sigma-rules

collection_google_drive_ownership_transferred_via_google_workspace.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

collection_google_workspace_custom_gmail_route_created_or_modified.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user.toml

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

defense_evasion_application_removed_from_blocklist_in_google_workspace.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

defense_evasion_domain_added_to_google_workspace_trusted_domains.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

defense_evasion_google_workspace_bitlocker_setting_disabled.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

google_workspace_alert_center_promotion.toml

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

impact_google_workspace_admin_role_deletion.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

impact_google_workspace_mfa_enforcement_disabled.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

initial_access_external_user_added_to_google_workspace_group.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

initial_access_google_workspace_suspended_user_renewed.toml

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

initial_access_object_copied_to_external_drive_with_app_consent.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_application_added_to_google_workspace_domain.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_2sv_policy_disabled.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_admin_role_assigned_to_user.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_api_access_granted_via_dwd.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_custom_admin_role_created.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_password_policy_modified.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_role_modified.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_google_workspace_user_organizational_unit_changed.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00

persistence_mfa_disabled_for_google_workspace_organization.toml

[Docs | Rule Tuning] Add blog references to rules (#4097 )

2024-09-25 15:19:20 -05:00