admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updates

Browse Source
This commit is contained in:
mvelazco
2023-10-17 17:19:57 -04:00
parent 780357f302
commit 4bc6b96b62
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_applicationimpersonation_role_assigned.yml
+1 -1
View File
@@ -50,6 +50,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/application_impersonation_role_assigned/application_impersonation_role_assigned.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/application_impersonation_role_assigned.log
source: O365
sourcetype: o365:management:activity
detections/cloud/o365_excessive_authentication_failures_alert.yml
+1 -1
View File
@@ -22,7 +22,7 @@ references:
- https://attack.mitre.org/techniques/T1110/
tags:
analytic_story:
- Office 365 Detections
- O365 Identity Compromise Techniques
asset_type: Office 365
confidence: 80
impact: 80
detections/cloud/o365_excessive_sso_logon_errors.yml
+1 -1
View File
@@ -17,7 +17,7 @@ references:
- https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
tags:
analytic_story:
- Office 365 Detections
- O365 Identity Compromise Techniques
- Cloud Federated Credential Abuse
asset_type: Office 365
confidence: 80
detections/cloud/o365_suspicious_user_email_forwarding.yml
+1 -1
View File
@@ -19,7 +19,7 @@ known_false_positives: unknown
references: []
tags:
analytic_story:
- Office 365 Detections
- O365 Compromised Identity Abuse
- Data Exfiltration
asset_type: Office 365
confidence: 60