Every published rule

This rule detects when a service account is modified in Google Cloud.

This rule detects when an organization doesn't have the proper license for PIM and is out of compliance.

This rule detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could enable an adversary access to Azure subscriptions in your environment.

This rule detects number of VM creations or deployment activities occur in Azure via the azureactivity log.

This rule detects to authentication method could be an indicator of an adversary adding an auth method to the account so they can have continued access.

This rule detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

This rule detects when an API access service account is granted domain authority.

This rule detects when there is a interruption in the authentication process.

This rule detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

This rule detects when a user tampers with S3 data management in Amazon Web Services.

This rule detects when end user consent is blocked due to risk-based consent.

This rule detects when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, adversaries can intercept and modify the pod creation operations in the cluster and add their hostile container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

This rule detects when a Cloud SQL DB has been modified or deleted.

This rule detects when an EKS cluster is created or deleted.

This rule detects the creation or patching of potential hostile RoleBinding. This includes RoleBindings and ClusterRoleBinding.

This rule detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

This rule detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes seeking to evade detection.

This rule detects when a device or device configuration in azure is modified or deleted.

This rule detects when a application security group is modified or deleted.

This rule detects potential enumeration of AWS buckets via ListBuckets.