Rule Library

Sigma Rules

25 rules found for "Gloria Lee"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

Anomalous User Activity

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Azureriskdetection
TA0004 · Privilege EscalationT1098 · Account ManipulationTA0003 · Persistence
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Activity From Anonymous IP Address

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Anonymous IP Address

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Azureriskdetection
T1528 · Steal Application Access TokenTA0006 · Credential Access
Gloria LeeTue Aug 22cloud
Detectionhightest

Atypical Travel

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Impossible Travel

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Suspicious Inbox Forwarding Identity Protection

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Azureriskdetection
T1114.003 · Email Forwarding RuleTA0009 · Collection
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Suspicious Inbox Manipulation Rules

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Azureriskdetection
T1140 · Deobfuscate/Decode Files or InformationTA0005 · Defense Evasion
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Azure AD Account Credential Leaked

Indicates that the user's valid credentials have been leaked.

Azureriskdetection
T1589 · Gather Victim Identity InformationTA0043 · Reconnaissance
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Malicious IP Address Sign-In Failure Rate

Indicates sign-in from a malicious IP address based on high failure rates.

Azureriskdetection
T1090 · ProxyTA0011 · Command and Control
Mark Morowczynski+1Thu Sep 07cloud
Detectionhightest

Malicious IP Address Sign-In Suspicious

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Azureriskdetection
T1090 · ProxyTA0011 · Command and Control
Mark Morowczynski+1Thu Sep 07cloud
Detectionhightest

Sign-In From Malware Infected IP

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Azureriskdetection
T1090 · ProxyTA0011 · Command and Control
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

New Country

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Password Spray Activity

Indicates that a password spray attack has been successfully performed.

Azureriskdetection
T1110 · Brute ForceTA0006 · Credential Access
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Primary Refresh Token Access Attempt

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Azureriskdetection
T1528 · Steal Application Access TokenTA0006 · Credential Access
Mark Morowczynski+1Thu Sep 07cloud
Detectionhightest

Suspicious Browser Activity

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Azure AD Threat Intelligence

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Thu Sep 07cloud
Detectionhightest

SAML Token Issuer Anomaly

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Azureriskdetection
T1606 · Forge Web CredentialsTA0006 · Credential Access
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Unfamiliar Sign-In Properties

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Azureriskdetection
T1078 · Valid AccountsTA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege Escalation+1
Mark Morowczynski+1Sun Sep 03cloud
Detectionhightest

Stale Accounts In A Privileged Role

Identifies when an account hasn't signed in during the past n number of days.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud
Detectionhightest

Invalid PIM License

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud
Detectionhightest

Roles Assigned Outside PIM

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud
Detectionhightest

Roles Activated Too Frequently

Identifies when the same privilege role has multiple activations by the same user.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud
Detectionhightest

Roles Are Not Being Used

Identifies when a user has been assigned a privilege role and are not using that role.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud
Detectionhightest

Roles Activation Doesn't Require MFA

Identifies when a privilege role can be activated without performing mfa.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud
Detectionhightest

Too Many Global Admins

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Azurepim
TA0001 · Initial AccessTA0005 · Defense EvasionT1078 · Valid AccountsTA0003 · Persistence+1
Mark Morowczynski+1Thu Sep 14cloud