diff --git a/.gitignore b/.gitignore index ac7b1187a4..71b67df5bb 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ .DS_Store docs/html_docs /html_docs + +# development files +*launch.json* \ No newline at end of file diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc index a2764cb15b..3d929c12bd 100644 --- a/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc +++ b/docs/detections/prebuilt-rules/prebuilt-rules-changelog.asciidoc @@ -5,6 +5,9 @@ The following lists prebuilt rule updates per release. Only rules with significant modifications to their query or scope are listed. For detailed information about a rule's changes, see the rule's description page. +[float] +=== 8.6.0 + [float] === 8.5.0 diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc index 8c6744b91b..32302dc74d 100644 --- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc +++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc @@ -18,113 +18,113 @@ and their rule type is `machine_learning`. |<> |Indicates the update of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, by changing the configuration of a legit scheduled task. Some changes such as disabling or enabling a scheduled task are common and may may generate noise. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] |8.5.0 |1 -|<> |An adversary may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] [Credential Access] [has_guide] |7.9.0 |101 <> +|<> |An adversary may attempt to access the secrets in secrets manager to steal certificates, credentials, or other sensitive material |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] [Credential Access] [has_guide] |7.9.0 |102 <> -|<> |Identifies the creation of an AWS log trail that specifies the settings for delivery of log data. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] |7.9.0 |100 <> +|<> |Identifies the creation of an AWS log trail that specifies the settings for delivery of log data. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] |7.9.0 |101 <> -|<> |Identifies the deletion of an AWS log trail. An adversary may delete trails in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |101 <> +|<> |Identifies the deletion of an AWS log trail. An adversary may delete trails in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |102 <> -|<> |Identifies suspending the recording of AWS API calls and log file delivery for the specified trail. An adversary may suspend trails in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |101 <> +|<> |Identifies suspending the recording of AWS API calls and log file delivery for the specified trail. An adversary may suspend trails in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |102 <> -|<> |Identifies an update to an AWS log trail setting that specifies the delivery of log files. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |101 <> +|<> |Identifies an update to an AWS log trail setting that specifies the delivery of log files. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |102 <> -|<> |Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alarms in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [has_guide] |7.9.0 |101 <> +|<> |Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alarms in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [has_guide] |7.9.0 |102 <> -|<> |Identifies the deletion of a specified AWS CloudWatch log group. When a log group is deleted, all the archived log events associated with the log group are also permanently deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |101 <> +|<> |Identifies the deletion of a specified AWS CloudWatch log group. When a log group is deleted, all the archived log events associated with the log group are also permanently deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |102 <> -|<> |Identifies the deletion of an AWS CloudWatch log stream, which permanently deletes all associated archived log events with the stream. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Impact] [has_guide] |7.9.0 |101 <> +|<> |Identifies the deletion of an AWS CloudWatch log stream, which permanently deletes all associated archived log events with the stream. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Impact] [has_guide] |7.9.0 |102 <> -|<> |Identifies attempts to delete an AWS Config Service resource. An adversary may tamper with Config services in order to reduce visibility into the security posture of an account and / or its workload instances. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [has_guide] |7.9.0 |101 <> +|<> |Identifies attempts to delete an AWS Config Service resource. An adversary may tamper with Config services in order to reduce visibility into the security posture of an account and / or its workload instances. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [has_guide] |7.9.0 |102 <> -|<> |Identifies an AWS configuration change to stop recording a designated set of resources. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |100 <> +|<> |Identifies an AWS configuration change to stop recording a designated set of resources. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |101 <> -|<> |Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora database cluster, global database cluster, or database instance. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |100 <> +|<> |Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora database cluster, global database cluster, or database instance. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |101 <> -|<> |Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default in the current region. Disabling encryption by default does not change the encryption status of your existing volumes. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] |7.9.0 |100 <> +|<> |Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default in the current region. Disabling encryption by default does not change the encryption status of your existing volumes. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] |7.9.0 |101 <> -|<> |Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.14.0 |100 <> +|<> |Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.14.0 |101 <> -|<> |Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access control list (ACL) or an entry in a network ACL with a specified rule number. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |100 <> +|<> |Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access control list (ACL) or an entry in a network ACL with a specified rule number. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |101 <> -|<> |Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access control list (ACL) or one of its ingress/egress entries. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |100 <> +|<> |Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access control list (ACL) or one of its ingress/egress entries. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |101 <> -|<> |An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data from an EC2 fleet. If the permissions were modified, verify the snapshot was not shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Exfiltration] [has_guide] |7.9.0 |101 <> +|<> |An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data from an EC2 fleet. If the permissions were modified, verify the snapshot was not shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Exfiltration] [has_guide] |7.9.0 |102 <> -|<> |Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.14.0 |100 <> +|<> |Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) export may indicate an attempt to extract or exfiltrate information. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.14.0 |101 <> -|<> |Detects when an EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] |7.16.0 |100 <> +|<> |Detects when an EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Data Protection] |7.16.0 |101 <> -|<> |Identifies when an ElastiCache security group has been created. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |100 <> +|<> |Identifies when an ElastiCache security group has been created. