techniques/T1098/005/"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0003"
rules/integrations/azure/collection_update_event_hub_auth_rule.toml → rules/integrations/azure/persistence_update_event_hub_auth_rule.toml
+18 -14
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -67,7 +67,7 @@ references = ["https://docs.microsoft.com/en-us/azure/event-hubs/authorize-acces
risk_score = 47
rule_id = "b6dce542-2b75-4ffb-b7d6-38787298ba9d"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Log Auditing", "Tactic: Collection", "Resources: Investigation Guide"]
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Log Auditing", "Tactic: Persistence", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"
@@ -79,25 +79,29 @@ event.dataset:azure.activitylogs and azure.activitylogs.operation_name:"MICROSOF
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1530"
name = "Data from Cloud Storage"
reference = "https://attack.mitre.org/techniques/T1530/"
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1537"
name = "Transfer Data to Cloud Account"
reference = "https://attack.mitre.org/techniques/T1537/"
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"
[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
rules/integrations/azure/persistence_user_added_as_owner_for_azure_application.toml
+13 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/20"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -78,4 +78,16 @@ reference = "https://attack.mitre.org/techniques/T1098/"
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
rules/integrations/azure/persistence_user_added_as_owner_for_azure_service_principal.toml
+10 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/20"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -78,6 +78,15 @@ id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0003"
rules/integrations/azure/privilege_escalation_azure_kubernetes_rolebinding_created.toml
+22 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2021/10/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Austin Songer"]
@@ -82,9 +82,30 @@ event.outcome:(Success or success)
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"
[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
rules/integrations/o365/credential_access_antra_id_device_reg_via_oauth_redirection.toml
+18 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/30"
integration = ["o365"]
maturity = "production"
updated_date = "2025/04/30"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -102,4 +102,21 @@ reference = "https://attack.mitre.org/techniques/T1098/005/"
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
rules/integrations/o365/credential_access_microsoft_365_excessive_account_lockouts.toml
+16 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/05/10"
integration = ["o365"]
maturity = "production"
updated_date = "2025/07/16"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -130,6 +130,21 @@ framework = "MITRE ATT&CK"
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"
[[rule.threat.technique.subtechnique]]
id = "T1110.001"
name = "Password Guessing"
reference = "https://attack.mitre.org/techniques/T1110/001/"
[[rule.threat.technique.subtechnique]]
id = "T1110.003"
name = "Password Spraying"
reference = "https://attack.mitre.org/techniques/T1110/003/"
[[rule.threat.technique.subtechnique]]
id = "T1110.004"
name = "Credential Stuffing"
reference = "https://attack.mitre.org/techniques/T1110/004/"
[rule.threat.tactic]
rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml → rules/integrations/o365/defense_evasion_microsoft_365_exchange_anti_phish_policy_deletion.toml
+12 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -72,7 +72,7 @@ tags = [
"Domain: Cloud",
"Data Source: Microsoft 365",
"Use Case: Configuration Audit",
"Tactic: Initial Access",
"Tactic: Defense Evasion",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -86,13 +86,17 @@ event.dataset:o365.audit and event.provider:Exchange and event.category:web and
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/o365/initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml → rules/integrations/o365/defense_evasion_microsoft_365_exchange_anti_phish_rule_mod.toml
+12 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/19"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -72,7 +72,7 @@ tags = [
"Domain: Cloud",
"Data Source: Microsoft 365",
"Use Case: Configuration Audit",
"Tactic: Initial Access",
"Tactic: Defense Evasion",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -86,13 +86,17 @@ event.dataset:o365.audit and event.provider:Exchange and event.category:web and
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/o365/persistence_microsoft_365_exchange_dkim_signing_config_disabled.toml → rules/integrations/o365/defense_evasion_microsoft_365_exchange_dkim_signing_config_disabled.toml
+12 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/18"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -67,7 +67,7 @@ references = [
risk_score = 47
rule_id = "514121ce-c7b6-474a-8237-68ff71672379"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Tactic: Persistence", "Resources: Investigation Guide"]
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"
@@ -79,13 +79,17 @@ event.dataset:o365.audit and event.provider:Exchange and event.category:web and
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1556"
name = "Modify Authentication Process"
