Austin Songer 8c2c6ea6ec [New Rule] Microsoft 365 - Mass download by a single user (#1348) ...

* Create impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update impact_microsoft_365_mass_download_by_a_single_user.toml

* Update rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit 3303a4e255)

2021-10-15 19:02:52 +00:00

..

collection_microsoft_365_new_inbox_rule.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

credential_access_microsoft_365_brute_force_user_account_attempt.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

credential_access_microsoft_365_potential_password_spraying_attack.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

credential_access_user_excessive_sso_logon_errors.toml

[Rule Tuning] Rule description tweaks (#1388)

2021-07-29 18:57:11 +00:00

defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

exfiltration_microsoft_365_exchange_transport_rule_creation.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

exfiltration_microsoft_365_exchange_transport_rule_mod.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

impact_microsoft_365_mass_download_by_a_single_user.toml

[New Rule] Microsoft 365 - Mass download by a single user (#1348)

2021-10-15 19:02:52 +00:00

impact_microsoft_365_potential_ransomware_activity.toml

[New Rule] Microsoft 365 - Potential ransomware activity (#1346)

2021-10-12 21:27:11 +00:00

initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

initial_access_microsoft_365_exchange_safelinks_disabled.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

initial_access_microsoft_365_impossible_travel_activity.toml

[New Rule] Microsoft 365 - Impossible travel activity (#1344)

2021-10-12 22:12:31 +00:00

initial_access_microsoft_365_user_restricted_from_sending_email.toml

[New Rule] Microsoft 365 - User Restricted from Sending Email (#1345)

2021-10-12 21:34:01 +00:00

microsoft_365_exchange_dkim_signing_config_disabled.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

microsoft_365_teams_custom_app_interaction_allowed.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

persistence_exchange_suspicious_mailbox_right_delegation.toml

Made these pull requests before the directory restructure. (#1517)

2021-10-05 12:30:40 +00:00

persistence_microsoft_365_exchange_management_role_assignment.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

persistence_microsoft_365_teams_external_access_enabled.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

persistence_microsoft_365_teams_guest_access_enabled.toml

[Fleet] Track integrations in folder and metadata (#1372)

2021-07-21 21:25:48 +00:00

privilege_escalation_new_or_modified_federation_domain.toml

Rename new_or_modified_federation_domain.toml to correspond with tactic (#1511)

2021-09-30 21:09:35 +00:00