Terrance DeJesus 06319b7a13 [Rule Tuning] Add KEEP Command to all ES|QL Rules (#4146) ...

* updating ES|QL rules to include KEEP command

* fixed some ES|QL rules with typos; added validation for KEEP command

* fixed ES|QL errors from missing fields

* fixed flake errors

* updated date

* added best practices to hunt docs

2024-10-09 21:08:38 -04:00

..

collection_microsoft_365_new_inbox_rule.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

credential_access_microsoft_365_brute_force_user_account_attempt.toml

[Rule Tuning] Add KEEP Command to all ES|QL Rules (#4146)

2024-10-09 21:08:38 -04:00

credential_access_microsoft_365_potential_password_spraying_attack.toml

[Rule Tuning] M365/Azure Brute-Forcing New Rule and Tuning; Deprecate Similar Rule (#4057)

2024-09-10 11:26:40 -04:00

credential_access_user_excessive_sso_logon_errors.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

defense_evasion_microsoft_365_mailboxauditbypassassociation.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

exfiltration_microsoft_365_exchange_transport_rule_creation.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

exfiltration_microsoft_365_exchange_transport_rule_mod.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

exfiltration_microsoft_365_mass_download_by_a_single_user.toml

[Security Content] Tags Reform (#2725)

2023-06-22 18:38:56 -03:00

impact_microsoft_365_potential_ransomware_activity.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

impact_microsoft_365_unusual_volume_of_file_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_microsoft_365_abnormal_clientappid.toml

[Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId (#3685)

2024-07-05 05:46:40 +01:00

initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_microsoft_365_exchange_safelinks_disabled.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_microsoft_365_impossible_travel_activity.toml

[New Rule] New Microsoft 365 Impossible Travel Rules and Deprecation (#4054)

2024-09-05 17:36:56 -04:00

initial_access_microsoft_365_impossible_travel_portal_logins.toml

[Rule Tuning] Ignore "Not Available" in o365.audit.UserId for Microsoft 365 Rules (#4105)

2024-09-28 18:13:03 -04:00

initial_access_microsoft_365_portal_login_from_rare_location.toml

[Rule Tuning] Ignore "Not Available" in o365.audit.UserId for Microsoft 365 Rules (#4105)

2024-09-28 18:13:03 -04:00

initial_access_microsoft_365_user_restricted_from_sending_email.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

initial_access_o365_user_reported_phish_malware.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

lateral_movement_malware_uploaded_onedrive.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

lateral_movement_malware_uploaded_sharepoint.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_exchange_suspicious_mailbox_right_delegation.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_microsoft_365_exchange_dkim_signing_config_disabled.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_microsoft_365_exchange_management_role_assignment.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_microsoft_365_global_administrator_role_assign.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_microsoft_365_teams_custom_app_interaction_allowed.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_microsoft_365_teams_external_access_enabled.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

persistence_microsoft_365_teams_guest_access_enabled.toml

Back-porting Version Trimming (#3704)

2024-05-23 00:45:10 +05:30

privilege_escalation_new_or_modified_federation_domain.toml

Refresh MITRE Attack v15.1.0 (#3725)

2024-06-04 20:14:58 +05:30