Michael Haag 442e815dad npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806) ...

* extra content

* 5 more extras

* Hunt 1

* story+extras

* Create linux_shai_hulud_2_exfiltration_artifacts.yml

* Create linux_shai_hulud_workflow_file_modification.yml

* Create linux_suspicious_github_workflow_file_modification.yml

* Create windows_github_workflow_file_creation_hunt.yml

* more

* last 3

* final pass

* Bump versions to resolve merge conflicts with develop branch

* Fix deprecated status for curl/wget bash execution detections

* Add npm Supply Chain Compromise story to file_download_or_read_to_pipe_execution (replacement for deprecated curl/wget bash detections)

* Fix version numbers to match previous build requirements

* Add all required Filesystem fields to windows_suspicious_github_workflow_file_modification search

* Update detections/endpoint/windows_curl_download_to_suspicious_path.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* small fixes

* apply updates

* more updates

* Update shai_hulud_2_exfiltration_artifact_files.yml

* Fix Windows path escaping - use single backslash in YAML block scalar

---------

Co-authored-by: Jose Enrique Hernandez <josehelps@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2025-11-25 14:56:20 -08:00

..

abnormally_high_number_of_cloud_infrastructure_api_calls.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

abnormally_high_number_of_cloud_instances_destroyed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

abnormally_high_number_of_cloud_instances_launched.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

abnormally_high_number_of_cloud_security_group_api_calls.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

amazon_eks_kubernetes_cluster_scan_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

amazon_eks_kubernetes_pod_scan_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_concurrent_sessions_from_different_ips.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

asl_aws_create_access_key.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

asl_aws_create_policy_version_to_allow_all_resources.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

asl_aws_credential_access_getpassworddata.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_credential_access_rds_password_reset.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

asl_aws_defense_evasion_delete_cloudtrail.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_defense_evasion_delete_cloudwatch_log_group.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_defense_evasion_impair_security_services.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_defense_evasion_putbucketlifecycle.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_defense_evasion_stop_logging_cloudtrail.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_defense_evasion_update_cloudtrail.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_disable_bucket_versioning.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_ec2_snapshot_shared_externally.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_ecr_container_upload_outside_business_hours.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_ecr_container_upload_unknown_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_iam_accessdenied_discovery_events.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_iam_assume_role_policy_brute_force.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

asl_aws_iam_delete_policy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_iam_failure_group_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_iam_successful_group_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_multi_factor_authentication_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_network_access_control_list_created_with_all_open_ports.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_network_access_control_list_deleted.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

asl_aws_new_mfa_method_registered_for_user.yml

update output fields

2025-06-10 20:07:40 +02:00

asl_aws_saml_update_identity_provider.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

asl_aws_updateloginprofile.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ami_attribute_modification_for_exfiltration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_bedrock_delete_guardrails.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_bedrock_delete_knowledge_base.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_bedrock_delete_model_invocation_logging_configuration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_bedrock_high_number_list_foundation_model_failures.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_bedrock_invoke_model_access_denied.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_concurrent_sessions_from_different_ips.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

aws_console_login_failed_during_mfa_challenge.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_create_policy_version_to_allow_all_resources.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_createaccesskey.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_createloginprofile.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_credential_access_failed_login.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_credential_access_getpassworddata.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_credential_access_rds_password_reset.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

aws_defense_evasion_delete_cloudtrail.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_defense_evasion_delete_cloudwatch_log_group.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_defense_evasion_impair_security_services.yml

updating SPL to match the issue fix after testing

2025-08-26 14:14:45 -07:00

aws_defense_evasion_putbucketlifecycle.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_defense_evasion_stop_logging_cloudtrail.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_defense_evasion_update_cloudtrail.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_detect_users_with_kms_keys_performing_encryption_s3.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_disable_bucket_versioning.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ec2_snapshot_shared_externally.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ecr_container_scanning_findings_high.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ecr_container_scanning_findings_low_informational_unknown.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ecr_container_scanning_findings_medium.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ecr_container_upload_outside_business_hours.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_ecr_container_upload_unknown_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_excessive_security_scanning.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_exfiltration_via_anomalous_getobject_api_activity.yml