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |101 <> -|<> |Identifies when an ElastiCache security group has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |100 <> +|<> |Identifies when an ElastiCache security group has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |101 <> -|<> |Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or a break in the flow with other AWS services. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.16.0 |100 <> +|<> |Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of visibility in applications or a break in the flow with other AWS services. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.16.0 |101 <> -|<> |Identifies the execution of commands and scripts via System Manager. Execution methods such as RunShellScript, RunPowerShellScript, and alike can be abused by an authenticated attacker to install a backdoor or to interact with a compromised instance via reverse-shell using system only commands. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Initial Access] [has_guide] |7.9.0 |101 <> +|<> |Identifies the execution of commands and scripts via System Manager. Execution methods such as RunShellScript, RunPowerShellScript, and alike can be abused by an authenticated attacker to install a backdoor or to interact with a compromised instance via reverse-shell using system only commands. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [Initial Access] [has_guide] |7.9.0 |102 <> -|<> |Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |100 <> +|<> |Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |101 <> -|<> |Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may attempt to modify the AssumeRolePolicy of a misconfigured role in order to gain the privileges of that role. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |101 <> +|<> |Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may attempt to modify the AssumeRolePolicy of a misconfigured role in order to gain the privileges of that role. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |102 <> -|<> |Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |101 <> +|<> |Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |102 <> -|<> |Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be deactivated before it can be deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [has_guide] |7.9.0 |101 <> +|<> |Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be deactivated before it can be deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] [has_guide] |7.9.0 |102 <> -|<> |Identifies the creation of a group in AWS Identity and Access Management (IAM). Groups specify permissions for multiple users. Any user in a group automatically has the permissions that are assigned to the group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |100 <> +|<> |Identifies the creation of a group in AWS Identity and Access Management (IAM). Groups specify permissions for multiple users. Any user in a group automatically has the permissions that are assigned to the group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |101 <> -|<> |Identifies the deletion of a specified AWS Identity and Access Management (IAM) resource group. Deleting a resource group does not delete resources that are members of the group; it only deletes the group structure. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |100 <> +|<> |Identifies the deletion of a specified AWS Identity and Access Management (IAM) resource group. Deleting a resource group does not delete resources that are members of the group; it only deletes the group structure. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |101 <> -|<> |Identifies AWS IAM password recovery requests. An adversary may attempt to gain unauthorized AWS access by abusing password recovery mechanisms. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |100 <> +|<> |Identifies AWS IAM password recovery requests. An adversary may attempt to gain unauthorized AWS access by abusing password recovery mechanisms. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |101 <> -|<> |Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM). |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Credential Access] [Persistence] [has_guide] |7.9.0 |101 <> +|<> |Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM). |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [Credential Access] [Persistence] [has_guide] |7.9.0 |102 <> -|<> |Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies a successful login to the AWS Management Console by the Root user. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |101 <> +|<> |Identifies a successful login to the AWS Management Console by the Root user. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |102 <> -|<> |Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora DB cluster or global database spread across multiple regions. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |100 <> +|<> |Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora DB cluster or global database spread across multiple regions. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |101 <> -|<> |Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Persistence] |7.14.0 |100 <> +|<> |Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Persistence] |7.14.0 |101 <> -|<> |Identifies that an Amazon Relational Database Service (RDS) cluster or instance has been stopped. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |100 <> +|<> |Identifies that an Amazon Relational Database Service (RDS) cluster or instance has been stopped. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |101 <> -|<> |Identifies the creation of an Amazon Relational Database Service (RDS) Security group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.14.0 |100 <> +|<> |Identifies the creation of an Amazon Relational Database Service (RDS) Security group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.14.0 |101 <> -|<> |Identifies the deletion of an Amazon Relational Database Service (RDS) Security group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.14.0 |100 <> +|<> |Identifies the deletion of an Amazon Relational Database Service (RDS) Security group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Monitoring] |7.14.0 |101 <> -|<> |Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Exfiltration] |7.16.0 |100 <> +|<> |Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Exfiltration] |7.16.0 |101 <> -|<> |Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data or evade detection after performing malicious activities. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Defense Evasion] |7.16.0 |100 <> +|<> |Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are sometimes shared by threat actors in order to exfiltrate bulk data or evade detection after performing malicious activities. If the permissions were modified, verify if the snapshot was shared with an unauthorized or unexpected AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Defense Evasion] |7.16.0 |101 <> -|<> |Identifies the creation of an Amazon Redshift cluster. Unexpected creation of this cluster by a non-administrative user may indicate a permission or role issue with current users. If unexpected, the resource may not properly be configured and could introduce security vulnerabilities. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Persistence] |8.3.0 |100 <> +|<> |Identifies the creation of an Amazon Redshift cluster. Unexpected creation of this cluster by a non-administrative user may indicate a permission or role issue with current users. If unexpected, the resource may not properly be configured and could introduce security vulnerabilities. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] [Persistence] |8.3.0 |101 <> -|<> |Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |101 <> +|<> |Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.9.0 |102 <> -|<> |Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.14.0 |100 <> +|<> |Identifies when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.14.0 |101 <> -|<> |Identifies when a request has been made to transfer a Route 53 domain to another AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.14.0 |100 <> +|<> |Identifies when a request has been made to transfer a Route 53 domain to another AWS account. