{"id":"T1078.004","name":"Cloud Accounts","url":"https://attack.mitre.org/techniques/T1078/004","tactics":["stealth","persistence","privilege-escalation","initial-access"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0546","stix_id":"x-mitre-detection-strategy--a1a9e316-145a-4744-a594-7decc23c543d","name":"Detection of Abused or Compromised Cloud Accounts for Access and Persistence","url":"https://attack.mitre.org/detectionstrategies/DET0546","analytics":[{"id":"AN1503","stix_id":"x-mitre-analytic--02571f27-8fa6-47cb-9097-0b84016a1dda","name":"Analytic 1503","description":"Detects anomalous authentication activity such as sign-ins from impossible geolocations or legacy protocols from high-privileged accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0546#AN1503","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"Sign-in activity","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"},{"name":"saas:okta","channel":"user.authentication.sso","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"saas-okta"}],"mutable_elements":[{"field":"AnomalousLocationThreshold","description":"Defines geographic separation (e.g., impossible travel) considered suspicious."},{"field":"ProtocolType","description":"Filter based on legacy or deprecated authentication mechanisms."}],"live":true,"detection_strategies":["DET0546"],"techniques":["T1078.004"]},{"id":"AN1504","stix_id":"x-mitre-analytic--fc507123-4267-4cf8-9e30-a90a89043b20","name":"Analytic 1504","description":"Detects cloud account use for API calls that exceed normal scope, such as IAM changes or access to services never used before.","url":"https://attack.mitre.org/detectionstrategies/DET0546#AN1504","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"ConsoleLogin, AssumeRole, ListAccessKeys, CreateUser","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"aws-cloudtrail"},{"name":"gcp:audit","channel":"admin.googleapis.com","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"gcp-audit"}],"mutable_elements":[{"field":"ServiceInteractionBaseline","description":"Custom list of expected service interactions per user or role."},{"field":"RoleSwitchRateThreshold","description":"Frequency of assume-role operations that triggers an alert."}],"live":true,"detection_strategies":["DET0546"],"techniques":["T1078.004"]},{"id":"AN1505","stix_id":"x-mitre-analytic--ac36f883-9a5b-4796-9f2e-18f1cce8fc0b","name":"Analytic 1505","description":"Detects unexpected access or usage of cloud productivity tools (e.g., downloading large numbers of files, creating external shares) by internal users.","url":"https://attack.mitre.org/detectionstrategies/DET0546#AN1505","platforms":["SaaS"],"log_source_references":[{"name":"m365:unified","channel":"FileAccessed, SharingSet","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"m365-unified"},{"name":"gcp:audit","channel":"drive.activity","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"gcp-audit"}],"mutable_elements":[{"field":"FileDownloadThreshold","description":"Defines excessive access based on number or size of downloads."},{"field":"SharingPolicyViolationThreshold","description":"Defines external sharing behaviors that violate policy."}],"live":true,"detection_strategies":["DET0546"],"techniques":["T1078.004"]},{"id":"AN1506","stix_id":"x-mitre-analytic--5f1ffd26-01f7-47fc-b544-130fc14c0bd2","name":"Analytic 1506","description":"Detects login and usage patterns deviating from typical Microsoft 365 or Google Workspace user profiles.","url":"https://attack.mitre.org/detectionstrategies/DET0546#AN1506","platforms":["Office Suite"],"log_source_references":[{"name":"m365:signinlogs","channel":"UserLogin","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"m365-signinlogs"},{"name":"gcp:audit","channel":"login.event","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"gcp-audit"}],"mutable_elements":[{"field":"BusinessHours","description":"Used to identify logins outside of expected work times."},{"field":"OfficeProductivityToolBaseline","description":"Defines expected application usage per department or role."}],"live":true,"detection_strategies":["DET0546"],"techniques":["T1078.004"]}],"live":true,"version":"1.0","techniques":["T1078.004"]}],"sigma_rules":[{"id":"0055ad1f-be85-4798-83cf-a6da17c993b3","title":"Application URI Configuration Changes","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"high","date":"2022-06-02","modified":null,"description":"Detects when a configuration change is made to an applications URI.\nURIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.