Updated docs links in detections

2025-06-24 11:27:59 -05:00

aws_exfiltration_via_batch_service.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_exfiltration_via_bucket_replication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_exfiltration_via_datasync_task.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

aws_exfiltration_via_ec2_snapshot.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_high_number_of_failed_authentications_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_high_number_of_failed_authentications_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_iam_accessdenied_discovery_events.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_iam_assume_role_policy_brute_force.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_iam_delete_policy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_iam_failure_group_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_iam_successful_group_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_lambda_updatefunctioncode.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_multi_factor_authentication_disabled.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

aws_multiple_failed_mfa_requests_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_multiple_users_failing_to_authenticate_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_network_access_control_list_created_with_all_open_ports.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_network_access_control_list_deleted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_new_mfa_method_registered_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_password_policy_changes.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_s3_exfiltration_behavior_identified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_saml_update_identity_provider.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_setdefaultpolicyversion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_successful_console_authentication_from_multiple_ips.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_successful_single_factor_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_unusual_number_of_failed_authentications_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

aws_updateloginprofile.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_active_directory_high_risk_sign_in.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_admin_consent_bypassed_by_service_principal.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_application_administrator_role_assigned.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_authentication_failed_during_mfa_challenge.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_azurehound_useragent_detected.yml

Updated docs links in detections

2025-06-24 11:27:59 -05:00

azure_ad_block_user_consent_for_risky_apps_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_concurrent_sessions_from_different_ips.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_device_code_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_external_guest_user_invited.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_fullaccessasapp_permission_assigned.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_global_administrator_role_assigned.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_high_number_of_failed_authentications_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_high_number_of_failed_authentications_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_multi_factor_authentication_disabled.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_multi_source_failed_authentications_spike.yml

Update azure_ad_multi_source_failed_authentications_spike.yml

2025-09-29 14:45:01 -07:00

azure_ad_multiple_appids_and_useragents_authentication_spike.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_multiple_denied_mfa_requests_for_user.yml

aad multiple denied mfa requests: updating version and date

2025-07-31 20:42:11 -04:00

azure_ad_multiple_failed_mfa_requests_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_multiple_service_principals_created_by_sp.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_multiple_service_principals_created_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_new_custom_domain_added.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_new_federated_domain_added.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_new_mfa_method_registered_for_user.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_new_mfa_method_registered.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_oauth_application_consent_granted_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_pim_role_assigned.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_pim_role_assignment_activated.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_privileged_authentication_administrator_role_assigned.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_privileged_graph_api_permission_assigned.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_privileged_role_assigned_to_service_principal.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_privileged_role_assigned.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_service_principal_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_service_principal_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_service_principal_enumeration.yml

Version bumps

2025-06-24 12:43:01 -05:00

azure_ad_service_principal_new_client_credentials.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_service_principal_owner_added.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_service_principal_privilege_escalation.yml

Version bumps

2025-06-24 12:43:01 -05:00

azure_ad_successful_authentication_from_different_ips.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_successful_powershell_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_successful_single_factor_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_tenant_wide_admin_consent_granted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_unusual_number_of_failed_authentications_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_user_consent_blocked_for_risky_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_user_consent_denied_for_oauth_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

azure_ad_user_enabled_and_password_reset.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

azure_ad_user_immutableid_attribute_updated.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

azure_automation_account_created.yml

Correct Azure localization issues

2025-09-03 16:07:29 -05:00

azure_automation_runbook_created.yml

Correct Azure localization issues

2025-09-03 16:07:29 -05:00

azure_runbook_webhook_created.yml

Correct Azure localization issues

2025-09-03 16:07:29 -05:00

circle_ci_disable_security_job.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

circle_ci_disable_security_step.yml

more updates

2025-06-16 23:38:10 +02:00

cloud_api_calls_from_previously_unseen_user_roles.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

cloud_compute_instance_created_by_previously_unseen_user.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

cloud_compute_instance_created_in_previously_unused_region.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

cloud_compute_instance_created_with_previously_unseen_image.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

cloud_compute_instance_created_with_previously_unseen_instance_type.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