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.14.0 |101 <> -|<> |Identifies when an AWS Route Table has been created. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] [Persistence] |7.16.0 |100 <> +|<> |Identifies when an AWS Route Table has been created. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] [Persistence] |7.16.0 |101 <> -|<> |Identifies when an AWS Route Table has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] [Persistence] |7.16.0 |100 <> +|<> |Identifies when an AWS Route Table has been modified or deleted. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] [Persistence] |7.16.0 |101 <> -|<> |Identifies when a Route53 private hosted zone has been associated with VPC. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |100 <> +|<> |Identifies when a Route53 private hosted zone has been associated with VPC. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |101 <> -|<> |Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |100 <> +|<> |Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.9.0 |101 <> -|<> |Identifies when SAML activity has occurred in AWS. An adversary could manipulate SAML to maintain access to the target. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |100 <> +|<> |Identifies when SAML activity has occurred in AWS. An adversary could manipulate SAML to maintain access to the target. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |101 <> -|<> |Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |100 <> +|<> |Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |101 <> -|<> |Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.15.0 |100 <> +|<> |Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.15.0 |101 <> -|<> |Identifies the use of AssumeRole. AssumeRole returns a set of temporary security credentials that can be used to access AWS resources. An adversary could use those credentials to move laterally and escalate privileges. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |100 <> +|<> |Identifies the use of AssumeRole. AssumeRole returns a set of temporary security credentials that can be used to access AWS resources. An adversary could use those credentials to move laterally and escalate privileges. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |101 <> -|<> |Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |101 <> +|<> |Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (EC2). An adversary may delete flow logs in an attempt to evade defenses. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Log Auditing] [has_guide] |7.9.0 |102 <> -|<> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) access control list. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |100 <> +|<> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) access control list. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |101 <> -|<> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule or rule group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |100 <> +|<> |Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule or rule group. |[Elastic] [Cloud] [AWS] [Continuous Monitoring] [SecOps] [Network Security] |7.9.0 |101 <> |<> |Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [BPFDoor] |8.3.0 |101 <> @@ -148,9 +148,9 @@ and their rule type is `machine_learning`. |<> |Identifies a modification on the dsHeuristics attribute on the bit that holds the configuration of groups excluded from the SDProp process. The SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, meaning that groups excluded will remain unchanged. Attackers can abuse this misconfiguration to maintain long-term access to privileged accounts in these groups. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [Active Directory] [has_guide] |8.2.0 |101 <> -|<> |Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |100 <> +|<> |Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |101 <> -|<> |Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment. |[Elastic] [Okta] [SecOps] [Monitoring] [Continuous Monitoring] |7.11.0 |100 <> +|<> |Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment. |[Elastic] [Okta] [SecOps] [Monitoring] [Continuous Monitoring] |7.11.0 |101 <> |<> |Detects writing executable files that will be automatically launched by Adobe on launch. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] [has_guide] |7.6.0 |101 <> @@ -172,29 +172,29 @@ and their rule type is `machine_learning`. |<> |Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges. |[Elastic] [Host] [macOS] [Threat Detection] [Execution] [Privilege Escalation] |7.12.0 |100 <> -|<> |Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |7.11.0 |100 <> +|<> |Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |7.11.0 |101 <> -|<> |Google Workspace administrators may be aware of malicious applications within the Google marketplace and block these applications for user security purposes. An adversary, with administrative privileges, may remove this application from the explicit block list to allow distribution of the application amongst users. This may also indicate the unauthorized use of an application that had been previously blocked before by a user with admin privileges. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Impair Defenses] |8.5.0 |1 +|<> |Google Workspace administrators may be aware of malicious applications within the Google marketplace and block these applications for user security purposes. An adversary, with administrative privileges, may remove this application from the explicit block list to allow distribution of the application amongst users. This may also indicate the unauthorized use of an application that had been previously blocked before by a user with admin privileges. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Impair Defenses] |8.5.0 |2 <> -|<> |Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |100 <> +|<> |Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |101 <> -|<> |Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |100 <> +|<> |Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |101 <> -|<> |Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.11.0 |100 <> +|<> |Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.11.0 |101 <> -|<> |Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion] |7.11.0 |100 <> +|<> |Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion] |7.11.0 |101 <> -|<> |Detects attempts to deactivate an Okta policy. An adversary may attempt to deactivate an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to deactivate an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.9.0 |100 <> +|<> |Detects attempts to deactivate an Okta policy. An adversary may attempt to deactivate an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to deactivate an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.9.0 |101 <> -|<> |Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion] |7.9.0 |100 <> +|<> |Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion] |7.9.0 |101 <> -|<> |Detects attempts to delete an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.11.0 |100 <> +|<> |Detects attempts to delete an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.11.0 |101 <> -|<> |Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion] |7.11.0 |100 <> +|<> |Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion] |7.11.0 |101 <> -|<> |Detects attempts to delete an Okta policy. An adversary may attempt to delete an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to delete an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.9.0 |100 <> +|<> |Detects attempts to delete an Okta policy. An adversary may attempt to delete an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to delete an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.9.0 |101 <> -|<> |Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.11.0 |100 <> +|<> |Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.11.0 |101 <> |<> |Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion] |7.12.0 |100 <> @@ -204,97 +204,97 @@ and their rule type