security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9569aa48602c287de7eb50b4754396ca2d0117e8
sigma-rules/rules/integrations/azure
T
History
Terrance DeJesus 9569aa4860 [New Rule] Microsoft Entra ID Excessive Account Lockouts Detected (#4782) 
* new rule Microsoft Entra ID Exccessive Account Lockouts Detected

* updating investigation guide

* removed user agent exception

* linted
2025-06-10 11:31:35 -04:00
..
collection_entra_auth_broker_sharepoint_access_for_user_principal.toml
Fix new term doc broken link (#4706)
2025-05-07 17:03:58 +05:30
collection_graph_email_access_by_unusual_public_client_via_graph.toml
[New Rule] Suspicious Email Access by First-Party Application via Microsoft Graph (#4704)
2025-05-09 20:49:08 -04:00
collection_update_event_hub_auth_rule.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
credential_access_azure_entra_suspicious_signin.toml
[New] Concurrent Azure SignIns with Suspicious Properties (#4670)
2025-05-06 13:09:54 +05:30
credential_access_azure_entra_totp_brute_force_attempts.toml
Prep for Release 9.0 (#4550)
2025-03-20 20:32:07 +05:30
credential_access_azure_full_network_packet_capture_detected.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
credential_access_entra_id_device_code_auth_with_broker_client.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
credential_access_entra_id_excessive_account_lockouts.toml
[New Rule] Microsoft Entra ID Excessive Account Lockouts Detected (#4782)
2025-06-10 11:31:35 -04:00
credential_access_entra_password_spraying_non_interactive_sfa.toml
Prep for Release 9.0 (#4550)
2025-03-20 20:32:07 +05:30
credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml
Prep for Release 9.0 (#4550)
2025-03-20 20:32:07 +05:30
credential_access_entra_signin_brute_force_microsoft_365.toml
[Rule Tuning] Tuning Azure Entra Sign-in Brute Force against Microsoft 365 Accounts (#4737)
2025-05-28 13:45:15 -04:00
credential_access_first_time_seen_device_code_auth.toml
fixing double header in investigation notes (#4490)
2025-03-25 09:08:13 -04:00
credential_access_key_vault_modified.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
credential_access_storage_account_key_regenerated.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_azure_application_credential_modification.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_azure_automation_runbook_deleted.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_azure_blob_permissions_modified.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_azure_diagnostic_settings_deletion.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_entra_suspicious_auth_broker_activity_on_behalf_of_principal_user.toml
[New Rule] Adding Coverage for Suspicious Activity via Auth Broker On-Behalf-of Principal User (#4687)
2025-05-06 12:41:57 +05:30
defense_evasion_event_hub_deletion.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_firewall_policy_deletion.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_frontdoor_firewall_policy_deletion.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_kubernetes_events_deleted.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_network_watcher_deletion.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
defense_evasion_suppression_rule_created.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
discovery_blob_container_access_mod.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
discovery_bloodhound_user_agents_detected.toml
new rule for bloodhound user agents (#4769)
2025-06-04 09:11:13 -04:00
execution_command_virtual_machine.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
impact_kubernetes_pod_deleted.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
impact_resource_group_deletion.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
impact_virtual_network_device_modified.toml
deprecating 'Azure Virtual Network Device Modified or Deleted' (#4559)
2025-03-27 10:09:34 -04:00
initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
initial_access_azure_active_directory_powershell_signin.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
initial_access_entra_graph_single_session_from_multiple_addresses.toml
[New Rule] Microsoft Entra Session Reuse with Suspicious Graph Access (#4711)
2025-05-09 20:32:22 -04:00
initial_access_entra_id_high_risk_signin.toml
tuning 'Microsoft Entra ID High Risk Sign-in' (#4739)
2025-05-28 11:40:04 -04:00
initial_access_entra_id_protection_sign_in_risk_detected.toml
[Rule Tuning] Microsoft Entra ID Protection Anonymized IP Risk Detection (#4759)
2025-06-04 08:31:21 -04:00
initial_access_entra_id_protection_user_risk_detected.toml
[New Rule] Entra ID Protection - Risk Detection - User Risk (#4762)
2025-06-04 08:59:01 -04:00
initial_access_entra_id_user_reported_risk.toml
[New Rule] Microsoft Entra ID User Reported Suspicious Activity (#4740)
2025-05-28 11:55:51 -04:00
initial_access_entra_illicit_consent_grant_via_registered_application.toml
[Rule Tuning] Tuning Illicit Grant Consent Detections in Azure and M365 (#4557)
2025-03-27 15:55:04 -04:00
initial_access_entra_oauth_phishing_via_vscode_client.toml
[New Rule] MSFT Tenant OAuth Phishing via First-Party VSCode Client (#4642)
2025-05-01 22:38:41 -04:00
initial_access_entra_protection_multi_azure_identity_protection_alerts.toml
[New] Microsoft 365 OAuth Redirect to Device Registration for User (#4694)
2025-05-02 08:36:10 +01:00
initial_access_entra_rare_app_id_for_principal_auth.toml
[New Rule] Adding Coverage for Azure Entra Rare App ID for Principal Authentication (#4524)
2025-03-11 11:05:56 -04:00
initial_access_entra_rare_authentication_requirement_for_principal_user.toml
[Rule Tuning] Adjusting Microsoft Entra ID Rare Authentication Requirement for Principal User (#4562)
2025-04-16 12:21:41 -04:00
initial_access_external_guest_user_invite.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
initial_access_graph_first_occurrence_of_client_request.toml
[Rule Tuning] Microsoft Graph First Occurrence of Client Request (#4728)
2025-05-19 14:56:21 -04:00
persistence_azure_automation_account_created.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
persistence_azure_automation_runbook_created_or_modified.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
persistence_azure_automation_webhook_created.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
persistence_azure_global_administrator_role_assigned.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
persistence_azure_pim_user_added_global_admin.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
persistence_azure_privileged_identity_management_role_modified.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_azure_service_principal_credentials_added.toml
[New Hunt] Commvault Supply Chain Threat (#4748)
2025-05-28 14:11:46 -04:00
persistence_entra_conditional_access_policy_modified.toml
tuning 'Azure Conditional Access Policy Modified' (#4558)
2025-03-27 15:43:46 -04:00
persistence_entra_service_principal_created.toml
[Rule Tuning] Excluding Microsoft Entra ID Service Principal Addition Invoked by MSFT Identity (#4700)
2025-05-06 11:19:50 -04:00
persistence_mfa_disabled_for_azure_user.toml
Back-porting Version Trimming (#3704)
2024-05-23 00:45:10 +05:30
persistence_user_added_as_owner_for_azure_application.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
persistence_user_added_as_owner_for_azure_service_principal.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
privilege_escalation_azure_kubernetes_rolebinding_created.toml
[FR] Generate investigation guides (#4358)
2025-01-22 11:17:38 -06:00
privilege_escalation_entra_id_elevate_to_user_administrator_access.toml
[New Rule] Microsoft Entra ID Elevated Access to User Access Administrator (#4742)
2025-05-28 13:33:22 -04:00