reference = "https://attack.mitre.org/techniques/T1556/"
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/o365/initial_access_microsoft_365_exchange_safelinks_disabled.toml → rules/integrations/o365/defense_evasion_microsoft_365_exchange_safelinks_disabled.toml
+12 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/18"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Domain: Cloud",
"Data Source: Microsoft 365",
"Use Case: Identity and Access Audit",
"Tactic: Initial Access",
"Tactic: Defense Evasion",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -84,13 +84,17 @@ event.dataset:o365.audit and event.provider:Exchange and event.category:web and
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/o365/defense_evasion_microsoft_365_mailboxauditbypassassociation.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2022/01/13"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -84,6 +84,10 @@ id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[[rule.threat.technique.subtechnique]]
id = "T1562.008"
name = "Disable or Modify Cloud Logs"
reference = "https://attack.mitre.org/techniques/T1562/008/"
[rule.threat.tactic]
rules/integrations/o365/defense_evasion_microsoft_365_susp_oauth2_authorization.toml
+29 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2025/05/01"
integration = ["o365"]
maturity = "production"
updated_date = "2025/07/16"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -134,4 +134,32 @@ reference = "https://attack.mitre.org/techniques/T1550/001/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[rule.threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
rules/integrations/o365/persistence_microsoft_365_teams_custom_app_interaction_allowed.toml → rules/integrations/o365/defense_evasion_microsoft_365_teams_custom_app_interaction_allowed.toml
+10 -5
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/30"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -66,7 +66,7 @@ references = ["https://docs.microsoft.com/en-us/microsoftteams/platform/concepts
risk_score = 47
rule_id = "bbd1a775-8267-41fa-9232-20e5582596ac"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Persistence", "Resources: Investigation Guide"]
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"
@@ -80,9 +80,14 @@ o365.audit.NewValue:True and event.outcome:success
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/o365/persistence_microsoft_365_teams_external_access_enabled.toml → rules/integrations/o365/defense_evasion_microsoft_365_teams_external_access_enabled.toml
+8 -8
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/30"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -65,7 +65,7 @@ references = ["https://docs.microsoft.com/en-us/microsoftteams/manage-external-a
risk_score = 47
rule_id = "27f7c15a-91f8-4c3d-8b9e-1f99cc030a51"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Persistence", "Resources: Investigation Guide"]
tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Defense Evasion", "Resources: Investigation Guide"]
timestamp_override = "event.ingested"
type = "query"
@@ -79,13 +79,13 @@ o365.audit.Parameters.AllowFederatedUsers:True and event.outcome:success
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/integrations/o365/initial_access_microsoft_365_user_restricted_from_sending_email.toml
+5 -10
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/15"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Austin Songer"]
@@ -66,7 +66,7 @@ tags = [
"Domain: Cloud",
"Data Source: Microsoft 365",
"Use Case: Configuration Audit",
"Tactic: Initial Access",
"Tactic: Impact",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
@@ -79,14 +79,9 @@ event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.c
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
rules/integrations/o365/lateral_movement_malware_uploaded_onedrive.toml
+17 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2022/01/10"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -85,4 +85,20 @@ reference = "https://attack.mitre.org/techniques/T1080/"
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1608"
name = "Stage Capabilities"
reference = "https://attack.mitre.org/techniques/T1608/"
[[rule.threat.technique.subtechnique]]
id = "T1608.001"
name = "Upload Malware"
reference = "https://attack.mitre.org/techniques/T1608/001/"
[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"
rules/integrations/o365/lateral_movement_malware_uploaded_sharepoint.toml
+17 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2022/01/10"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -84,4 +84,20 @@ reference = "https://attack.mitre.org/techniques/T1080/"
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1608"
name = "Stage Capabilities"
reference = "https://attack.mitre.org/techniques/T1608/"
[[rule.threat.technique.subtechnique]]
id = "T1608.001"
name = "Upload Malware"
reference = "https://attack.mitre.org/techniques/T1608/001/"
[rule.threat.tactic]
id = "TA0042"
name = "Resource Development"
reference = "https://attack.mitre.org/tactics/TA0042/"
rules/integrations/o365/persistence_microsoft_365_exchange_management_role_assignment.toml
+5 -1
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/20"
integration = ["o365"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/09/26"
[rule]
author = ["Elastic"]
@@ -88,6 +88,10 @@ framework = "MITRE ATT&CK"
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"
[rule.threat.tactic]