230b59dfc9
rule-tuning-user-added-as-owner-for-azure-service-principal ( #258 )
2020-09-04 08:36:20 -06:00
bcd698add2
[New Rule] Azure Event Hub Deletion ( #170 )
...
* Create defense_evasion_event_hub_deletion.toml
* Update rules/azure/defense_evasion_event_hub_deletion.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* Update rules/azure/defense_evasion_event_hub_deletion.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
* lint
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
2020-09-04 10:23:43 -04:00
a49d102de3
[New Rule] Azure Event Hub Authorization Rule Created or Updated ( #173 )
...
* Create collection_update_event_hub_auth_rule.toml
* Update rules/azure/collection_update_event_hub_auth_rule.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/collection_update_event_hub_auth_rule.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-09-04 09:32:30 -04:00
0ac7f3d672
[New Rule] Azure Firewall Policy Deletion ( #169 )
...
* Create defense_evasion_firewall_policy_deletion.toml
* Update rules/azure/defense_evasion_firewall_policy_deletion.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
2020-09-04 09:28:58 -04:00
9025a7d183
[New Rule] Azure Diagnostic Settings Deletion ( #157 )
...
* Create azure_diagnostic_settings_deletion.toml
* Update azure_diagnostic_settings_deletion.toml
2020-09-04 09:20:13 -04:00
b4a15960cb
[New Rule] Azure Command Execution on Virtual Machine ( #155 )
...
* Create execution_command_virtual_machine.toml
* Update execution_command_virtual_machine.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
2020-09-03 17:09:40 -04:00
6b04105936
[New Rule] Azure Resource Group Deletion ( #158 )
...
* Create impact_resource_group_deletion.toml
* Update rules/azure/impact_resource_group_deletion.toml
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com >
2020-09-03 17:06:43 -04:00
1f555c289f
[New Rule] Azure Privileged Identity Management Role Modified ( #238 )
...
* new-rule-azure-pim-role-modified
* Add ATT&CK metadata to rule
* Update rules/azure/defense_evasion_azure_privileged_identity_management_role_modified.toml
2020-09-03 15:02:14 -06:00
89db7384a0
[New Rule] Azure Automation Runbook Deleted ( #235 )
...
* new-rule-azure-automation-runbook-deleted
* Update rules/azure/impact_azure_automation_runbook_deleted.toml
Fix typo in rule description
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/impact_azure_automation_runbook_deleted.toml
Remove superfluous parens from query
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-09-03 13:09:40 -06:00
225aba61c9
[New Rule] Multi-Factor Authentication Disabled for an Azure User ( #195 )
...
* new-rule-mfa-disabled-for-an-azure-user
* Update rules/azure/defense_evasion_mfa_disabled_for_azure_user.toml
Update ECS version
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/defense_evasion_mfa_disabled_for_azure_user.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-09-03 12:42:27 -06:00
43204391b6
[New Rule] User Added as Owner for Azure Service Principal ( #194 )
...
* new-rule-user-added-as-owner-for-azure-service-principal
* Update rules/azure/defense_evasion_user_added_as_owner_for_azure_application.toml
Add parens to query
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/defense_evasion_user_added_as_owner_for_azure_application.toml
Update ECS version
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
2020-09-03 12:21:44 -06:00
43f657ac4e
[New Rule] User Added as Owner for Azure Application ( #191 )
...
* new-rule-user-added-as-owner-for-azure-application
* Update rule name and description
* Update rules/azure/defense_evasion_user_added_as_owner_for_azure_application.toml
Update query to remove superfluous quotes
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/defense_evasion_user_added_as_owner_for_azure_application.toml
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
* Add ATT&CK metadata to rule
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
2020-09-03 12:15:33 -06:00
4c431d2408
[New Rule] Azure Automation Webhook Created ( #179 )
...
* new-rule-azure-automation-webhook-created
* Update rules/azure/persistence_azure_automation_webhook_created.toml
Update description
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update rules/azure/persistence_azure_automation_webhook_created.toml
Update ecs_version
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
2020-09-03 11:20:50 -06:00
98f216404a
[New Rule] Azure Automation Runbook Created or Modified ( #178 )
...
* new-rule-azure-automation-runbook-created-or-modified
* Update rules/azure/persistence_azure_automation_runbook_created_or_modified.toml
Update ecs_version
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-09-03 11:16:42 -06:00
85e799b378
[New Rule] Azure Automation Account Created ( #177 )
...
* new-rule-azure-automation-account-created
* Fix rule name format 😄
* Update rules/azure/persistence_azure_automation_account_created.toml
Update maturity to production
* Update rules/azure/persistence_azure_automation_account_created.toml
Update ecs_version to 1.6.0
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com >
2020-09-03 11:08:38 -06:00
David French