SigmaHQ/rules/cloud/m365/microsoft365_activity_by_terminated_user.yml
Austin Songer c0e58d3c27 Update
2021-08-23 23:00:58 +00:00

24 lines
1004 B
YAML

title: Activity Performed by Terminated User
id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee
status: experimental
description: Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
author: Austin Songer @austinsonger
date: 2021/08/23
references:
- https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
- https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
logsource:
category: ThreatManagement
service: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: "Activity performed by terminated user"
status: success
condition: selection
falsepositives:
- Unknown
level: medium
tags:
- attack.impact