is `machine_learning`. |<> |Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion] |7.12.0 |100 <> -|<> |Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.11.0 |100 <> +|<> |Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Impact] |7.11.0 |101 <> -|<> |Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion] |7.9.0 |100 <> +|<> |Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Network Security] [Defense Evasion] |7.9.0 |101 <> -|<> |Detects attempts to modify an Okta policy. An adversary may attempt to modify an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to modify an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.9.0 |100 <> +|<> |Detects attempts to modify an Okta policy. An adversary may attempt to modify an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to modify an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] [Defense Evasion] |7.9.0 |101 <> -|<> |Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion] |7.9.0 |100 <> +|<> |Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion] |7.9.0 |101 <> |<> |Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB. |[Elastic] [Host] [macOS] [Threat Detection] [Lateral Movement] |7.12.0 |100 <> |<> |Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion] |7.11.0 |100 <> -|<> |Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |100 <> +|<> |Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |101 <> -|<> |Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |100 <> +|<> |Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Monitoring] |7.9.0 |101 <> |<> |Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command. |[Elastic] [Host] [macOS] [Threat Detection] [Defense Evasion] |7.12.0 |100 <> -|<> |Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |100 <> +|<> |Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.9.0 |101 <> -|<> |Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> |<> |Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon. |[Elastic] [Host] [macOS] [Threat Detection] [Persistence] |7.12.0 |100 <> -|<> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |8.1.0 |100 <> +|<> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |8.1.0 |101 <> -|<> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.12.0 |101 <> +|<> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.12.0 |102 <> -|<> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |8.0.0 |101 <> +|<> |Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |8.0.0 |102 <> -|<> |Identifies a sign-in using the Azure Active Directory PowerShell module. PowerShell for Azure Active Directory allows for managing settings from the command line, which is intended for users who are members of an admin role. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.11.0 |101 <> +|<> |Identifies a sign-in using the Azure Active Directory PowerShell module. PowerShell for Azure Active Directory allows for managing settings from the command line, which is intended for users who are members of an admin role. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.11.0 |102 <> -|<> |Identifies the creation of suppression rules in Azure. Suppression rules are a mechanism used to suppress alerts previously identified as false positives or too noisy to be in production. This mechanism can be abused or mistakenly configured, resulting in defense evasions and loss of security visibility. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |8.0.0 |100 <> +|<> |Identifies the creation of suppression rules in Azure. Suppression rules are a mechanism used to suppress alerts previously identified as false positives or too noisy to be in production. This mechanism can be abused or mistakenly configured, resulting in defense evasions and loss of security visibility. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |8.0.0 |101 <> -|<> |Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |Identifies when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. An adversary may create an Automation account in order to maintain persistence in their target's environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. An adversary may create an Automation account in order to maintain persistence in their target's environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure Automation runbook to execute malicious code and maintain persistence in their target's environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |100 <> +|<> |Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure Automation runbook to execute malicious code and maintain persistence in their target's environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |101 <> -|<> |Identifies when an Azure Automation runbook is deleted. An adversary may delete an Azure Automation runbook in order to disrupt their target's automated business operations or to remove a malicious runbook for defense evasion. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |100 <> +|<> |Identifies when an Azure Automation runbook is deleted. An adversary may delete an Azure Automation runbook in order to disrupt their target's automated business operations or to remove a malicious runbook for defense evasion. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |101 <> -|<> |Identifies when an Azure Automation webhook is created. Azure Automation runbooks can be configured to execute via a webhook. A webhook uses a custom URL passed to Azure Automation along with a data payload specific to the runbook. An adversary may create a webhook in order to trigger a runbook that contains malicious code. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |100 <> +|<> |Identifies when an Azure Automation webhook is created. Azure Automation runbooks can be configured to execute via a webhook. A webhook uses a custom URL passed to Azure Automation along with a data payload specific to the runbook. An adversary may create a webhook in order to trigger a runbook that contains malicious code. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |101 <> -|<> |Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.10.0 |100 <> +|<> |Identifies changes to container access levels in Azure. Anonymous public read access to containers and blobs in Azure is a way to share data broadly, but can present a security risk if access to sensitive data is not managed judiciously. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.10.0 |101 <> -|<> |Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |100 <> +|<> |Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.16.0 |101 <> -|<> |Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machine Contributor role lets you manage virtual machines, but not access them, nor access the virtual network or storage account they’re connected to. However, commands can be run via PowerShell on the VM, which execute as System. Other roles, such as certain Administrator roles may be able to execute commands on a VM as well. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machine Contributor role lets you manage virtual machines, but not access them, nor access the virtual network or storage account they’re connected to. However, commands can be run via PowerShell on the VM, which execute as System. Other roles, such as certain Administrator roles may be able to execute commands on a VM as well. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies when an Azure Conditional Access policy is modified. Azure Conditional Access policies control access to resources via if-then statements. For example, if a user wants to access a resource, then they must complete an action such as using multi-factor authentication to access it. An adversary may modify a Conditional Access policy in order to weaken their target's security controls. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |100 <> +|<> |Identifies when an Azure Conditional Access policy is modified. Azure Conditional Access policies control access to resources via if-then statements. For example, if a user wants to access a resource, then they must complete an action such as using multi-factor authentication to access it. An adversary may modify a Conditional Access policy in order to weaken their target's security controls. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |101 <> -|<> |Identifies the deletion of diagnostic settings in Azure, which send platform logs and metrics to different destinations. An adversary may delete diagnostic settings in an attempt to evade defenses. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Monitoring] |7.10.0 |100 <> +|<> |Identifies the deletion of diagnostic settings in Azure, which send platform logs and metrics to different destinations. An adversary may delete diagnostic settings in an attempt to evade defenses. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Monitoring] |7.10.0 |101 <> -|<> |Identifies when an Event Hub Authorization Rule is created or updated in Azure. An authorization rule is associated with specific rights, and carries a pair of cryptographic keys. When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is created for the namespace. This has manage permissions for the entire namespace and it's recommended that you treat this rule like an administrative root account and don't use it in your application. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies when an Event Hub Authorization Rule is created or updated in Azure. An authorization rule is associated with specific rights, and carries a pair of cryptographic keys. When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is created for the namespace. This has manage permissions for the entire namespace and it's recommended that you treat this rule like an administrative root account and don't use it in your application. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies an Event Hub deletion in Azure. An Event Hub is an event processing service that ingests and processes large volumes of events and data. An adversary may delete an Event Hub in an attempt to evade detection. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies an Event Hub deletion in Azure. An Event Hub is an event processing service that ingests and processes large volumes of events and data. An adversary may delete an Event Hub in an attempt to evade detection. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account. Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users could potentially be overlooked indefinitely leading to a potential vulnerability. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account. Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users could potentially be overlooked indefinitely leading to a potential vulnerability. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies the deletion of a firewall policy in Azure. An adversary may delete a firewall policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] |7.10.0 |100 <> +|<> |Identifies the deletion of a firewall policy in Azure. An adversary may delete a firewall policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] |7.10.0 |101 <> -|<> |Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] |7.16.0 |100 <> +|<> |Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers to their objective. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] |7.16.0 |101 <> -|<> |Identifies potential full network packet capture in Azure. Packet Capture is an Azure Network Watcher feature that can be used to inspect network traffic. This feature can potentially be abused to read sensitive data from unencrypted internal traffic. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |100 <> +|<> |Identifies potential full network packet capture in Azure. Packet Capture is an Azure Network Watcher feature that can be used to inspect network traffic. This feature can potentially be abused to read sensitive data from unencrypted internal traffic. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Monitoring] |7.16.0 |101 <> -|<> |Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies modifications to a Key Vault in Azure. The Key Vault is a service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. Because this data is sensitive and business critical, access to key vaults should be secured to allow only authorized applications and users. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Data Protection] |7.10.0 |100 <> +|<> |Identifies modifications to a Key Vault in Azure. The Key Vault is a service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. Because this data is sensitive and business critical, access to key vaults should be secured to allow only authorized applications and users. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Data Protection] |7.10.0 |101 <> -|<> |Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes. Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.16.0 |100 <> +|<> |Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes. Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.16.0 |101 <> -|<> |Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kubernetes pod to disrupt the normal behavior of the environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |100 <> +|<> |Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kubernetes pod to disrupt the normal behavior of the environment. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Asset Visibility] |7.16.0 |101 <> -|<> |Identifies the creation of role binding or cluster role bindings. You can assign these roles to Kubernetes subjects (users, groups, or service accounts) with role bindings and cluster role bindings. An adversary who has permissions to create bindings and cluster-bindings in the cluster can create a binding to the cluster-admin ClusterRole or to other high privileges roles. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |8.0.0 |100 <> +|<> |Identifies the creation of role binding or cluster role bindings. You can assign these roles to Kubernetes subjects (users, groups, or service accounts) with role bindings and cluster role bindings. An adversary who has permissions to create bindings and cluster-bindings in the cluster can create a binding to the cluster-admin ClusterRole or to other high privileges roles. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |8.0.0 |101 <> -|<> |Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] |7.10.0 |100 <> +|<> |Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] |7.10.0 |101 <> -|<> |Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator. An adversary may add a user to a PIM role in order to maintain persistence in their target's environment or modify a PIM role to weaken their target's security controls. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.10.0 |101 <> +|<> |Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator. An adversary may add a user to a PIM role in order to maintain persistence in their target's environment or modify a PIM role to weaken their target's security controls. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.10.0 |102 <> -|<> |Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies when a new service principal is added in Azure. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.11.0 |101 <> +|<> |Identifies when a new service principal is added in Azure. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] [has_guide] |7.11.0 |102 <> -|<> |Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.14.0 |100 <> +|<> |Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.14.0 |101 <> -|<> |Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub, or virtual router. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] [Impact] |7.16.0 |100 <> +|<> |Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub, or virtual router. |[Elastic] [Cloud] [Azure] [Continuous Monitoring] [SecOps] [Network Security] [Impact] |7.16.0 |101 <> |<> |Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity. |[Elastic] [Host] [Linux] [Threat Detection] [Execution] [TripleCross] |8.4.0 |100 <> @@ -360,9 +360,9 @@ and their rule type is `machine_learning`. |<> |Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] [Threat Detection] [Privilege Escalation] |7.6.0 |100 <> -|<> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error level audit event. The event.code correlates to the CyberArk Vault Audit Action Code. |[Elastic] [cyberarkpas] [SecOps] [Log Auditing] [Threat Detection] [Privilege Escalation] |7.14.0 |100 <> +|<> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error level audit event. The event.code correlates to the CyberArk Vault Audit Action Code. |[Elastic] [cyberarkpas] [SecOps] [Log Auditing] [Threat Detection] [Privilege Escalation] |7.14.0 |101 <> -|<> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code. |[Elastic] [cyberarkpas] [SecOps] [Log Auditing] [Threat Detection] [Privilege Escalation] |7.14.0 |100 <> +|<> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code. |[Elastic] [cyberarkpas] [SecOps] [Log Auditing] [Threat Detection] [Privilege Escalation] |7.14.0 |101 <> |<> |A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data. |[Elastic] [Network] [Threat Detection] [ML] [Command and Control] |7.7.0 |100 <> @@ -384,7 +384,7 @@ and their rule type is `machine_learning`. |<> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [has_guide] |7.14.0 |101 <> -|<> |Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.11.0 |100 <> +|<> |Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.11.0 |101 <> |<> |Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement. |[Elastic] [Host] [macOS] [Threat Detection] [Credential Access] |7.12.0 |100 <> @@ -460,87 +460,87 @@ and their rule type is `machine_learning`. |<> |Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] |8.5.0 |1 -|<> |Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |100 <> +|<> |Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |101 <> -|<> |Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule in order to weaken their target's security controls. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |100 <> +|<> |Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule in order to weaken their target's security controls. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |101 <> -|<> |Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be modified to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may modify an existing firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |100 <> +|<> |Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be modified to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may modify an existing firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.10.0 |101 <> -|<> |Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies the creation or patching of potentially malicious role bindings. Users can use role bindings and cluster role bindings to assign roles to Kubernetes subjects (users, groups, or service accounts). |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |100 <> +|<> |Identifies the creation or patching of potentially malicious role bindings. Users can use role bindings and cluster role bindings to assign roles to Kubernetes subjects (users, groups, or service accounts). |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |101 <> -|<> |Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a log entry arrives, Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may delete a Logging sink to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a log entry arrives, Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may delete a Logging sink to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may update a Logging sink to exfiltrate logs to a different export destination. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may update a Logging sink to exfiltrate logs to a different export destination. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A topic is used to forward messages from publishers to subscribers. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A topic is used to forward messages from publishers to subscribers. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |100 <> +|<> |Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Log Auditing] |7.10.0 |101 <> -|<> |Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create a new service account to use during their operations in order to avoid using a standard user account and attempt to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create a new service account to use during their operations in order to avoid using a standard user account and attempt to evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions assigned to that account and evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions assigned to that account and evade detection. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when the configuration is modified for a storage bucket in Google Cloud Platform (GCP). An adversary may modify the configuration of a storage bucket in order to weaken the security controls of their target's environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion] |7.10.0 |100 <> +|<> |Identifies when the configuration is modified for a storage bucket in Google Cloud Platform (GCP). An adversary may modify the configuration of a storage bucket in order to weaken the security controls of their target's environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] [Defense Evasion] |7.10.0 |101 <> -|<> |Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Monitoring] |7.10.0 |100 <> +|<> |Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Monitoring] |7.10.0 |101 <> -|<> |Identifies when the Identity and Access Management (IAM) permissions are modified for a Google Cloud Platform (GCP) storage bucket. An adversary may modify the permissions on a storage bucket to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies when the Identity and Access Management (IAM) permissions are modified for a Google Cloud Platform (GCP) storage bucket. An adversary may modify the permissions on a storage bucket to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> -|<> |Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud Platform (GCP). A VPC network is a virtual version of a physical network within a GCP project. Each VPC network has its own subnets, routes, and firewall, as well as other elements. An adversary may delete a VPC network in order to disrupt their target's network and business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |100 <> +|<> |Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud Platform (GCP). A VPC network is a virtual version of a physical network within a GCP project. Each VPC network has its own subnets, routes, and firewall, as well as other elements. An adversary may delete a VPC network in order to disrupt their target's network and business operations. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |101 <> -|<> |Identifies when a virtual private cloud (VPC) route is created in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may create a route in order to impact the flow of network traffic in their target's cloud environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |100 <> +|<> |Identifies when a virtual private cloud (VPC) route is created in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may create a route in order to impact the flow of network traffic in their target's cloud environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |101 <> -|<> |Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may delete a route in order to impact the flow of network traffic in their target's cloud environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |100 <> +|<> |Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may delete a route in order to impact the flow of network traffic in their target's cloud environment. |[Elastic] [Cloud] [GCP] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |7.10.0 |101 <> -|<> |Drive and Docs is a Google Workspace service that allows users to leverage Google Drive and Google Docs. Access to files is based on inherited permissions from the child organizational unit the user belongs to which is scoped by administrators. Typically if a user is removed, their files can be transferred to another user by the administrator. This service can also be abused by adversaries to transfer files to an adversary account for potential exfiltration. