Terrance DeJesus 6a7c1e9674 [Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679) ...

* [Rule Tuning] Deprecate Individual MSFT Defender Rules / Create BBR MSFT Defender Rule
Fixes #5678

* adjusted naming; fixed mitre match

* adding M365 Exchange DLP Policy Deleted to deprecation

* adjusted BBR naming to represent Purview and not Defender

* added tactic tags

* adding filebeat

* removed new rule

2026-02-20 14:00:34 -05:00

..

collection_exchange_excessive_mail_items_accessed.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

collection_exchange_mailbox_access_by_unusual_client_app_id.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

collection_exchange_new_inbox_rule.toml

[Tuning] M365 Exchange Inbox Forwarding Rule Created (#5647)

2026-02-04 13:50:55 +00:00

collection_onedrive_excessive_file_downloads.toml

[Rule Tuning] M365 OneDrive Excessive File Downloads with OAuth Token (#5365)

2025-12-03 14:13:35 -05:00

credential_access_entra_id_device_reg_via_oauth_redirection.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

credential_access_entra_id_potential_user_account_brute_force.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

credential_access_identity_user_account_lockouts.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_entra_id_susp_oauth2_authorization.toml

[New Rule] ConsentFix Detections (#5485)

2026-01-12 08:45:50 -05:00

defense_evasion_exchange_anti_phish_policy_deletion.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_anti_phish_rule_modification.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_dkim_signing_config_disabled.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_dlp_policy_removed.toml

[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)

2026-02-20 14:00:34 -05:00

defense_evasion_exchange_exchange_safelinks_disabled.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_mailbox_audit_bypass_association.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_malware_filter_policy_deletion.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_malware_filter_rule_mod.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_exchange_new_inbox_rule_delete_or_move.toml

[Tuning] M365 Exchange Inbox Phishing Evasion Rule Created (#5648)

2026-02-05 10:02:57 -03:00

defense_evasion_exchange_safe_attach_rule_disabled.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_teams_custom_app_interaction_allowed.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

defense_evasion_teams_external_access_enabled.toml

[Rule Deprecation] M365 Teams Guest & External Access Rules (#5721)

2026-02-18 10:00:24 -05:00

exfiltration_exchange_transport_rule_creation.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

exfiltration_exchange_transport_rule_modification.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

impact_security_compliance_potential_ransomware_activity.toml

[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)

2026-02-20 14:00:34 -05:00

impact_security_compliance_unusual_volume_of_file_deletion.toml

[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)

2026-02-20 14:00:34 -05:00

initial_access_entra_id_portal_login_atypical_travel.toml

[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)

2025-11-04 11:29:25 -05:00

initial_access_entra_id_portal_login_impossible_travel.toml

[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)

2025-11-04 11:29:25 -05:00

initial_access_identity_illicit_consent_grant_via_registered_application.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml

[New Rule] ConsentFix Detections (#5485)

2026-01-12 08:45:50 -05:00

initial_access_identity_unusual_sso_errors_for_user.toml

[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported (#5677)

2026-02-17 13:55:24 -05:00

initial_access_security_compliance_user_reported_phish_malware.toml

[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)

2026-02-20 14:00:34 -05:00

initial_access_security_compliance_user_restricted_from_sending_email.toml

[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)

2026-02-20 14:00:34 -05:00

lateral_movement_onedrive_malware_uploaded.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

lateral_movement_sharepoint_malware_uploaded.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

persistence_entra_id_global_administrator_role_assign.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

persistence_exchange_management_role_assignment.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

persistence_exchange_suspicious_mailbox_permission_delegation.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00

persistence_teams_guest_access_enabled.toml

[Rule Deprecation] M365 Teams Guest & External Access Rules (#5721)

2026-02-18 10:00:24 -05:00

privilege_escalation_exchange_new_or_modified_federation_domain.toml

[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)

2025-12-10 12:59:50 -05:00