\n","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.initial-access","attack.stealth","attack.t1528","attack.t1078.004","attack.persistence","attack.credential-access","attack.privilege-escalation"],"path":"rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml","techniques":["T1528","T1078.004"],"cves":[]},{"id":"039a7469-0296-4450-84c0-f6966b16dc6d","title":"PIM Approvals And Deny Elevation","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'","status":"test","level":"high","date":"2022-08-09","modified":null,"description":"Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml","techniques":["T1078.004"],"cves":[]},{"id":"09438caa-07b1-4870-8405-1dbafe3dad95","title":"Azure Subscription Permission Elevation Via ActivityLogs","author":"Austin Songer @austinsonger","status":"test","level":"high","date":"2021-11-26","modified":"2022-08-23","description":"Detects when a user has been elevated to manage all Azure Subscriptions.\nThis change should be investigated immediately if it isn't planned.\nThis setting could allow an attacker access to Azure subscriptions in your environment.\n","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml","techniques":["T1078.004"],"cves":[]},{"id":"0b4b72e3-4c53-4d5b-b198-2c58cfef39a9","title":"Guest User Invited By Non Approved Inviters","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'","status":"test","level":"medium","date":"2022-08-10","modified":null,"description":"Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_guest_invite_failure.yml","techniques":["T1078.004"],"cves":[]},{"id":"11c767ae-500b-423b-bae3-b234450736ed","title":"Users Added to Global or Device Admin Roles","author":"Michael Epping, '@mepples21'","status":"test","level":"high","date":"2022-06-28","modified":null,"description":"Monitor and alert for users added to device admin roles.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml","techniques":["T1078.004"],"cves":[]},{"id":"1b45b0d1-773f-4f23-aedc-814b759563b1","title":"Application AppID Uri Configuration Changes","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"high","date":"2022-06-02","modified":null,"description":"Detects when a configuration change is made to an applications AppID URI.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.initial-access","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.stealth","attack.t1552","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml","techniques":["T1552","T1078.004"],"cves":[]},{"id":"28870ae4-6a13-4616-bd1a-235a7fad7458","title":"Failed Authentications From Countries You Do Not Operate Out Of","author":"MikeDuddington, '@dudders1'","status":"test","level":"low","date":"2022-07-28","modified":null,"description":"Detect failed authentications from countries you do not operate out of.","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110"],"path":"rules-placeholder/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml","techniques":["T1078.004","T1110"],"cves":[]},{"id":"28eea407-28d7-4e42-b0be-575d5ba60b2c","title":"Azure AD Only Single Factor Authentication Required","author":"MikeDuddington, '@dudders1'","status":"test","level":"low","date":"2022-07-27","modified":null,"description":"Detect when users are authenticating without MFA being required.","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.defense-impairment","attack.t1078.004","attack.t1556.006"],"path":"rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml","techniques":["T1078.004","T1556.006"],"cves":[]},{"id":"2f575940-d85e-4ddc-af13-17dad6f1a0ef","title":"Github SSH Certificate Configuration Changed","author":"Romain Gaillard (@romain-gaillard)","status":"test","level":"medium","date":"2024-07-29","modified":null,"description":"Detects when changes are made to the SSH certificate configuration of the organization.","references":["https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities","https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority"],"logsource":{"product":"github","service":"audit"},"tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"path":"rules/application/github/audit/github_ssh_certificate_config_changed.yml","techniques":["T1078.004"],"cves":[]},{"id":"313e72de-0c0d-4d65-8c95-87f4d546eceb","title":"AWS Console Login Monitoring","author":"Ivan Saakov","status":"experimental","level":"medium","date":"2025-10-19","modified":null,"description":"Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization.\nThis alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.\n","references":["https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.004"],"path":"rules-placeholder/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_from_susp_locations.yml","techniques":["T1078.004"],"cves":[]},{"id":"340ee172-4b67-4fb4-832f-f961bdc1f3aa","title":"Password Reset By User Account","author":"YochanaHenderson, '@Yochana-H'","status":"test","level":"medium","date":"2022-08-03","modified":null,"description":"Detect when a user has reset their password in Azure AD","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.credential-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_user_password_change.yml","techniques":["T1078.004"],"cves":[]},{"id":"38360161-76c4-4283-842e-efcf997dafc8","title":"Suspicious Login Activity Classified By Google","author":"Tom Kluter","status":"experimental","level":"medium","date":"2026-04-28","modified":null,"description":"Detects Google Workspace login activity that's classified as