security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7be96ec64dc12ed3d2849bb408e4eecfde40dc02
sigma-rules/rules/integrations/azure
T
History
James Valente f52cfb3729 [Rule: Tuning] - Azure blob permission modification tagging - Correct tags (#4371) 
* Remove `Data Source: Elastic Defend` tag

* Update metadata

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
2025-01-13 10:40:34 -03:00
..
collection_update_event_hub_auth_rule.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
credential_access_azure_entra_totp_brute_force_attempts.toml
new rule 'Azure Entra MFA TOTP Brute Force Attempts' (#4297)
2024-12-12 11:00:02 -05:00
credential_access_azure_full_network_packet_capture_detected.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
credential_access_entra_id_device_code_auth_with_broker_client.toml
[New Rule] Entra ID Device Code Auth with Broker Client (#3819)
2024-07-01 10:31:26 -04:00
credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml
[Rule Tuning] Add KEEP Command to all ES|QL Rules (#4146)
2024-10-09 21:08:38 -04:00
credential_access_entra_signin_brute_force_microsoft_365.toml
[Rule Tuning] Add KEEP Command to all ES|QL Rules (#4146)
2024-10-09 21:08:38 -04:00
credential_access_first_time_seen_device_code_auth.toml
[New] First Time Seen User Auth via DeviceCode Protocol (#4153)
2024-11-11 13:04:18 +00:00
credential_access_key_vault_modified.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
credential_access_storage_account_key_regenerated.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_azure_application_credential_modification.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_azure_automation_runbook_deleted.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_azure_blob_permissions_modified.toml
[Rule: Tuning] - Azure blob permission modification tagging - Correct tags (#4371)
2025-01-13 10:40:34 -03:00
defense_evasion_azure_diagnostic_settings_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_azure_service_principal_addition.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_event_hub_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_firewall_policy_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_frontdoor_firewall_policy_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_kubernetes_events_deleted.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_network_watcher_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
defense_evasion_suppression_rule_created.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
discovery_blob_container_access_mod.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
execution_command_virtual_machine.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
impact_azure_service_principal_credentials_added.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
impact_kubernetes_pod_deleted.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
impact_resource_group_deletion.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
impact_virtual_network_device_modified.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
initial_access_azure_active_directory_high_risk_signin.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
initial_access_azure_active_directory_powershell_signin.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
initial_access_consent_grant_attack_via_azure_registered_application.toml
[Tuning] SDH - Possible Consent Grant Attack via Azure-Registered Application (#4283)
2024-12-06 17:27:38 -05:00
initial_access_external_guest_user_invite.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_automation_account_created.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_automation_runbook_created_or_modified.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_automation_webhook_created.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_conditional_access_policy_modified.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_global_administrator_role_assigned.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_pim_user_added_global_admin.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_privileged_identity_management_role_modified.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_mfa_disabled_for_azure_user.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_user_added_as_owner_for_azure_application.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_user_added_as_owner_for_azure_service_principal.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
privilege_escalation_azure_kubernetes_rolebinding_created.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30