security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
dev-v1.5.17
sigma-rules/rules/integrations/azure
T
History
Terrance DeJesus e8d74260f2 [Rule Tuning] Microsoft Entra ID Exccessive Account Lockouts (#5315) 
* [Rule Tuning] Microsoft Entra ID Exccessive Account Lockouts
Fixes #5314

* added min stack

* added index

* fixed query optimization

* fixed investigation guide

* added min-stack comments
2025-11-24 14:16:08 -05:00
..
collection_azure_storage_account_blob_public_access_enabled.toml
[New Rule] Azure Storage Account Blob Public Access Enabled (#5139)
2025-10-06 09:15:07 -04:00
collection_entra_auth_broker_sharepoint_access_for_user_principal.toml
Fix new term doc broken link (#4706)
2025-05-07 17:03:58 +05:30
collection_graph_email_access_by_unusual_public_client_via_graph.toml
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00
credential_access_azure_entra_suspicious_signin.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
credential_access_azure_entra_totp_brute_force_attempts.toml
[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)
2025-09-30 00:36:29 -04:00
credential_access_azure_full_network_packet_capture_detected.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
credential_access_azure_key_vault_excessive_retrieval.toml
[Rule Tuning] Excessive Secret or Key Retrieval from Azure Key Vault (#5220)
2025-10-14 12:53:02 -05:00
credential_access_azure_key_vault_retrieval_from_rare_identity.toml
[Rule Tuning] Azure Key Vault Secret Key Usage by Unusual Identity (#4925)
2025-07-22 20:22:31 +05:30
credential_access_azure_storage_account_keys_accessed.toml
[New Rule] Azure Storage Account Keys Accessed by Privileged User (#5141)
2025-09-29 12:20:31 -04:00
credential_access_entra_id_brute_force_activity.toml
[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)
2025-09-30 00:36:29 -04:00
credential_access_entra_id_excessive_account_lockouts.toml
[Rule Tuning] Microsoft Entra ID Exccessive Account Lockouts (#5315)
2025-11-24 14:16:08 -05:00
credential_access_entra_signin_brute_force_microsoft_365.toml
[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)
2025-09-30 00:36:29 -04:00
credential_access_storage_account_key_regenerated.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_azure_automation_runbook_deleted.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_azure_blob_permissions_modified.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_azure_diagnostic_settings_deletion.toml
[Rule Tuning] Azure Diagnostic Settings Deletion (#5253)
2025-11-13 13:49:44 -05:00
defense_evasion_event_hub_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_firewall_policy_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_frontdoor_firewall_policy_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_kubernetes_events_deleted.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_network_watcher_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_suppression_rule_created.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
discovery_blob_container_access_mod.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
discovery_bloodhound_user_agents_detected.toml
new rule for bloodhound user agents (#4769)
2025-06-04 09:11:13 -04:00
discovery_teamfiltration_user_agents_detected.toml
[New Rule] TeamFiltration User-Agents Detected (#4868)
2025-07-08 09:56:06 -04:00
execution_azure_automation_runbook_created_or_modified.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
execution_command_virtual_machine.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
exfiltration_azure_storage_blob_download_azcopy_sas_token.toml
[New Rule] Azure Storage Blob Retrieval via AzCopy (#5179)
2025-10-16 12:00:55 -04:00
impact_azure_compute_restore_point_collection_deleted.toml
[New Rule] Azure Compute Restore Point Collection Deleted (#5217)
2025-10-17 10:49:38 -04:00
impact_azure_compute_restore_point_collections_deleted.toml
[New Rule] Azure Compute Restore Point Collection Deleted (#5217)
2025-10-17 10:49:38 -04:00
impact_azure_compute_vm_snapshot_deletion.toml
[New Rule] Azure Compute Snapshot Deletion(s) (#5211)
2025-11-15 08:36:03 -05:00
impact_azure_compute_vm_snapshot_deletions.toml
[New Rule] Azure Compute Snapshot Deletion(s) (#5211)
2025-11-15 08:36:03 -05:00
impact_azure_key_vault_modified.toml
[Rule Tuning] Azure Key Vault Modified (#4896)
2025-07-17 09:31:58 -04:00
impact_azure_storage_account_deletion_multiple.toml
[New Rule] Azure Storage Account Deletion (#5200)
2025-10-17 10:26:00 -04:00
impact_azure_storage_account_deletion.toml
[New Rule] Azure Storage Account Deletion (#5200)
2025-10-17 10:26:00 -04:00
impact_kubernetes_pod_deleted.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
impact_resource_group_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_azure_active_directory_powershell_signin.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_entra_graph_single_session_from_multiple_addresses.toml
