security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
29cdcc88815be878165eb0a026be1f3e2ee195cf
sigma-rules/rules/integrations/o365
T
History
Jonhnathan b214688afe [New Rule] OneDrive Malware File Upload (#1693) 
* "OneDrive Malware File Upload" Initial Rule

* bump severity

(cherry picked from commit f7bc13b437)
2022-01-27 19:21:13 +00:00
..
collection_microsoft_365_new_inbox_rule.toml
[Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created (#1683)
2022-01-27 12:23:00 +00:00
credential_access_microsoft_365_brute_force_user_account_attempt.toml
[Rule Tuning] Fix event.outcome condition on O365 failed logon related rules (#1687)
2022-01-27 12:24:37 +00:00
credential_access_microsoft_365_potential_password_spraying_attack.toml
[Rule Tuning] Fix event.outcome condition on O365 failed logon related rules (#1687)
2022-01-27 12:24:37 +00:00
credential_access_user_excessive_sso_logon_errors.toml
[Rule Tuning] O365 Excessive Single Sign-On Logon Errors (#1680)
2022-01-20 11:34:29 +00:00
defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_microsoft_365_mailboxauditbypassassociation.toml
[New Rule] Mailbox Audit Logging Bypass (#1702)
2022-01-13 20:35:10 +00:00
exfiltration_microsoft_365_exchange_transport_rule_creation.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
exfiltration_microsoft_365_exchange_transport_rule_mod.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
impact_microsoft_365_mass_download_by_a_single_user.toml
[Rule Tuning] updates from documentation review for 7.16 (#1645)
2021-12-08 00:45:10 +00:00
impact_microsoft_365_potential_ransomware_activity.toml
[Rule Tuning] updates from documentation review for 7.16 (#1645)
2021-12-08 00:45:10 +00:00
impact_microsoft_365_unusual_volume_of_file_deletion.toml
Add missing Integration field (#1537)
2021-10-26 12:05:12 -03:00
initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
initial_access_microsoft_365_exchange_safelinks_disabled.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
initial_access_microsoft_365_impossible_travel_activity.toml
[New Rule] Microsoft 365 - Impossible travel activity (#1344)
2021-10-12 19:11:32 -03:00
initial_access_microsoft_365_user_restricted_from_sending_email.toml
[New Rule] Microsoft 365 - User Restricted from Sending Email (#1345)
2021-10-12 18:32:54 -03:00
lateral_movement_malware_uploaded_onedrive.toml
[New Rule] OneDrive Malware File Upload (#1693)
2022-01-27 19:21:13 +00:00
lateral_movement_malware_uploaded_sharepoint.toml
[New Rule] SharePoint Malware File Upload (#1691)
2022-01-27 19:14:47 +00:00
microsoft_365_exchange_dkim_signing_config_disabled.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
microsoft_365_teams_custom_app_interaction_allowed.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_exchange_suspicious_mailbox_right_delegation.toml
Add missing Integration field (#1537)
2021-10-26 12:05:12 -03:00
persistence_microsoft_365_exchange_management_role_assignment.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_microsoft_365_global_administrator_role_assign.toml
[New Rule] Global Administrator Role Assigned (#1686)
2022-01-27 12:55:01 +00:00
persistence_microsoft_365_teams_external_access_enabled.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_microsoft_365_teams_guest_access_enabled.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
privilege_escalation_new_or_modified_federation_domain.toml
Add missing Integration field (#1537)
2021-10-26 12:05:12 -03:00