Terrance DeJesus 4b7aa67213 [New Rule] Adding Coverage for M365 OneDrive Excessive File Downloads with OAuth Token (#4469) ...

* new rule 'M365 OneDrive Excessive File Downloads with OAuth Token'

* removed Azure data source tag; added saas tag

* removed Azure data source tag; added saas tag

* updated mitre mappings

* added tactic:collection tag

* removed file directory, added targeted_time_window to aggregation

2025-02-21 10:45:04 -05:00

..

aws

[New Hunt] Adding Hunting Queries for AWS SNS exfiltration and data collection (#4458)

2025-02-20 10:53:36 -05:00

aws_bedrock

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

azure

[Rule Tuning] Expanding coverage for First Occurrence of Entra ID Auth via DeviceCode Protocol (#4466)

2025-02-20 10:29:04 -05:00

beaconing

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

cloud_defend

[Rule Tuning] Event Aggregation - Fix event.action & event.type conditions (#4445)

2025-02-07 18:42:28 -03:00

cyberarkpas

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

ded

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

dga

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

endpoint

[Rule Tuning] Decrease Interval to 1m for Endpoint Promotions (#4450)

2025-02-07 08:30:35 -06:00

fim

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

gcp

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

github

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

google_workspace

Fix spacing in Setup information (#4470)

2025-02-20 10:04:13 +05:30

kubernetes

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

lmd

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

o365

[New Rule] Adding Coverage for M365 OneDrive Excessive File Downloads with OAuth Token (#4469)

2025-02-21 10:45:04 -05:00

okta

Fix spacing in Setup information (#4470)

2025-02-20 10:04:13 +05:30

problemchild

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00