cloud_instance_modified_by_previously_unseen_user.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

cloud_provisioning_activity_from_previously_unseen_city.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cloud_provisioning_activity_from_previously_unseen_country.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cloud_provisioning_activity_from_previously_unseen_ip_address.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cloud_provisioning_activity_from_previously_unseen_region.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cloud_security_groups_modifications_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_aws_console_login_by_new_user.yml

add manual_test tag

2025-06-10 21:25:21 +02:00

detect_aws_console_login_by_user_from_new_city.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_aws_console_login_by_user_from_new_country.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_aws_console_login_by_user_from_new_region.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_gcp_storage_access_from_a_new_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_new_open_gcp_storage_buckets.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_new_open_s3_buckets_over_aws_cli.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_new_open_s3_buckets.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_s3_access_from_a_new_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_spike_in_aws_security_hub_alerts_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_spike_in_blocked_outbound_traffic_from_your_aws.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_spike_in_s3_bucket_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gcp_authentication_failed_during_mfa_challenge.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

gcp_detect_gcploit_framework.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gcp_kubernetes_cluster_pod_scan_detection.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

gcp_multi_factor_authentication_disabled.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

gcp_multiple_failed_mfa_requests_for_user.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

gcp_multiple_users_failing_to_authenticate_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gcp_successful_single_factor_authentication.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

gcp_unusual_number_of_failed_authentications_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gdrive_suspicious_file_sharing.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

geographic_improbable_location.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

github_enterprise_delete_branch_ruleset.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_enterprise_disable_2fa_requirement.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

github_enterprise_disable_audit_log_event_stream.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_enterprise_disable_classic_branch_protection_rule.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

github_enterprise_disable_dependabot.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

github_enterprise_disable_ip_allow_list.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

github_enterprise_modify_audit_log_event_stream.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_enterprise_pause_audit_log_event_stream.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_enterprise_register_self_hosted_runner.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_enterprise_remove_organization.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

github_enterprise_repository_archived.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_enterprise_repository_deleted.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_organizations_delete_branch_ruleset.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_organizations_disable_2fa_requirement.yml

Version bumps

2025-06-24 12:43:01 -05:00

github_organizations_disable_classic_branch_protection_rule.yml

Version bumps

2025-06-24 12:43:01 -05:00

github_organizations_disable_dependabot.yml

Version bumps

2025-06-24 12:43:01 -05:00

github_organizations_repository_archived.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

github_organizations_repository_deleted.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)

2025-11-25 14:56:20 -08:00

gsuite_drive_share_in_external_email.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

gsuite_email_suspicious_attachment.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gsuite_email_suspicious_subject_with_attachment.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gsuite_email_with_known_abuse_web_service_link.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gsuite_outbound_email_with_attachment_to_external_domain.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gsuite_suspicious_calendar_invite.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

gsuite_suspicious_shared_file_name.yml

Version bump

2025-06-17 09:14:07 -05:00

high_number_of_login_failures_from_a_single_source.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_abuse_of_secret_by_unusual_location.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_abuse_of_secret_by_unusual_user_agent.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_abuse_of_secret_by_unusual_user_group.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_abuse_of_secret_by_unusual_user_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_access_scanning.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_anomalous_inbound_network_activity_from_process.yml

Version bumps

2025-06-24 12:43:01 -05:00

kubernetes_anomalous_inbound_outbound_network_io.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_anomalous_outbound_network_activity_from_process.yml

Version bumps

2025-06-24 12:43:01 -05:00

kubernetes_anomalous_traffic_on_network_edge.yml

Version bumps

2025-06-24 12:43:01 -05:00

kubernetes_aws_detect_suspicious_kubectl_calls.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_create_or_update_privileged_pod.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_cron_job_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_daemonset_deployed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_falco_shell_spawned.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_newly_seen_tcp_edge.yml

