Every published rule

This rule detects when a new cloudshell is created inside of Azure portal.

This rule detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an adversary is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to enable machines in that VPC/Subnet to contact a C&C server.

This rule detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

This rule detects behavior when someone is changing passwords on behalf of other users. An adversary with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

This rule detects the change of database master password. It may be a part of data exfiltration.

This rule detects suggests anomalous behavior based on anomalous sign-in behavior across multiple tenants from different countries in the same browser

This rule detects conditional access changes.

This rule detects when a Point-to-site VPN is Modified or Deleted.

This rule detects when an Google Workspace user is granted admin privileges.

This rule detects anomalous rules that delete or move messages or folders are set on a user's inbox.

This rule detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

This rule detects this detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

This rule detects Google Workspace login behavior that's classified as anomalous by Google.

This rule detects user login with multifactor authentication failures, which might be an indication an adversary has the password for the account but can't pass the MFA challenge.

This rule detects disabling, deleting and updating of a Trail

This rule detects when a new admin is created.

This rule detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

This rule detects when an account was created and deleted in a short period of time.

This rule detects the addition of a new Federated Domain.

This rule detects an event where there are there are too many accounts assigned the Global Administrator role.