[Rule Tuning] Microsoft Entra ID Suspicious Session Reuse to Graph Access (#4997)
2025-08-29 14:57:25 -04:00
initial_access_entra_id_actor_token_user_impersonation_abuse.toml
[New Rule] Entra ID Actor Token User Impersonation Abuse (#5136)
2025-10-06 08:57:36 -04:00
initial_access_entra_id_device_code_auth_with_broker_client.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
initial_access_entra_id_high_risk_signin.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
initial_access_entra_id_oauth_user_impersonation_scope.toml
[Rule Tuning] Suspicious Entra ID OAuth User Impersonation Scope Detected (#5190)
2025-10-17 09:52:40 -04:00
initial_access_entra_id_protection_confirmed_compromise.toml
[New Rule] Entra ID Protection Admin Confirmed Compromise (#5186)
2025-10-16 14:29:28 -04:00
initial_access_entra_id_protection_sign_in_risk_detected.toml
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00
initial_access_entra_id_protection_user_risk_detected.toml
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00
initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
initial_access_entra_id_unusual_ropc_login_attempt.toml
[New Rule] Unusual ROPC Login Attempt by User Principal (#4871)
2025-07-03 14:43:19 -04:00
initial_access_entra_id_user_reported_risk.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
initial_access_entra_illicit_consent_grant_via_registered_application.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_entra_oauth_phishing_via_vscode_client.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_entra_protection_multi_azure_identity_protection_alerts.toml
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00
initial_access_entra_rare_app_id_for_principal_auth.toml
[Tuning] Azure Entra ID Rare App ID for Principal Authentication (#5184)
2025-10-06 08:49:31 -04:00
initial_access_entra_rare_authentication_requirement_for_principal_user.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
initial_access_external_guest_user_invite.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_first_time_seen_device_code_auth.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
initial_access_graph_first_occurrence_of_client_request.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
persistence_azure_application_credential_modification.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_azure_automation_account_created.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_azure_automation_webhook_created.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_azure_global_administrator_role_assigned.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_azure_pim_user_added_global_admin.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_azure_privileged_identity_management_role_modified.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_azure_service_principal_credentials_added.toml
[New Hunt] Commvault Supply Chain Threat (#4748)
2025-05-28 14:11:46 -04:00
persistence_entra_conditional_access_policy_modified.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_entra_id_mfa_disabled_for_user.toml
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00
persistence_entra_id_oidc_discovery_url_change.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_entra_id_rt_to_prt_transition_from_user_device.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
persistence_entra_id_suspicious_adrs_token_request.toml
[New Rule] Suspicious ADRS Token Request by Microsoft Auth Broker (#4801)
2025-06-18 14:41:04 -04:00
persistence_entra_id_suspicious_cloud_device_registration.toml
[New Rule] Microsoft Entra ID Suspicious Cloud Device Registration (#4802)
2025-07-02 10:03:08 -04:00
persistence_entra_id_user_signed_in_from_unusual_device.toml
[New Rule] Entra ID User Signed In from Unusual Device (#4804)
2025-06-18 14:13:42 -04:00
persistence_entra_service_principal_created.toml
[Rule Tuning] Excluding Microsoft Entra ID Service Principal Addition Invoked by MSFT Identity (#4700)
2025-05-06 11:19:50 -04:00
persistence_graph_eam_addition_or_modification.toml
[New Rule] External Authentication Method Addition or Modification in Entra ID (#4906)
2025-07-18 09:45:33 -04:00
persistence_identity_protect_alert_followed_by_device_reg.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_update_event_hub_auth_rule.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_user_added_as_owner_for_azure_application.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_user_added_as_owner_for_azure_service_principal.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
privilege_escalation_azure_kubernetes_rolebinding_created.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
privilege_escalation_azure_rbac_administrator_roles_assigned.toml
[New Rule] Azure RBAC Built-In Administrator Roles Assigned (#5113)
2025-10-06 09:38:56 -04:00
privilege_escalation_entra_id_elevate_to_user_administrator_access.toml
[Rule Tuning] Microsoft Entra ID Elevated Access to User Access Administrator (#5107)
2025-09-22 13:20:58 -04:00