Rule Library
Sigma Rules
3 rules found for "Corissa Koopmans"
3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest
CA Policy Removed by Non Approved Actor
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Azureauditlogs
TA0004 · Privilege EscalationTA0006 · Credential AccessTA0005 · Defense EvasionTA0003 · Persistence+2
Corissa KoopmansTue Jul 19cloud
Detectionmediumtest
CA Policy Updated by Non Approved Actor
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Azureauditlogs
TA0004 · Privilege EscalationTA0006 · Credential AccessTA0005 · Defense EvasionTA0003 · Persistence+2
Corissa KoopmansTue Jul 19cloud
Detectionmediumtest
New CA Policy by Non-approved Actor
Monitor and alert on conditional access changes.
Azureauditlogs
TA0004 · Privilege EscalationTA0005 · Defense EvasionT1548 · Abuse Elevation Control Mechanism
Corissa KoopmansMon Jul 18cloud