Samirbous db688e43b3 [New] Microsoft Entra ID Protection Alert and Device Registration (#4688) ...

* [New] Device Registration via OAuth Code Authentication

* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml

* Create persistence_identity_protect_alert_followed_by_device_reg.toml

* Update credential_access_antra_id_device_reg_via_oauth_redirection.toml

* Create initial_access_multi_azure_identity_protection_alerts.toml

* changed from KQL to EQL

* updated rules; query logic changes; investigation guides; schema

* updating patch version

* Update pyproject.toml

* ++

* Update non-ecs-schema.json

* Update rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Update rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Update persistence_identity_protect_alert_followed_by_device_reg.toml

* Update persistence_identity_protect_alert_followed_by_device_reg.toml

* Update persistence_identity_protect_alert_followed_by_device_reg.toml

---------

Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

2025-09-18 09:54:47 +01:00

..

collection_entra_auth_broker_sharepoint_access_for_user_principal.toml

Fix new term doc broken link (#4706)

2025-05-07 17:03:58 +05:30

collection_graph_email_access_by_unusual_public_client_via_graph.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

collection_update_event_hub_auth_rule.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_azure_entra_suspicious_signin.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

credential_access_azure_entra_totp_brute_force_attempts.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

credential_access_azure_full_network_packet_capture_detected.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_azure_key_vault_excessive_retrieval.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

credential_access_azure_key_vault_retrieval_from_rare_identity.toml

[Rule Tuning] Azure Key Vault Secret Key Usage by Unusual Identity (#4925)

2025-07-22 20:22:31 +05:30

credential_access_entra_id_brute_force_activity.toml

Fix updated_date for tunings as part of #5079 (#5081)

2025-09-10 22:05:36 +05:30

credential_access_entra_id_device_code_auth_with_broker_client.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

credential_access_entra_id_excessive_account_lockouts.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

credential_access_entra_signin_brute_force_microsoft_365.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

credential_access_first_time_seen_device_code_auth.toml

fixing double header in investigation notes (#4490)

2025-03-25 09:08:13 -04:00

credential_access_storage_account_key_regenerated.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_azure_application_credential_modification.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_azure_automation_runbook_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_azure_blob_permissions_modified.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_azure_diagnostic_settings_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_entra_id_oauth_user_impersonation_scope.toml

new rule Suspicious Entra ID OAuth User Impersonation Scope Detected (#4876)

2025-07-07 14:29:06 -04:00

defense_evasion_event_hub_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_firewall_policy_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_frontdoor_firewall_policy_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_kubernetes_events_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_network_watcher_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_suppression_rule_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_blob_container_access_mod.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

discovery_bloodhound_user_agents_detected.toml

new rule for bloodhound user agents (#4769)

2025-06-04 09:11:13 -04:00

discovery_teamfiltration_user_agents_detected.toml

[New Rule] TeamFiltration User-Agents Detected (#4868)

2025-07-08 09:56:06 -04:00

execution_command_virtual_machine.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_azure_key_vault_modified.toml

[Rule Tuning] Azure Key Vault Modified (#4896)

2025-07-17 09:31:58 -04:00

impact_kubernetes_pod_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_resource_group_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_azure_active_directory_powershell_signin.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_entra_graph_single_session_from_multiple_addresses.toml

[Rule Tuning] Microsoft Entra ID Suspicious Session Reuse to Graph Access (#4997)

2025-08-29 14:57:25 -04:00

initial_access_entra_id_high_risk_signin.toml

tuning 'Microsoft Entra ID High Risk Sign-in' (#4739)

2025-05-28 11:40:04 -04:00

initial_access_entra_id_protection_sign_in_risk_detected.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

initial_access_entra_id_protection_user_risk_detected.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

initial_access_entra_id_unusual_ropc_login_attempt.toml

[New Rule] Unusual ROPC Login Attempt by User Principal (#4871)

2025-07-03 14:43:19 -04:00

initial_access_entra_id_user_reported_risk.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

initial_access_entra_illicit_consent_grant_via_registered_application.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

initial_access_entra_oauth_phishing_via_vscode_client.toml

[New Rule] MSFT Tenant OAuth Phishing via First-Party VSCode Client (#4642)

2025-05-01 22:38:41 -04:00

initial_access_entra_protection_multi_azure_identity_protection_alerts.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

initial_access_entra_rare_app_id_for_principal_auth.toml

[New Rule] Adding Coverage for Azure Entra Rare App ID for Principal Authentication (#4524)

2025-03-11 11:05:56 -04:00

initial_access_entra_rare_authentication_requirement_for_principal_user.toml

[Rule Tuning] Adjusting Microsoft Entra ID Rare Authentication Requirement for Principal User (#4562)

2025-04-16 12:21:41 -04:00

initial_access_external_guest_user_invite.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_graph_first_occurrence_of_client_request.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

persistence_azure_automation_account_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_azure_automation_runbook_created_or_modified.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_azure_automation_webhook_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_azure_global_administrator_role_assigned.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_azure_pim_user_added_global_admin.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_azure_privileged_identity_management_role_modified.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_azure_service_principal_credentials_added.toml

[New Hunt] Commvault Supply Chain Threat (#4748)

2025-05-28 14:11:46 -04:00

persistence_entra_conditional_access_policy_modified.toml

tuning 'Azure Conditional Access Policy Modified' (#4558)

2025-03-27 15:43:46 -04:00

persistence_entra_id_mfa_disabled_for_user.toml

[Rule Tuning] Beats & Endgame Indices (#5072)

2025-09-09 13:19:13 -05:00

persistence_entra_id_oidc_discovery_url_change.toml

[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)

2025-08-05 19:35:41 -04:00

persistence_entra_id_rt_to_prt_transition_from_user_device.toml

[New Rule] Entra ID RT to PRT Transition from Same User and Device (#4845)

2025-06-25 14:52:50 -04:00

persistence_entra_id_suspicious_adrs_token_request.toml

[New Rule] Suspicious ADRS Token Request by Microsoft Auth Broker (#4801)

2025-06-18 14:41:04 -04:00

persistence_entra_id_suspicious_cloud_device_registration.toml

[New Rule] Microsoft Entra ID Suspicious Cloud Device Registration (#4802)

2025-07-02 10:03:08 -04:00

persistence_entra_id_user_signed_in_from_unusual_device.toml

[New Rule] Entra ID User Signed In from Unusual Device (#4804)

2025-06-18 14:13:42 -04:00

persistence_entra_service_principal_created.toml

[Rule Tuning] Excluding Microsoft Entra ID Service Principal Addition Invoked by MSFT Identity (#4700)

2025-05-06 11:19:50 -04:00

persistence_graph_eam_addition_or_modification.toml

[New Rule] External Authentication Method Addition or Modification in Entra ID (#4906)

2025-07-18 09:45:33 -04:00

persistence_identity_protect_alert_followed_by_device_reg.toml

[New] Microsoft Entra ID Protection Alert and Device Registration (#4688)

2025-09-18 09:54:47 +01:00

persistence_user_added_as_owner_for_azure_application.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_user_added_as_owner_for_azure_service_principal.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_azure_kubernetes_rolebinding_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

privilege_escalation_entra_id_elevate_to_user_administrator_access.toml

[New Rule] Microsoft Entra ID Elevated Access to User Access Administrator (#4742)

2025-05-28 13:33:22 -04:00