suspicious by Google.","references":["https://cloud.google.com/logging/docs/audit/gsuite-audit-logging","https://cloud.google.com/logging/docs/audit/understanding-audit-logs","https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login","https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app","https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login"],"logsource":{"product":"gcp","service":"google_workspace.login"},"tags":["attack.initial-access","attack.privilege-escalation","attack.persistence","attack.stealth","attack.t1078.004"],"path":"rules/cloud/gcp/gworkspace/login/gcp_gworkspace_suspicious_login.yml","techniques":["T1078.004"],"cves":[]},{"id":"49a268a4-72f4-4e38-8a7b-885be690c5b5","title":"User Added To Privilege Role","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'","status":"test","level":"high","date":"2022-08-06","modified":null,"description":"Detects when a user is added to a privileged role.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml","techniques":["T1078.004"],"cves":[]},{"id":"4afac85c-224a-4dd7-b1af-8da40e1c60bd","title":"Account Disabled or Blocked for Sign in Attempts","author":"Yochana Henderson, '@Yochana-H'","status":"test","level":"medium","date":"2022-06-17","modified":null,"description":"Detects when an account is disabled or blocked for sign in but tried to log in","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml","techniques":["T1078.004"],"cves":[]},{"id":"4d136857-6a1a-432a-82fc-5dd497ee5e7c","title":"Sign-ins by Unknown Devices","author":"Michael Epping, '@mepples21'","status":"test","level":"low","date":"2022-06-28","modified":"2022-10-05","description":"Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml","techniques":["T1078.004"],"cves":[]},{"id":"4f77e1d7-3982-4ee0-8489-abf2d6b75284","title":"Sign-ins from Non-Compliant Devices","author":"Michael Epping, '@mepples21'","status":"test","level":"high","date":"2022-06-28","modified":null,"description":"Monitor and alert for sign-ins where the device was non-compliant.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml","techniques":["T1078.004"],"cves":[]},{"id":"53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc","title":"Potential MFA Bypass Using Legacy Client Authentication","author":"Harjot Singh, '@cyb3rjy0t'","status":"test","level":"high","date":"2023-03-20","modified":null,"description":"Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.","references":["https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022","https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110"],"path":"rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml","techniques":["T1078.004","T1110"],"cves":[]},{"id":"5496ff55-42ec-4369-81cb-00f417029e25","title":"Multifactor Authentication Interrupted","author":"AlertIQ","status":"test","level":"medium","date":"2021-10-10","modified":"2022-12-18","description":"Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110","attack.t1621"],"path":"rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml","techniques":["T1078.004","T1110","T1621"],"cves":[]},{"id":"5afa454e-030c-4ab4-9253-a90aa7fcc581","title":"Device Registration or Join Without MFA","author":"Michael Epping, '@mepples21'","status":"test","level":"medium","date":"2022-06-28","modified":null,"description":"Monitor and alert for device registration or join events where MFA was not performed.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml","techniques":["T1078.004"],"cves":[]},{"id":"5f521e4b-0105-4b72-845b-2198a54487b9","title":"Users Authenticating To Other Azure AD Tenants","author":"MikeDuddington, '@dudders1'","status":"test","level":"medium","date":"2022-06-30","modified":"2026-05-08","description":"Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules-placeholder/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml","techniques":["T1078.004"],"cves":[]},{"id":"60f6535a-760f-42a9-be3f-c9a0a025906e","title":"Use of Legacy Authentication Protocols","author":"Yochana Henderson, '@Yochana-H'","status":"test","level":"high","date":"2022-06-17","modified":null,"description":"Alert on when legacy authentication has been used on an account","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110"],"path":"rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml","techniques":["T1078.004","T1110"],"cves":[]},{"id":"70ed1d26-0050-4b38-a599-92c53d57d45a","title":"Bitbucket User Login Failure","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2024-02-25","modified":null,"description":"Detects user authentication failure events.\nPlease note that this rule can be noisy and it is recommended to use with correlation based on \"author.name\" field.\n","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110"],"path":"rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml","techniques":["T1078.004","T1110"],"cves":[]},{"id":"77caf516-34e5-4df9-b4db-20744fea0a60","title":"AWS Successful Console Login Without MFA","author":"Thuya@Hacktilizer, Ivan Saakov","status":"experimental","level":"medium","date":"2025-10-18","modified":"2025-10-21","description":"Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).