Every published rule

This rule detects Bitlocker key retrieval.

This rule detects when a DNS Zone is modified or deleted in Google Cloud.

This rule detects when a VPN connection is modified or deleted.

This rule detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform a behavior that resembles an attempt to exfiltrate information from your organization.

This rule detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users to maintain or achieve access to the account. Also see in SIM Swap attacks.

This rule detects when highly privileged delegated permissions are granted on behalf of all users

This rule detects when storage bucket is modified or deleted in Google Cloud.

This rule detects when a user has reset their password in Azure AD

This rule detects when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

This rule detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

This rule detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

This rule detects when a service principal was removed in Azure.

This rule detects when a service principal is created in Azure.

This rule detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an adversary trying to avoid detection of its hostile activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this behavior is legitimate.

This rule detects when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content

This rule detects when multi-factor authentication (MFA) is disabled.

This rule detects suggests access attempt to the PRT resource that can be leveraged to move laterally into an organization or perform credential theft

This rule detects instances where an email, identified as hostile or anomalous by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

This rule detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

This rule detects when a privilege role assignment has taken place outside of PIM and may indicate an attack.