Every published rule

This rule detects sign-ins from new countries. The detection considers past behavior locations to determine new and infrequent locations.

This rule detects users added to device admin roles.

This rule detects when a service account is modified or deleted.

This rule detects when a configuration change is made to an applications AppID URI.

This rule detects when a owner is was removed from a application or service principal in Azure.

This rule detects the import of SSH key pairs into AWS EC2, which may indicate an adversary attempting to gain unauthorized access to instances. This behavior could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

This rule detects suggests that there are anomalous patterns of behavior like anomalous changes to the directory.

This rule detects when secrets are modified or deleted in Azure.

This rule detects AWS API key creation for a user by another user. Backdoored users can be leveraged to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

This rule detects when changes are made to PIM roles

This rule detects user Added to an Administrator's Azure AD Role

This rule detects when a user generates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially enable unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges linked with the Lambda service role that is attached to that function.

This rule detects access has been blocked by Conditional Access policies. The access policy does not enable token issuance which might be sights≈ of unauthorizeed login to valid accounts.

This rule detects suggests sign-in from a hostile IP address known to be hostile at time of sign-in.

This rule detects the deletion of Azure Kubernetes Pods.

This rule detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

This rule detects conditional access changes where non approved actor removed CA Policy.

This rule detects IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

This rule detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

This rule detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.