Terrance DeJesus 8d27b6069b [Rule Tuning] M365/Azure Brute-Forcing New Rule and Tuning; Deprecate Similar Rule (#4057) ...

* deprecated rule; tuned for single source inclusion

* adjusted query comments

* added min-stack

* updated date

* added Azure-based rule for brute forcing

* added reference to o365spray

* fixed tag

* adjusted query comment

* added rule for repeat source

* adjusted query to use count distinct

* added intervals; adjusted lookback window according to time truncation

2024-09-10 11:26:40 -04:00

..

collection_update_event_hub_auth_rule.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_azure_full_network_packet_capture_detected.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_entra_id_device_code_auth_with_broker_client.toml

[New Rule] Entra ID Device Code Auth with Broker Client (#3819)

2024-07-01 10:31:26 -04:00

credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml

[Rule Tuning] M365/Azure Brute-Forcing New Rule and Tuning; Deprecate Similar Rule (#4057)

2024-09-10 11:26:40 -04:00

credential_access_entra_signin_brute_force_microsoft_365.toml

[Rule Tuning] M365/Azure Brute-Forcing New Rule and Tuning; Deprecate Similar Rule (#4057)

2024-09-10 11:26:40 -04:00

credential_access_key_vault_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_storage_account_key_regenerated.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_azure_application_credential_modification.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_azure_automation_runbook_deleted.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_azure_blob_permissions_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_azure_diagnostic_settings_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_azure_service_principal_addition.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_event_hub_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_firewall_policy_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_frontdoor_firewall_policy_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_kubernetes_events_deleted.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_network_watcher_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_suppression_rule_created.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

discovery_blob_container_access_mod.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

execution_command_virtual_machine.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_azure_service_principal_credentials_added.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_kubernetes_pod_deleted.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_resource_group_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_virtual_network_device_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_azure_active_directory_high_risk_signin.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_azure_active_directory_powershell_signin.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_consent_grant_attack_via_azure_registered_application.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_external_guest_user_invite.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_automation_account_created.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_automation_runbook_created_or_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_automation_webhook_created.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_conditional_access_policy_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_global_administrator_role_assigned.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_pim_user_added_global_admin.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_privileged_identity_management_role_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_mfa_disabled_for_azure_user.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_user_added_as_owner_for_azure_application.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_user_added_as_owner_for_azure_service_principal.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_azure_kubernetes_rolebinding_created.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30