valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1885 from austinsonger/microsoft365_unusual_volume_of_file_deletion.yml

Browse Source 
microsoft365_unusual_volume_of_file_deletion.yml
This commit is contained in:
frack113 2021-08-20 17:20:43 +02:00 committed by GitHub
commit dbbb422a42
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
rules/cloud/m365/microsoft365_unusual_volume_of_file_deletion.yml Normal file
View File

@ -0,0 +1,24 @@
title: Microsoft 365 - Unusual Volume of File Deletion
id: 78a34b67-3c39-4886-8fb4-61c46dc18ecd
status: experimental
description: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
author: austinsonger
date: 2021/08/19
references:
- https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
- https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
logsource:
category: ThreatManagement
service: Microsoft365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: "Unusual volume of file deletion"
status: success
condition: selection
falsepositives:
-
level: medium
tags:
- attack.impact
- attack.t1485