Samirbous f0012d8770 [New] Entra ID Microsoft Authentication Broker DRS Sign-In from Susp ASN (#6190) ...

* [New] Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN

Detects Microsoft Entra ID sign-in activity where the Microsoft Authentication Broker requests the Device Registration Service from a source autonomous system number (ASN) associated with VPN, residential proxy, or hosting egress commonly observed in OAuth phishing and adversary-in-the-middle device registration flows. This pattern can indicate device join or primary refresh token acquisition staged from attacker-controlled infrastructure after a user completes
authentication.

* Update persistence_entra_id_microsoft_auth_broker_drs_signin_from_suspicious_asn.toml

2026-06-05 17:35:26 -04:00

..

aws

[New Rule] AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (#6239)

2026-06-05 21:16:26 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296)

2025-11-11 07:37:40 +05:30

azure

[New] Entra ID Microsoft Authentication Broker DRS Sign-In from Susp ASN (#6190)

2026-06-05 17:35:26 -04:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)

2025-09-30 00:36:29 -04:00

beaconing

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

cloud_defend

[New/Tuning] Misc. Linux Web Server Rules (#6222)

2026-06-01 15:46:34 +00:00

cyberarkpas

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

ded

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

dga

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

endpoint

Prep 8.19/9.1 (#4869)

2025-07-07 11:27:48 -04:00

entityanalytics_entra_id

[New Rule] Entra ID / Entity Analytics ROADTools Default OS Build Fingerprint (#6193)

2026-05-29 14:10:16 +00:00

fim

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

gcp

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

github

Field not supported in integration (#6131)

2026-05-13 12:23:52 +00:00

google_workspace

[Rule Tuning] Forwarded Google Workspace Security Alert (#6166)

2026-06-01 13:30:15 +00:00

kubernetes

[Tuning] Diverse Recently Created Rules (#6191)

2026-06-01 10:10:37 +00:00

lmd

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

microsoft_exchange_online_message_trace

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

o365

[Rule Tuning] M365 Exchange Inbox Forwarding Rule Created (#6199)

2026-05-29 13:30:38 +00:00

okta

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:20:23 +00:00

pad

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

problemchild

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00