Brent Murphy 7857787328 [New Rule] Azure Global Administrator Role Addition to PIM User (#336) ...

* Create persistence_azure_pim_user_added_global_admin.toml

* tweak syntax for readability

* Update additional rule name to match others naming convention

* Delete defense_evasion_azure_diagnostic_settings_deletion.toml

* tweak rule name

* Update rules/azure/persistence_azure_pim_user_added_global_admin.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/azure/persistence_azure_pim_user_added_global_admin.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* update description and lint

* small naming tweak for consistency

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2020-09-28 10:45:59 -04:00

..

collection_update_event_hub_auth_rule.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

credential_access_key_vault_modified.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

credential_access_storage_account_key_regenerated.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

defense_evasion_azure_conditional_access_policy_modified.toml

Refresh ATT&CK data to v7.2 and expand threat validation (#330)

2020-09-23 22:03:29 -08:00

defense_evasion_azure_diagnostic_settings_deletion.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

defense_evasion_azure_privileged_identity_management_role_modified.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

defense_evasion_event_hub_deletion.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

defense_evasion_firewall_policy_deletion.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

defense_evasion_mfa_disabled_for_azure_user.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

defense_evasion_network_watcher_deletion.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

discovery_blob_container_access_mod.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

execution_command_virtual_machine.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

impact_azure_automation_runbook_deleted.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

impact_resource_group_deletion.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

initial_access_consent_grant_attack_via_azure_registered_application.toml

Refresh ATT&CK data to v7.2 and expand threat validation (#330)

2020-09-23 22:03:29 -08:00

initial_access_external_guest_user_invite.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

persistence_azure_automation_account_created.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

persistence_azure_automation_runbook_created_or_modified.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

persistence_azure_automation_webhook_created.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

persistence_azure_pim_user_added_global_admin.toml

[New Rule] Azure Global Administrator Role Addition to PIM User (#336)

2020-09-28 10:45:59 -04:00

persistence_user_added_as_owner_for_azure_application.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00

persistence_user_added_as_owner_for_azure_service_principal.toml

[Rule Tuning] Update event.category for Azure rules (#335)

2020-09-24 12:45:25 -04:00