security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f02325fe2f355845e92dbcebb0d3bb4acb0eb9db
sigma-rules/rules/integrations/o365
T
History
Jonhnathan f050b0ce0c [Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created (#1939) 
* [Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created

* Update non-ecs-schema.json

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
2022-04-27 09:09:25 -03:00
..
collection_microsoft_365_new_inbox_rule.toml
[Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created (#1939)
2022-04-27 09:09:25 -03:00
credential_access_microsoft_365_brute_force_user_account_attempt.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
credential_access_microsoft_365_potential_password_spraying_attack.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
credential_access_user_excessive_sso_logon_errors.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
defense_evasion_microsoft_365_mailboxauditbypassassociation.toml
[Rule Tuning] Update rules based on docs review (#1778)
2022-02-16 07:42:06 -09:00
exfiltration_microsoft_365_exchange_transport_rule_creation.toml
[Security Content] Update rules based on docs review (#1803)
2022-03-01 21:39:30 -03:00
exfiltration_microsoft_365_exchange_transport_rule_mod.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
impact_microsoft_365_mass_download_by_a_single_user.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
impact_microsoft_365_potential_ransomware_activity.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
impact_microsoft_365_unusual_volume_of_file_deletion.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
initial_access_microsoft_365_exchange_anti_phish_policy_deletion.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
initial_access_microsoft_365_exchange_anti_phish_rule_mod.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
initial_access_microsoft_365_exchange_safelinks_disabled.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
initial_access_microsoft_365_impossible_travel_activity.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
initial_access_microsoft_365_user_restricted_from_sending_email.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
initial_access_o365_user_reported_phish_malware.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
lateral_movement_malware_uploaded_onedrive.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
lateral_movement_malware_uploaded_sharepoint.toml
[Security Content] Update rules based on docs review (#1803)
2022-03-01 21:39:30 -03:00
microsoft_365_exchange_dkim_signing_config_disabled.toml
[Security Content] Update rules based on docs review (#1803)
2022-03-01 21:39:30 -03:00
microsoft_365_teams_custom_app_interaction_allowed.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
persistence_exchange_suspicious_mailbox_right_delegation.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
persistence_microsoft_365_exchange_management_role_assignment.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
persistence_microsoft_365_global_administrator_role_assign.toml
[Security Content] Update rules based on docs review (#1803)
2022-03-01 21:39:30 -03:00
persistence_microsoft_365_teams_external_access_enabled.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
persistence_microsoft_365_teams_guest_access_enabled.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00
privilege_escalation_new_or_modified_federation_domain.toml
[Documentation] Fix O365 Integration name on Rules and Unit Test (#1684)
2022-02-09 19:03:30 -03:00