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Collection] |8.5.0 |1 +|<> |Drive and Docs is a Google Workspace service that allows users to leverage Google Drive and Google Docs. Access to files is based on inherited permissions from the child organizational unit the user belongs to which is scoped by administrators. Typically if a user is removed, their files can be transferred to another user by the administrator. This service can also be abused by adversaries to transfer files to an adversary account for potential exfiltration. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Collection] |8.5.0 |2 <> -|<> |Google Workspace admins may setup 2-step verification (2SV) to add an extra layer of security to user accounts by asking users to verify their identity when they use login credentials. Admins have the ability to enforce 2SV from the admin console as well as the methods acceptable for verification and enrollment period. 2SV requires enablement on admin accounts prior to it being enabled for users within organization units. Adversaries may disable 2SV to lower the security requirements to access a valid account. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |8.5.0 |1 +|<> |Google Workspace admins may setup 2-step verification (2SV) to add an extra layer of security to user accounts by asking users to verify their identity when they use login credentials. Admins have the ability to enforce 2SV from the admin console as well as the methods acceptable for verification and enrollment period. 2SV requires enablement on admin accounts prior to it being enabled for users within organization units. Adversaries may disable 2SV to lower the security requirements to access a valid account. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |8.5.0 |2 <> -|<> |Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |Assigning the administrative role to a user will grant them access to the Google Admin console and grant them administrator privileges which allow them to access and manage various resources and applications. An adversary may create a new administrator account for persistence or apply the admin role to an existing user to carry out further intrusion efforts. Users with super-admin privileges can bypass single-sign on if enabled in Google Workspace. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.11.0 |101 <> +|<> |Assigning the administrative role to a user will grant them access to the Google Admin console and grant them administrator privileges which allow them to access and manage various resources and applications. An adversary may create a new administrator account for persistence or apply the admin role to an existing user to carry out further intrusion efforts. Users with super-admin privileges can bypass single-sign on if enabled in Google Workspace. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.11.0 |102 <> -|<> |Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Impact] |7.11.0 |100 <> +|<> |Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Impact] |7.11.0 |101 <> -|<> |Google Workspace administrators whom manage Windows devices and have Windows device management enabled may also enable BitLocker drive encryption to mitigate unauthorized data access on lost or stolen computers. Adversaries with valid account access may disable BitLocker to access sensitive data on an endpoint added to Google Workspace device management. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |8.5.0 |1 +|<> |Google Workspace administrators whom manage Windows devices and have Windows device management enabled may also enable BitLocker drive encryption to mitigate unauthorized data access on lost or stolen computers. Adversaries with valid account access may disable BitLocker to access sensitive data on an endpoint added to Google Workspace device management. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |8.5.0 |2 <> -|<> |Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |Detects when a custom Gmail route is added or modified in Google Workspace. Adversaries can add a custom e-mail route for outbound mail to route these e-mails to their own inbox of choice for data gathering. This allows adversaries to capture sensitive information from e-mail and potential attachments, such as invoices or payment documents. By default, all email from current Google Workspace users with accounts are routed through a domain's mail server for inbound and outbound mail. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Collection] |8.5.0 |1 +|<> |Detects when a custom Gmail route is added or modified in Google Workspace. Adversaries can add a custom e-mail route for outbound mail to route these e-mails to their own inbox of choice for data gathering. This allows adversaries to capture sensitive information from e-mail and potential attachments, such as invoices or payment documents. By default, all email from current Google Workspace users with accounts are routed through a domain's mail server for inbound and outbound mail. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Collection] |8.5.0 |2 <> -|<> |Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Impact] [has_guide] |7.11.0 |101 <> +|<> |Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Impact] [has_guide] |7.11.0 |102 <> -|<> |Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.11.0 |100 <> +|<> |Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.11.0 |101 <> -|<> |Detects when the Google Marketplace restrictions are changed to allow any application for users in Google Workspace. Malicious APKs created by adversaries may be uploaded to the Google marketplace but not installed on devices managed within Google Workspace. Administrators should set restrictions to not allow any application from the marketplace for security reasons. Adversaries may enable any app to be installed and executed on mobile devices within a Google Workspace environment prior to distributing the malicious APK to the end user. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |8.5.0 |1 +|<> |Detects when the Google Marketplace restrictions are changed to allow any application for users in Google Workspace. Malicious APKs created by adversaries may be uploaded to the Google marketplace but not installed on devices managed within Google Workspace. Administrators should set restrictions to not allow any application from the marketplace for security reasons. Adversaries may enable any app to be installed and executed on mobile devices within a Google Workspace environment prior to distributing the malicious APK to the end user. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Defense Evasion] |8.5.0 |2 <> -|<> |Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |User groups in Google Workspace are created to help manage users permissions and access to various resources and applications. The security label is only applied to a group when users within that group are expected to access sensitive data and/or resources so administrators add this label to easily manage security groups better. Adversaries with administrator access may modify a security group to allow external access from members outside the organization. This detection does not capture all modifications to security groups, but only those that could increase the risk associated with them. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |8.5.0 |1 +|<> |User groups in Google Workspace are created to help manage users permissions and access to various resources and applications. The security label is only applied to a group when users within that group are expected to access sensitive data and/or resources so administrators add this label to easily manage security groups better. Adversaries with administrator access may modify a security group to allow external access from members outside the organization. This detection does not capture all modifications to security groups, but only those that could increase the risk associated with them. