Detects AWS root account usage

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Detects when a user tampers with S3 data management in Amazon Web Services.

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Identifies when a application credential is modified.

Identifies when a device in azure is no longer managed or compliant

Identifies when a owner is was removed from a application or service principal in Azure.

Identifies when a service principal is created in Azure.

Identifies when a service principal was removed in Azure.

Detects LSASS process access by pypykatz for credential dumping.

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Detects disabling security tools

Identifies when a DNS Zone is modified or deleted in Google Cloud.

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Identifies when the Secrets are Modified or Deleted.

Identifies when sensitive information is re-identified in google Cloud.

Identifies when a service account is disabled or deleted in Google Cloud.

Identifies when a service account is modified in Google Cloud.

Detects when storage bucket is enumerated in Google Cloud.

Detects when storage bucket is modified or deleted in Google Cloud.

Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

Detects when an an application is removed from Google Workspace.

Detects when an API access service account is granted domain authority.

Detects when an a role is modified or deleted in Google Workspace.

Detects when an a role privilege is deleted in Google Workspace.

Detects when an Google Workspace user is granted admin privileges.

Rule to detect the Hybrid Connection Manager service running on an endpoint.

Detects registry key used by Leviathan APT in Malaysian focused campaign

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

Detects registry keys created in OceanLotus (also known as APT32) attacks

Detects when a API Token is revoked.

Detects when an application is modified or deleted.

Detects when an application Sign-on Policy is modified or deleted.

Detects when an Network Zone is Deactivated or Deleted.

Detects when an Okta policy is modified or deleted.

Detects when an Policy Rule is Modified or Deleted.

Detects when an security threat is detected in Okta.

Detects when unauthorized access to app occurs.

Detects the modification of PortProxy registry key which is used for port forwarding. For command execution see rule win_netsh_port_fwd.yml.

Detects installation of a new shim using sdbinst.exe. A shim can be used to load malicious DLLs into applications.