security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
116f48ccda80b31dab6d80fa30b4e20f5cbd984f
sigma-rules/rules/integrations/o365
T
History
Terrance DeJesus c932ececd9 [Rule Tuning] M365 Identity Login from Atypical Travel Location - Reduce FP Noise (#5866) 
* [Rule Tuning] M365 Identity Login from Atypical Travel Location - Reduce FP Noise
Fixes #5865

* removing CMSI for FNs
2026-03-26 16:03:38 -04:00
..
collection_exchange_excessive_mail_items_accessed.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
collection_exchange_mailbox_access_by_unusual_client_app_id.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
collection_exchange_new_inbox_rule.toml
[Rule Tuning] M365 Exchange Inbox Forwarding Rule Created (#5852)
2026-03-23 10:25:58 -04:00
collection_onedrive_excessive_file_downloads.toml
[Rule Tuning] M365 OneDrive/SharePoint Excessive File Downloads (#5767)
2026-02-26 10:38:59 -05:00
collection_sharepoint_file_download_via_powershell.toml
[Rule Tuning] M365 SharePoint/OneDrive File Access via PowerShell - Convert to new_terms (#5873)
2026-03-26 11:28:36 -04:00
credential_access_entra_id_device_reg_via_oauth_redirection.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
credential_access_entra_id_potential_user_account_brute_force.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
credential_access_identity_user_account_lockouts.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_entra_id_susp_oauth2_authorization.toml
[New Rule] ConsentFix Detections (#5485)
2026-01-12 08:45:50 -05:00
defense_evasion_exchange_anti_phish_policy_deletion.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_anti_phish_rule_modification.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_dkim_signing_config_disabled.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_dlp_policy_removed.toml
[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)
2026-02-20 14:00:34 -05:00
defense_evasion_exchange_exchange_safelinks_disabled.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_mailbox_audit_bypass_association.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_malware_filter_policy_deletion.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_malware_filter_rule_mod.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_exchange_new_inbox_rule_delete_or_move.toml
[Tuning] M365 Exchange Inbox Phishing Evasion Rule Created (#5648)
2026-02-05 10:02:57 -03:00
defense_evasion_exchange_safe_attach_rule_disabled.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_mfa_notification_email_deleted.toml
[New Rule] M365 MFA Notification Email Deleted or Moved (#5779)
2026-02-26 13:21:08 -05:00
defense_evasion_sharepoint_sharing_policy_weakened.toml
[New Rule] M365 SharePoint Site Sharing Policy Weakened (#5795)
2026-03-10 09:48:59 -04:00
defense_evasion_teams_custom_app_interaction_allowed.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
defense_evasion_teams_external_access_enabled.toml
[Rule Deprecation] M365 Teams Guest & External Access Rules (#5721)
2026-02-18 10:00:24 -05:00
discovery_sharepoint_sensitive_term_search.toml
[New Rule] Microsoft 365 SharePoint/OneDrive Sensitive Search and File Access (#5777)
2026-02-26 14:29:14 -05:00
exfiltration_exchange_transport_rule_creation.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
exfiltration_exchange_transport_rule_modification.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
impact_security_compliance_potential_ransomware_activity.toml
[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)
2026-02-20 14:00:34 -05:00
impact_security_compliance_unusual_volume_of_file_deletion.toml
[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)
2026-02-20 14:00:34 -05:00
initial_access_entra_id_portal_login_atypical_travel.toml
[Rule Tuning] M365 Identity Login from Atypical Travel Location - Reduce FP Noise (#5866)
2026-03-26 16:03:38 -04:00
initial_access_entra_id_portal_login_impossible_travel.toml
[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)
2025-11-04 11:29:25 -05:00
initial_access_identity_illicit_consent_grant_via_registered_application.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml
[New Rule] ConsentFix Detections (#5485)
2026-01-12 08:45:50 -05:00
initial_access_identity_unusual_sso_errors_for_user.toml
[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported (#5677)
2026-02-17 13:55:24 -05:00
initial_access_security_compliance_user_reported_phish_malware.toml
[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)
2026-02-20 14:00:34 -05:00
initial_access_security_compliance_user_restricted_from_sending_email.toml
[Rule Deprecation] Deprecate Individual MSFT Compliance Rules (#5679)
2026-02-20 14:00:34 -05:00
lateral_movement_onedrive_malware_uploaded.toml
[FR] Minor Typo Fixes (#5784)
2026-03-06 16:12:45 -06:00
lateral_movement_sharepoint_malware_uploaded.toml
[FR] Minor Typo Fixes (#5784)
2026-03-06 16:12:45 -06:00
persistence_entra_id_global_administrator_role_assign.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
persistence_exchange_management_role_assignment.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
persistence_exchange_suspicious_mailbox_permission_delegation.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
persistence_teams_guest_access_enabled.toml
[Rule Deprecation] M365 Teams Guest & External Access Rules (#5721)
2026-02-18 10:00:24 -05:00
privilege_escalation_exchange_new_or_modified_federation_domain.toml
[Rule Tuning] Update Azure / M365 Rule Names and File Paths (#5172)
2025-12-10 12:59:50 -05:00
privilege_escalation_sharepoint_site_collection_admin_added.toml
[New Rule] M365 SharePoint Site Administrator Added (#5806)
2026-03-17 10:49:24 -04:00