security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5561738f28ab42c19c09a8465b0d42eaf4fb4236
sigma-rules/rules/azure
T
History
Brent Murphy c5cae5c437 [New Rule] Azure Active Directory PowerShell Sign-in (#718) 
* Create initial_access_azure_active_directory_powershell_signon.toml

* Apply suggestions from code review

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update initial_access_azure_active_directory_powershell_signin.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
2020-12-15 11:52:43 -05:00
..
collection_update_event_hub_auth_rule.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
credential_access_key_vault_modified.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
credential_access_storage_account_key_regenerated.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
defense_evasion_azure_application_credential_modification.toml
[New Rule] Azure Application Credential Modification (#716)
2020-12-15 11:41:26 -05:00
defense_evasion_azure_diagnostic_settings_deletion.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
defense_evasion_azure_service_principal_addition.toml
[New Rule] Azure Service Principal Addition (#717)
2020-12-15 11:47:23 -05:00
defense_evasion_event_hub_deletion.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
defense_evasion_firewall_policy_deletion.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
defense_evasion_network_watcher_deletion.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
discovery_blob_container_access_mod.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
execution_command_virtual_machine.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
impact_azure_automation_runbook_deleted.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
impact_resource_group_deletion.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
initial_access_azure_active_directory_powershell_signin.toml
[New Rule] Azure Active Directory PowerShell Sign-in (#718)
2020-12-15 11:52:43 -05:00
initial_access_consent_grant_attack_via_azure_registered_application.toml
[Rule Tuning] Possible Consent Grant Attack via Azure-Registered Application (#575)
2020-12-08 17:20:30 -07:00
initial_access_external_guest_user_invite.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_azure_automation_account_created.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_azure_automation_runbook_created_or_modified.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_azure_automation_webhook_created.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_azure_conditional_access_policy_modified.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_azure_pim_user_added_global_admin.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_azure_privileged_identity_management_role_modified.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_mfa_disabled_for_azure_user.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_user_added_as_owner_for_azure_application.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00
persistence_user_added_as_owner_for_azure_service_principal.toml
Refresh beats and ecs schemas and default to use latest to validate (#570)
2020-12-01 13:24:20 -09:00