Every published rule

This rule detects the modification of the findings on SecurityHub.

This rule detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could enable an adversary access to Azure subscriptions in your environment.

This rule detects when a Keyvault Key is modified or deleted in Azure.

This rule detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

This rule detects when an user or application modified the federation settings on the domain.

This rule detects group membership additions of groups that have CA policy modification access

This rule detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

This rule detects a successful login to the Microsoft Intune Company Portal which could enable bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

This rule detects when users are authenticating without MFA being required.

This rule detects suggests the SAML token issuer for the linked SAML token is potentially compromised. The claims included in the token are unusual or match known adversary patterns

This rule detects when a application is deleted in Azure.

This rule detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

This rule detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

This rule detects when a Kubernetes account access a sensitive objects such as configmaps or secrets.

This rule detects when a key vault is modified or deleted.

This rule detects when a request has been made to transfer a Route 53 domain to another AWS account.

This rule detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

This rule detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.

This rule detects when the same privilege role has multiple activations by the same user.

This rule detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.