mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 01:45:21 +00:00
24 lines
1004 B
YAML
24 lines
1004 B
YAML
title: Activity Performed by Terminated User
|
|
id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee
|
|
status: experimental
|
|
description: Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
|
|
author: Austin Songer @austinsonger
|
|
date: 2021/08/23
|
|
references:
|
|
- https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
|
|
- https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
|
|
logsource:
|
|
category: ThreatManagement
|
|
service: m365
|
|
detection:
|
|
selection:
|
|
eventSource: SecurityComplianceCenter
|
|
eventName: "Activity performed by terminated user"
|
|
status: success
|
|
condition: selection
|
|
falsepositives:
|
|
- Unknown
|
|
level: medium
|
|
tags:
|
|
- attack.impact
|