\nThis alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.\n","references":["https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/","https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml","techniques":["T1078.004"],"cves":[]},{"id":"8ad1600d-e9dc-4251-b0ee-a65268f29add","title":"AWS Root Credentials","author":"vitaliy0x1","status":"test","level":"medium","date":"2020-01-21","modified":"2022-10-09","description":"Detects AWS root account usage","references":["https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_root_account_usage.yml","techniques":["T1078.004"],"cves":[]},{"id":"8c944ecb-6970-4541-8496-be554b8e2846","title":"Successful Authentications From Countries You Do Not Operate Out Of","author":"MikeDuddington, '@dudders1'","status":"test","level":"medium","date":"2022-07-28","modified":"2026-05-08","description":"Detect successful authentications from countries you do not operate out of.","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts","https://ishitasingh724.medium.com/cracking-kql-how-a-suspicious-login-alert-led-me-into-the-world-of-threat-hunting-and-the-10-kql-4ea6366ff0b3"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110"],"path":"rules-placeholder/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml","techniques":["T1078.004","T1110"],"cves":[]},{"id":"8dee7a0d-43fd-4b3c-8cd1-605e189d195e","title":"User State Changed From Guest To Member","author":"MikeDuddington, '@dudders1'","status":"test","level":"medium","date":"2022-06-30","modified":null,"description":"Detects the change of user type from \"Guest\" to \"Member\" for potential elevation of privilege.","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.persistence","attack.privilege-escalation","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_guest_to_member.yml","techniques":["T1078.004"],"cves":[]},{"id":"908655e0-25cf-4ae1-b775-1c8ce9cf43d8","title":"Login to Disabled Account","author":"AlertIQ","status":"test","level":"medium","date":"2021-10-10","modified":"2022-12-25","description":"Detect failed attempts to sign in to disabled accounts.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_login_to_disabled_account.yml","techniques":["T1078.004"],"cves":[]},{"id":"9a60e676-26ac-44c3-814b-0c2a8b977adf","title":"User Access Blocked by Azure Conditional Access","author":"AlertIQ","status":"test","level":"medium","date":"2021-10-10","modified":"2022-12-25","description":"Detect access has been blocked by Conditional Access policies.\nThe access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.\n","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.credential-access","attack.initial-access","attack.stealth","attack.t1110","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml","techniques":["T1110","T1078.004"],"cves":[]},{"id":"a0413867-daf3-43dd-9245-734b3a787942","title":"Bitlocker Key Retrieval","author":"Michael Epping, '@mepples21'","status":"test","level":"medium","date":"2022-06-28","modified":null,"description":"Monitor and alert for Bitlocker key retrieval.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml","techniques":["T1078.004"],"cves":[]},{"id":"a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9","title":"Okta New Admin Console Behaviours","author":"kelnage","status":"test","level":"high","date":"2023-09-07","modified":"2026-04-27","description":"Detects when Okta identifies new activity in the Admin Console.","references":["https://developer.okta.com/docs/reference/api/system-log/","https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/identity/okta/okta_new_behaviours_admin_console.yml","techniques":["T1078.004"],"cves":[]},{"id":"b4a6d707-9430-4f5f-af68-0337f52d5c42","title":"Sign-in Failure Due to Conditional Access Requirements Not Met","author":"Yochana Henderson, '@Yochana-H'","status":"test","level":"high","date":"2022-06-01","modified":null,"description":"Define a baseline threshold for failed sign-ins due to Conditional Access failures","references":["https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1110","attack.t1078.004"],"path":"rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml","techniques":["T1110","T1078.004"],"cves":[]},{"id":"ccd6a6c8-bb4e-4a91-9d2a-07e632819374","title":"AWS SAML Provider Deletion Activity","author":"Ivan Saakov","status":"experimental","level":"medium","date":"2024-12-19","modified":null,"description":"Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.\nAn attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.