Jonhnathan 71c382b1f5 [New Rule] Global Administrator Role Assigned (#1686) ...

* Initial Global Administrator Role Assigned Rules

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 14252d45ee)

2022-01-27 12:55:30 +00:00

..

collection_update_event_hub_auth_rule.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

credential_access_azure_full_network_packet_capture_detected.toml

[New Rule] Azure Full Network Packet Capture Detected (#1420)

2021-10-15 23:06:27 -03:00

credential_access_key_vault_modified.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

credential_access_storage_account_key_regenerated.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_azure_application_credential_modification.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_azure_blob_permissions_modified.toml

[New Rule] Azure Blob Permissions Modification (#1499)

2021-10-14 06:59:24 -03:00

defense_evasion_azure_diagnostic_settings_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_azure_service_principal_addition.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_event_hub_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_firewall_policy_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_frontdoor_firewall_policy_deletion.toml

[New Rule] Azure Frontdoor Web Application Firewall (WAF) Policy Deleted (#1393)

2021-09-29 09:08:09 -08:00

defense_evasion_kubernetes_events_deleted.toml

[Rule Tuning] updates from documentation review for 7.16 (#1645)

2021-12-07 15:42:58 -09:00

defense_evasion_network_watcher_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

defense_evasion_suppression_rule_created.toml

[New Rule] Azure Suppression Rule Created (#1666)

2022-01-20 08:46:24 -03:00

discovery_blob_container_access_mod.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

execution_command_virtual_machine.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_azure_automation_runbook_deleted.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_azure_service_principal_credentials_added.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_kubernetes_pod_deleted.toml

[Rule Tuning] updates from documentation review for 7.16 (#1645)

2021-12-07 15:42:58 -09:00

impact_resource_group_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

impact_virtual_network_device_modified.toml

[Rule Tuning] Azure Virtual Network Device Modified or Deleted (#1679)

2022-01-27 12:19:33 +00:00

initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml

[New Rule] Azure Active Directory High Risk User AtRisk or Confirmed (#1579)

2021-11-17 19:38:12 -03:00

initial_access_azure_active_directory_high_risk_signin.toml

[Rule tuning] Azure Active Directory High Risk Sign-in (#1463)

2021-08-30 14:33:44 -08:00

initial_access_azure_active_directory_powershell_signin.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

initial_access_consent_grant_attack_via_azure_registered_application.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

initial_access_external_guest_user_invite.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_azure_automation_account_created.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_azure_automation_runbook_created_or_modified.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_azure_automation_webhook_created.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_azure_conditional_access_policy_modified.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_azure_global_administrator_role_assigned.toml

[New Rule] Global Administrator Role Assigned (#1686)

2022-01-27 12:55:30 +00:00

persistence_azure_pim_user_added_global_admin.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_azure_privileged_identity_management_role_modified.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_mfa_disabled_for_azure_user.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_user_added_as_owner_for_azure_application.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

persistence_user_added_as_owner_for_azure_service_principal.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 15:24:56 -06:00

privilege_escalation_azure_kubernetes_rolebinding_created.toml

[New Rule] Azure Kubernetes Rolebindings Created (#1576)

2021-11-29 09:16:00 -03:00