Anomalous User Activity

Rule Info

Name
Anomalous User Activity
Author
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Description
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Date
2023-09-03 00:00:00
Modified
None
Id
258b6593-215d-4a26-a141-c8e31c1299a6
Tags
attack.t1098 attack.persistence DEMO
Type
Community Rule

Rule History

Author
Title
Date
Commit
Ryan Plas
Merge PR #4893 from @ryanplasma - Update Microsoft references URLS
2024-07-02
github-actions[bot]
Merge PR #4891 from @nasbench - Promote older rules status from `experimental` to `test`
2024-07-01
Mark Morowczynski
Merge PR #4423 from @MarkMorow - Add Azure AD Identity Protection Rules
2023-09-06
frack113
Change field name in detection
2023-08-10
Nasreddine Bencherchali
chore: change service name to lowercase
2023-08-08
frack113
Fix to pass the tests
2023-08-08
Mark Morowczynski
Update azure_identity_protectection_anomalous_token.yml
2023-08-07
Mark Morowczynski
Create azure_identity_protectection_anomalous_token.yml
2023-08-07