Terrance DeJesus fcd70b284b [New Rule] Multiple Microsoft 365 User Account Lockouts in Short Time Window (#4717) ...

* new rule 'Multiple Microsoft 365 User Account Lockouts in Short Time Window'

* adjusted logic

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

2025-05-19 14:44:46 -04:00

..

collection_microsoft_365_new_inbox_rule.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

collection_onedrive_excessive_file_downloads.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

credential_access_antra_id_device_reg_via_oauth_redirection.toml

[New] Microsoft 365 OAuth Redirect to Device Registration for User (#4694)

2025-05-02 08:36:10 +01:00

credential_access_microsoft_365_excessive_account_lockouts.toml

[New Rule] Multiple Microsoft 365 User Account Lockouts in Short Time Window (#4717)

2025-05-19 14:44:46 -04:00

credential_access_microsoft_365_potential_user_account_brute_force.toml

[Rule Tuning] Potential Microsoft 365 User Account Brute Force (#4716)

2025-05-19 14:08:38 -04:00

credential_access_user_excessive_sso_logon_errors.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_microsoft_365_mailboxauditbypassassociation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_microsoft_365_susp_oauth2_authorization.toml

[New] Suspicious Microsoft 365 UserLoggedIn via OAuth Code (#4691)

2025-05-06 12:53:33 +05:30

exfiltration_microsoft_365_exchange_transport_rule_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_microsoft_365_exchange_transport_rule_mod.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_microsoft_365_mass_download_by_a_single_user.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_microsoft_365_potential_ransomware_activity.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_microsoft_365_unusual_volume_of_file_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_abnormal_clientappid.toml

[Rule Tuning] Added OWA (outlook for web) new AppID (#4568)

2025-03-26 15:15:28 -03:00

initial_access_microsoft_365_entra_oauth_phishing_via_vscode_client.toml

[New Rule] MSFT Tenant OAuth Phishing via First-Party VSCode Client (#4642)

2025-05-01 22:38:41 -04:00

initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_exchange_safelinks_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_illicit_consent_grant_via_registered_application.toml

[Rule Tuning] Tuning Illicit Grant Consent Detections in Azure and M365 (#4557)

2025-03-27 15:55:04 -04:00

initial_access_microsoft_365_impossible_travel_activity.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_impossible_travel_portal_logins.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_portal_login_from_rare_location.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_microsoft_365_user_restricted_from_sending_email.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_o365_user_reported_phish_malware.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

lateral_movement_malware_uploaded_onedrive.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

lateral_movement_malware_uploaded_sharepoint.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_exchange_suspicious_mailbox_permission_delegation.toml

[Rule Tuning] Tuning Suspicious Mailbox Permission Delegation in Exchange Online (#4705)

2025-05-08 11:01:00 -04:00

persistence_microsoft_365_exchange_dkim_signing_config_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_microsoft_365_exchange_management_role_assignment.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_microsoft_365_global_administrator_role_assign.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_microsoft_365_teams_custom_app_interaction_allowed.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_microsoft_365_teams_external_access_enabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_microsoft_365_teams_guest_access_enabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_new_or_modified_federation_domain.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00