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |8.5.0 |2 <> -|<> |Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |8.5.0 |1 +|<> |Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |8.5.0 |2 <> |<> |Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. |[Elastic] [Host] [Windows] [Threat Detection] [Privilege Escalation] [Active Directory] [has_guide] |8.0.0 |101 <> |<> |Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. |[Elastic] [Network] [Threat Detection] [Command and Control] [Host] |7.10.0 |100 <> -|<> |Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |100 <> +|<> |Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] |7.10.0 |101 <> |<> |This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period. |[Elastic] [Host] [Linux] [Threat Detection] [Impact] [has_guide] |8.4.0 |101 <> @@ -596,7 +596,7 @@ and their rule type is `machine_learning`. |<> |This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Initial Access] [Defense Evasion] |8.5.0 |1 -|<> |This rule detects when a service account makes an unauthorized request for resources from the API server. Service accounts follow a very predictable pattern of behavior. A service account should never send an unauthorized request to the API server. This behavior is likely an indicator of compromise or of a problem within the cluster. An adversary may have gained access to credentials/tokens and this could be an attempt to access or create resources to facilitate further movement or execution within the cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Discovery] |8.5.0 |1 +|<> |This rule detects when a service account makes an unauthorized request for resources from the API server. Service accounts follow a very predictable pattern of behavior. A service account should never send an unauthorized request to the API server. This behavior is likely an indicator of compromise or of a problem within the cluster. An adversary may have gained access to credentials/tokens and this could be an attempt to access or create resources to facilitate further movement or execution within the cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Discovery] |8.5.0 |2 <> |<> |This rule detects an attempt to create or modify a service as type NodePort. The NodePort service allows a user to externally expose a set of labeled pods to the internet. This creates an open port on every worker node in the cluster that has a pod for that service. When external traffic is received on that open port, it directs it to the specific pod through the service representing it. A malicious user can configure a service as type Nodeport in order to intercept traffic from other pods or nodes, bypassing firewalls and other network security measures configured for load balancers within a cluster. This creates a direct method of communication between the cluster and the outside world, which could be used for more malicious behavior and certainly widens the attack surface of your cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Persistence] |8.4.0 |100 <> @@ -610,7 +610,7 @@ and their rule type is `machine_learning`. |<> |This rule detects when a user creates a pod/container running in privileged mode. A highly privileged container has access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the privileged container to gain access to the underlying host. Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation] |8.4.0 |100 <> -|<> |This rule detects a request to attach a controller service account to an existing or new pod running in the kube-system namespace. By default, controllers running as part of the API Server utilize admin-equivalent service accounts hosted in the kube-system namespace. Controller service accounts aren't normally assigned to running pods and could indicate adversary behavior within the cluster. An attacker that can create or modify pods or pod controllers in the kube-system namespace, can assign one of these admin-equivalent service accounts to a pod and abuse their powerful token to escalate privileges and gain complete cluster control. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation] |8.5.0 |1 +|<> |This rule detects a request to attach a controller service account to an existing or new pod running in the kube-system namespace. By default, controllers running as part of the API Server utilize admin-equivalent service accounts hosted in the kube-system namespace. Controller service accounts aren't normally assigned to running pods and could indicate adversary behavior within the cluster. An attacker that can create or modify pods or pod controllers in the kube-system namespace, can assign one of these admin-equivalent service accounts to a pod and abuse their powerful token to escalate privileges and gain complete cluster control. |[Elastic] [Kubernetes] [Continuous Monitoring] [Execution] [Privilege Escalation] |8.5.0 |2 <> |<> |This rule detects when a service account or node attempts to enumerate their own permissions via the selfsubjectaccessreview or selfsubjectrulesreview APIs. This is highly unusual behavior for non-human identities like service accounts and nodes. An adversary may have gained access to credentials/tokens and this could be an attempt to determine what privileges they have to facilitate further movement or execution within the cluster. |[Elastic] [Kubernetes] [Continuous Monitoring] [Discovery] |8.4.0 |100 <> @@ -630,7 +630,7 @@ and their rule type is `machine_learning`. |<> |Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Elastic] [Host] [Windows] [Threat Detection] [Persistence] |7.6.0 |100 <> -|<> |Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.11.0 |100 <> +|<> |Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Elastic] [Cloud] [Google Workspace] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.11.0 |101 <> |<> |Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] [has_guide] |8.1.0 |101 <> @@ -640,43 +640,43 @@ and their rule type is `machine_learning`. |<> |Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Elastic] [Elastic Endgame] |7.6.0 |100 <> -|<> |Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Data Protection] [Persistence] |7.11.0 |100 <> +|<> |Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Data Protection] [Persistence] |7.11.0 |101 <> -|<> |Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365. An adversary may remove a DLP policy to evade existing DLP monitoring. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365. An adversary may remove a DLP policy to evade existing DLP monitoring. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |100 <> +|<> |Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |7.11.0 |101 <> -|<> |Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |8.1.0 |100 <> +|<> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Identity and Access] |8.1.0 |101 <> -|<> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.13.0 |100 <> +|<> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.13.0 |101 <> -|<> |Identifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |100 <> +|<> |Identifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |101 <> -|<> |Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |7.11.0 |100 <> +|<> |Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] [Persistence] |7.11.0 |101 <> -|<> |Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |100 <> +|<> |Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.11.0 |101 <> -|<> |Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |100 <> +|<> |Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |101 <> -|<> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |100 <> +|<> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Elastic] [Cloud] [Microsoft 365] [Continuous Monitoring] [SecOps] [Configuration Audit] |7.16.0 |101 <> |<> |An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. |[Elastic] [Host] [Windows] [Threat Detection] [Defense Evasion] |7.7.0 |101 <> @@ -718,7 +718,7 @@ and their rule type is `machine_learning`. |<> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Elastic] [Host] [Windows] [Threat Detection] [Credential Access] [has_guide] |7.12.0 |101 <> -|<> |Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.9.0 |100 <> +|<> |Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls. |[Elastic] [Identity] [Okta] [Continuous Monitoring] [SecOps] [Identity and Access] [Persistence] |7.9.0 |101 <> |<