Jonhnathan 7a2d7237b6 [Security Content] Add Investigation Guides - Cloud - 3 (#2132) ...

* [Security Content] Add Investigation Guides - Cloud - 3

* Apply suggestions from code review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

* Update rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml

* update dates

* Apply suggestions from review

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

Removed changes from:
- rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled.toml

(selectively cherry picked from commit 91c00fd442)

2022-07-27 18:41:05 +00:00

..

collection_update_event_hub_auth_rule.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

credential_access_azure_full_network_packet_capture_detected.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

credential_access_key_vault_modified.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

credential_access_storage_account_key_regenerated.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_azure_application_credential_modification.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_azure_automation_runbook_deleted.toml

[Rule Tuning] Missing MITRE ATT&CK Mappings (#2073)

2022-07-22 18:31:42 +00:00

defense_evasion_azure_blob_permissions_modified.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_azure_diagnostic_settings_deletion.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_azure_service_principal_addition.toml

[Security Content] Add Investigation Guides - Cloud - 2 (#2124)

2022-07-22 17:33:44 +00:00

defense_evasion_event_hub_deletion.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_firewall_policy_deletion.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_frontdoor_firewall_policy_deletion.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_kubernetes_events_deleted.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_network_watcher_deletion.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

defense_evasion_suppression_rule_created.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

discovery_blob_container_access_mod.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

execution_command_virtual_machine.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

impact_azure_service_principal_credentials_added.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

impact_kubernetes_pod_deleted.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

impact_resource_group_deletion.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

impact_virtual_network_device_modified.toml

[Rule Tuning] Missing MITRE ATT&CK Mappings (#2073)

2022-07-22 18:31:42 +00:00

initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml

[Security Content] Add Investigation Guides - Cloud - 2 (#2124)

2022-07-22 17:33:44 +00:00

initial_access_azure_active_directory_high_risk_signin.toml

[Security Content] Add Investigation Guides - Cloud - 2 (#2124)

2022-07-22 17:33:44 +00:00

initial_access_azure_active_directory_powershell_signin.toml

[Security Content] Add Investigation Guides - Cloud - 2 (#2124)

2022-07-22 17:33:44 +00:00

initial_access_consent_grant_attack_via_azure_registered_application.toml

[Security Content] Add Investigation Guides - Cloud - 2 (#2124)

2022-07-22 17:33:44 +00:00

initial_access_external_guest_user_invite.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_azure_automation_account_created.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_azure_automation_runbook_created_or_modified.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_azure_automation_webhook_created.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_azure_conditional_access_policy_modified.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_azure_global_administrator_role_assigned.toml

[Rule Tuning] Missing MITRE ATT&CK Mappings (#2073)

2022-07-22 18:31:42 +00:00

persistence_azure_pim_user_added_global_admin.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_azure_privileged_identity_management_role_modified.toml

[Security Content] Add Investigation Guides - Cloud - 2 (#2124)

2022-07-22 17:33:44 +00:00

persistence_mfa_disabled_for_azure_user.toml

[Security Content] Add Investigation Guides - Cloud - 3 (#2132)

2022-07-27 18:41:05 +00:00

persistence_user_added_as_owner_for_azure_application.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

persistence_user_added_as_owner_for_azure_service_principal.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00

privilege_escalation_azure_kubernetes_rolebinding_created.toml

2058 add setup field to metadata (#2061)

2022-07-18 21:25:32 +00:00