security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
652b2c5e4429bb25f408832520e64c1ccc3ccd67
sigma-rules/rules/azure
T
History
Brent Murphy 95877f7879 [Rule Tuning] Update event.category for Azure rules (#335) 
* update event.category for azure rules

* update updated_date field

* update name to include Azure

* Update persistence_user_added_as_owner_for_azure_service_principal.toml
2020-09-24 12:45:25 -04:00
..
collection_update_event_hub_auth_rule.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
credential_access_key_vault_modified.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
credential_access_storage_account_key_regenerated.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
defense_evasion_azure_conditional_access_policy_modified.toml
Refresh ATT&CK data to v7.2 and expand threat validation (#330)
2020-09-23 22:03:29 -08:00
defense_evasion_azure_diagnostic_settings_deletion.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
defense_evasion_azure_privileged_identity_management_role_modified.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
defense_evasion_event_hub_deletion.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
defense_evasion_firewall_policy_deletion.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
defense_evasion_mfa_disabled_for_azure_user.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
defense_evasion_network_watcher_deletion.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
discovery_blob_container_access_mod.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
execution_command_virtual_machine.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
impact_azure_automation_runbook_deleted.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
impact_resource_group_deletion.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
initial_access_consent_grant_attack_via_azure_registered_application.toml
Refresh ATT&CK data to v7.2 and expand threat validation (#330)
2020-09-23 22:03:29 -08:00
initial_access_external_guest_user_invite.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
persistence_azure_automation_account_created.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
persistence_azure_automation_runbook_created_or_modified.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
persistence_azure_automation_webhook_created.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
persistence_user_added_as_owner_for_azure_application.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00
persistence_user_added_as_owner_for_azure_service_principal.toml
[Rule Tuning] Update event.category for Azure rules (#335)
2020-09-24 12:45:25 -04:00