\n","references":["https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.stealth","attack.t1078.004","attack.privilege-escalation","attack.initial-access","attack.persistence","attack.t1531","attack.impact"],"path":"rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml","techniques":["T1078.004","T1531"],"cves":[]},{"id":"db014773-7375-4f4e-b83b-133337c0ffee","title":"AWS IAM S3Browser Templated S3 Bucket Policy Creation","author":"daniel.bohannon@permiso.io (@danielhbohannon)","status":"test","level":"high","date":"2023-05-17","modified":null,"description":"Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of \"<YOUR-BUCKET-NAME>\".","references":["https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.execution","attack.stealth","attack.t1059.009","attack.persistence","attack.initial-access","attack.privilege-escalation","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml","techniques":["T1059.009","T1078.004"],"cves":[]},{"id":"db014773-b1d3-46bd-ba26-133337c0ffee","title":"AWS IAM S3Browser LoginProfile Creation","author":"daniel.bohannon@permiso.io (@danielhbohannon)","status":"test","level":"high","date":"2023-05-17","modified":null,"description":"Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.","references":["https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.execution","attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1059.009","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml","techniques":["T1059.009","T1078.004"],"cves":[]},{"id":"db014773-d9d9-4792-91e5-133337c0ffee","title":"AWS IAM S3Browser User or AccessKey Creation","author":"daniel.bohannon@permiso.io (@danielhbohannon)","status":"test","level":"high","date":"2023-05-17","modified":null,"description":"Detects S3 Browser utility creating IAM User or AccessKey.","references":["https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.initial-access","attack.stealth","attack.t1059.009","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml","techniques":["T1059.009","T1078.004"],"cves":[]},{"id":"db6c06c4-bf3b-421c-aa88-15672b88c743","title":"Changes To PIM Settings","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'","status":"test","level":"high","date":"2022-08-09","modified":null,"description":"Detects when changes are made to PIM roles","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.initial-access","attack.privilege-escalation","attack.persistence","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_pim_change_settings.yml","techniques":["T1078.004"],"cves":[]},{"id":"e40f4962-b02b-4192-9bfe-245f7ece1f99","title":"Multifactor Authentication Denied","author":"AlertIQ","status":"test","level":"medium","date":"2022-03-24","modified":null,"description":"User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.","references":["https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110","attack.t1621"],"path":"rules/cloud/azure/signin_logs/azure_mfa_denies.yml","techniques":["T1078.004","T1110","T1621"],"cves":[]},{"id":"f7b5b004-dece-46e4-a4a5-f6fd0e1c6947","title":"Privileged Account Creation","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton","status":"test","level":"medium","date":"2022-08-11","modified":"2022-08-16","description":"Detects when a new admin is created.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml","techniques":["T1078.004"],"cves":[]},{"id":"f8ed0e8f-7438-4b79-85eb-f358ef2fbebd","title":"Github Self Hosted Runner Changes Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"low","date":"2023-01-27","modified":null,"description":"A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.\nThis rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,\nit should be validated from GitHub UI because the log entry may not provide full context.\n","references":["https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation"],"logsource":{"product":"github","service":"audit"},"tags":["attack.impact","attack.discovery","attack.collection","attack.persistence","attack.privilege-escalation","attack.initial-access","attack.stealth","attack.t1526","attack.t1213.003","attack.t1078.004"],"path":"rules/application/github/audit/github_self_hosted_runner_changes_detected.yml","techniques":["T1526","T1213.003","T1078.004"],"cves":[]},{"id":"f9405037-bc97-4eb7-baba-167dad399b83","title":"Github New Secret Created","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"low","date":"2023-01-20","modified":null,"description":"Detects when a user creates action secret for the organization, environment, codespaces or repository.","references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions"],"logsource":{"product":"github","service":"audit"},"tags":["attack.persistence","attack.privilege-escalation","attack.initial-access","attack.stealth","attack.t1078.004"],"path":"rules/application/github/audit/github_new_secret_created.yml","techniques":["T1078.004"],"cves":[]},{"id":"fa84aaf5-8142-43cd-9ec2-78cfebf878ce","title":"Temporary Access Pass Added To An Account","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'","status":"test","level":"high","date":"2022-08-10","modified":null,"description":"Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.004"],"path":"rules/cloud/azure/audit_logs/azure_tap_added.yml","techniques":["T1078.004"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-53704","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}