Every published rule

This rule detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

This rule detects failed attempts to sign in to disabled accounts.

This rule detects when an account is disabled or blocked for sign in but tried to log in

This rule detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

This rule detects user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

This rule detects the addition of a new Federated Domain.

This rule detects detection for when multi factor authentication has been disabled, which might indicate a hostile behavior to bypass authentication mechanisms.

This rule detects the anomalous use of GetSessionToken. Tokens could be created and used by adversaries to move laterally and escalate privileges.

This rule detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

This rule detects this detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

This rule detects when an ElastiCache security group has been created.

This rule detects when an a role is modified or deleted in Google Workspace.

This rule detects when a user is removed from a privileged role. Bulk changes should be investigated.

This rule detects AzureHound (A BloodHound data collector for Microsoft Azure) behavior via the default User-Agent that is used during its operation after successful authentication.

This rule detects suggests sign-in from a hostile IP address based on high failure rates.

This rule detects user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

This rule detects when System Manager successfully runs commands against an instance.

This rule detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

This rule detects conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

This rule detects risky authentication from a non AD registered device without MFA being required.