security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
dev-v1.5.21
sigma-rules/rules/integrations/o365
T
History
Terrance DeJesus 61c9344677 [Rule Tuning] M365 OneDrive Excessive File Downloads with OAuth Token (#5365) 
* [Rule Tuning] M365 OneDrive Excessive File Downloads with OAuth Token
Fixes #5361

* adding keep operation

* updating non-ecs
2025-12-03 14:13:35 -05:00
..
collection_microsoft_365_excessive_mail_items_accessed.toml
[New Rule] Excessive Microsoft 365 Mailbox Items Accessed (#4825)
2025-06-26 12:51:11 -04:00
collection_microsoft_365_mailbox_access_by_unusual_client_app_id.toml
[Rule Tuning] Suspicious Microsoft 365 Mail Access by Unusual ClientAppId (#4806)
2025-06-24 14:20:33 -04:00
collection_microsoft_365_new_inbox_rule.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
collection_onedrive_excessive_file_downloads.toml
[Rule Tuning] M365 OneDrive Excessive File Downloads with OAuth Token (#5365)
2025-12-03 14:13:35 -05:00
credential_access_antra_id_device_reg_via_oauth_redirection.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
credential_access_microsoft_365_excessive_account_lockouts.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
credential_access_microsoft_365_potential_user_account_brute_force.toml
[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)
2025-08-05 19:35:41 -04:00
credential_access_user_excessive_sso_logon_errors.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_anti_phish_policy_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_anti_phish_rule_mod.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_dkim_signing_config_disabled.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_dlp_policy_removed.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_exchange_safelinks_disabled.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_mailboxauditbypassassociation.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_new_inbox_rule_delete_or_move.toml
[New Rule] Microsoft 365 Suspicious Inbox Rule to Delete or Move Emails (#4743)
2025-06-02 10:02:18 -04:00
defense_evasion_microsoft_365_susp_oauth2_authorization.toml
[Rule Tuning] Update Azure / M365 Mappings (#5153)
2025-09-30 12:58:25 -04:00
defense_evasion_microsoft_365_teams_custom_app_interaction_allowed.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
defense_evasion_microsoft_365_teams_external_access_enabled.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
exfiltration_microsoft_365_exchange_transport_rule_creation.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
exfiltration_microsoft_365_exchange_transport_rule_mod.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
impact_microsoft_365_potential_ransomware_activity.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
impact_microsoft_365_unusual_volume_of_file_deletion.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_defender_for_m365_threat_intelligence_signal.toml
Monthly Schema Updates (#5046)
2025-09-01 20:42:42 +05:30
initial_access_entra_id_portal_login_atypical_travel.toml
[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)
2025-11-04 11:29:25 -05:00
initial_access_entra_id_portal_login_impossible_travel.toml
[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)
2025-11-04 11:29:25 -05:00
initial_access_microsoft_365_entra_oauth_phishing_via_vscode_client.toml
[Rule Tuning] Beats & Endgame Indices (#5072)
2025-09-09 13:19:13 -05:00
initial_access_microsoft_365_illicit_consent_grant_via_registered_application.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_microsoft_365_user_restricted_from_sending_email.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
initial_access_o365_user_reported_phish_malware.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
lateral_movement_malware_uploaded_onedrive.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
lateral_movement_malware_uploaded_sharepoint.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_exchange_suspicious_mailbox_permission_delegation.toml
[Rule Tuning] Tuning Suspicious Mailbox Permission Delegation in Exchange Online (#4705)
2025-05-08 11:01:00 -04:00
persistence_microsoft_365_exchange_management_role_assignment.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
persistence_microsoft_365_global_administrator_role_assign.toml
[Rule Tuning] Microsoft 365 Global Administrator Role Assigned (#5293)
2025-11-11 13:13:07 -05:00
persistence_microsoft_365_teams_guest_access_enabled.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00
privilege_escalation_new_or_modified_federation_domain.toml
[Rule Tuning] Update Azure / M365 Index Patterns and Lookback Windows (#5155)
2025-09-30 15:51:50 -04:00