Version bumps

2025-06-24 12:43:01 -05:00

kubernetes_newly_seen_udp_edge.yml

Version bumps

2025-06-24 12:43:01 -05:00

kubernetes_nginx_ingress_lfi.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_nginx_ingress_rfi.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_node_port_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_pod_created_in_default_namespace.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_pod_with_host_network_attachment.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_previously_unseen_container_image_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_previously_unseen_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_process_running_from_new_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_process_with_anomalous_resource_utilisation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_process_with_resource_ratio_anomalies.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_scanner_image_pulling.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_scanning_by_unauthenticated_ip_address.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_shell_running_on_worker_node_with_cpu_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_shell_running_on_worker_node.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_suspicious_image_pulling.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kubernetes_unauthorized_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

microsoft_intune_device_health_scripts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

microsoft_intune_devicemanagementconfigurationpolicies.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

microsoft_intune_manual_device_management.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

microsoft_intune_mobile_apps.yml

update to fix ci errors

2025-06-16 16:24:51 +02:00

o365_add_app_role_assignment_grant_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_added_service_principal.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_admin_consent_bypassed_by_service_principal.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_advanced_audit_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_application_available_to_other_tenants.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_application_registration_owner_added.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_applicationimpersonation_role_assigned.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_bec_email_hiding_rule_created.yml

update risk message

2025-07-24 09:00:34 +01:00

o365_block_user_consent_for_risky_apps_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_bypass_mfa_via_trusted_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_compliance_content_search_exported.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_compliance_content_search_started.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_concurrent_sessions_from_different_ips.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

o365_cross_tenant_access_change.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_disable_mfa.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_dlp_rule_triggered.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_elevated_mailbox_permission_assigned.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

o365_email_access_by_security_administrator.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_hard_delete_excessive_volume.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_new_inbox_rule_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_password_and_payroll_compromise_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_receive_and_hard_delete_takeover_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_reported_by_admin_found_malicious.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_reported_by_user_found_malicious.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_security_feature_changed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_send_and_hard_delete_exfiltration_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_send_and_hard_delete_suspicious_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_send_attachments_excessive_volume.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_suspicious_behavior_alert.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_suspicious_search_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_email_transport_rule_changed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_excessive_authentication_failures_alert.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_excessive_sso_logon_errors.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_exfiltration_via_file_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_exfiltration_via_file_download.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_exfiltration_via_file_sync_download.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_external_guest_user_invited.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_external_identity_policy_changed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_file_permissioned_application_consent_granted_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_fullaccessasapp_permission_assigned.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_high_number_of_failed_authentications_for_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_high_privilege_role_granted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_mail_permissioned_application_consent_granted_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_mailbox_email_forwarding_enabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_mailbox_folder_read_permission_assigned.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

o365_mailbox_folder_read_permission_granted.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

o365_mailbox_inbox_folder_shared_with_all_users.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_mailbox_read_access_granted_to_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multi_source_failed_authentications_spike.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multiple_appids_and_useragents_authentication_spike.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multiple_failed_mfa_requests_for_user.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

o365_multiple_mailboxes_accessed_via_api.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multiple_os_vendors_authenticating_from_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multiple_service_principals_created_by_sp.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multiple_service_principals_created_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_multiple_users_failing_to_authenticate_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_new_email_forwarding_rule_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_new_email_forwarding_rule_enabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_new_federated_domain_added.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_new_forwarding_mailflow_rule_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_new_mfa_method_registered.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_oauth_app_mailbox_access_via_ews.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_oauth_app_mailbox_access_via_graph_api.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_privileged_graph_api_permission_assigned.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_privileged_role_assigned_to_service_principal.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

o365_privileged_role_assigned.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

o365_pst_export_alert.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_safe_links_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_security_and_compliance_alert_triggered.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_service_principal_new_client_credentials.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_service_principal_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_sharepoint_allowed_domains_policy_changed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_sharepoint_malware_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_sharepoint_suspicious_search_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_tenant_wide_admin_consent_granted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_threat_intelligence_suspicious_email_delivered.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_threat_intelligence_suspicious_file_detected.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_user_consent_blocked_for_risky_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_user_consent_denied_for_oauth_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

o365_zap_activity_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

okta_non_standard_vpn_usage.yml

Initial remote employment fraud detections.

2025-06-12 14:43:59 -04:00

risk_rule_for_dev_sec_ops_by_repository.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00