security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f02325fe2f355845e92dbcebb0d3bb4acb0eb9db
sigma-rules/rules/integrations/azure
T
History
Jonhnathan 8a9b52f7e1 Update impact_azure_service_principal_credentials_added.toml (#1802)
2022-03-02 05:36:21 -03:00
..
collection_update_event_hub_auth_rule.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
credential_access_azure_full_network_packet_capture_detected.toml
[New Rule] Azure Full Network Packet Capture Detected (#1420)
2021-10-15 23:06:27 -03:00
credential_access_key_vault_modified.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
credential_access_storage_account_key_regenerated.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_azure_application_credential_modification.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_azure_blob_permissions_modified.toml
[New Rule] Azure Blob Permissions Modification (#1499)
2021-10-14 06:59:24 -03:00
defense_evasion_azure_diagnostic_settings_deletion.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_azure_service_principal_addition.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
defense_evasion_event_hub_deletion.toml
[Rule tuning] Update rules based on docs review (#1663)
2022-01-28 10:41:22 -09:00
defense_evasion_firewall_policy_deletion.toml
[Rule tuning] Update rules based on docs review (#1663)
2022-01-28 10:41:22 -09:00
defense_evasion_frontdoor_firewall_policy_deletion.toml
[Rule tuning] Update rules based on docs review (#1663)
2022-01-28 10:41:22 -09:00
defense_evasion_kubernetes_events_deleted.toml
[Security Content] Update rules based on docs review (#1803)
2022-03-01 21:39:30 -03:00
defense_evasion_network_watcher_deletion.toml
[Rule tuning] Update rules based on docs review (#1663)
2022-01-28 10:41:22 -09:00
defense_evasion_suppression_rule_created.toml
[Rule Tuning] Update rules based on docs review (#1778)
2022-02-16 07:42:06 -09:00
discovery_blob_container_access_mod.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
execution_command_virtual_machine.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
impact_azure_automation_runbook_deleted.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
impact_azure_service_principal_credentials_added.toml
Update impact_azure_service_principal_credentials_added.toml (#1802)
2022-03-02 05:36:21 -03:00
impact_kubernetes_pod_deleted.toml
[Rule tuning] Update rules based on docs review (#1663)
2022-01-28 10:41:22 -09:00
impact_resource_group_deletion.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
impact_virtual_network_device_modified.toml
[Rule tuning] Update rules based on docs review (#1663)
2022-01-28 10:41:22 -09:00
initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml
[New Rule] Azure Active Directory High Risk User AtRisk or Confirmed (#1579)
2021-11-17 19:38:12 -03:00
initial_access_azure_active_directory_high_risk_signin.toml
[Rule tuning] Azure Active Directory High Risk Sign-in (#1463)
2021-08-30 14:33:44 -08:00
initial_access_azure_active_directory_powershell_signin.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
initial_access_consent_grant_attack_via_azure_registered_application.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
initial_access_external_guest_user_invite.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_azure_automation_account_created.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_azure_automation_runbook_created_or_modified.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_azure_automation_webhook_created.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_azure_conditional_access_policy_modified.toml
Update persistence_azure_conditional_access_policy_modified.toml (#1788)
2022-02-22 15:26:28 -03:00
persistence_azure_global_administrator_role_assigned.toml
[Security Content] Update rules based on docs review (#1803)
2022-03-01 21:39:30 -03:00
persistence_azure_pim_user_added_global_admin.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_azure_privileged_identity_management_role_modified.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_mfa_disabled_for_azure_user.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_user_added_as_owner_for_azure_application.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
persistence_user_added_as_owner_for_azure_service_principal.toml
[Fleet] Track integrations in folder and metadata (#1372)
2021-07-21 15:24:56 -06:00
privilege_escalation_azure_kubernetes_rolebinding_created.toml
[New Rule] Azure Kubernetes Rolebindings Created (#1576)
2021-11-29 09:16:00 -03:00