Browse Rules

[CROWDSTRIKE] Impact Tactic Catchall

[CROWDSTRIKE] Impact Tactic Catchall

SSL Certificate Deletion

This rule detects the deletion of SSL certificates on a Linux system. Adversaries may delete SSL certificates to subvert trust controls and negatively impact the system.

GitHub PAT Access Revoked

Access to private GitHub organization resources was revoked for a PAT.

GitHub User Blocked From Organization

A GitHub user was blocked from access to an organization.

Memory Swap Modification

This rule detects memory swap modification events on Linux systems. Memory swap modification can be used to manipulate the system's memory and potentially impact the system's performance. This behavior is commonly observed in malware that deploys miner software such as XMRig.

Google Workspace Admin Role Deletion

Detects when a custom administrative role is deleted in Google Workspace. Adversaries may delete a custom admin role to disrupt delegated administration, remove security team access, or hinder incident response. Deleting a role removes the privileges it granted from all assigned users and groups, which can cause operational impact or blind spots during an active investigation.

Github Activity on a Private Repository from an Unusual IP

Detects when there is activity on a private GitHub repository from an unusual IP address. Adversaries may access private repositories from unfamiliar IPs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

Member Removed From GitHub Organization

A member was removed or their invitation to join was removed from a GitHub Organization.

Account Password Reset Remotely

Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials.

GitHub Private Repository Turned Public

Detects when a private GitHub repository is changed to public visibility. Adversaries may change repository visibility to public in order to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

GCP KMS Key Version Disabled or Destroyed

Detects when a KMS key version is disabled, scheduled for destruction, or destroyed. Disabling or destroying KMS key versions can be used to deny access to encrypted data—a ransomware tactic where attackers disable keys to prevent victims from accessing their data.

High Number of Closed Pull Requests by User

Detects a high number of closed pull requests by a single user within a short time frame. Adversaries may close multiple pull requests to disrupt development workflows or hide malicious changes.

Azure Kubernetes Services (AKS) Kubernetes Pods Deleted

Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kubernetes pod to disrupt the normal behavior of the environment.

Azure Compute Restore Point Collections Deleted

Identifies multiple Azure Restore Point Collections being deleted by a single user within a short time period. Restore Point Collections contain recovery points for virtual machines, enabling point-in-time recovery capabilities. Mass deletion of these collections is a common tactic used by adversaries during ransomware attacks to prevent victim recovery or to maximize impact during destructive operations. Multiple deletions in rapid succession may indicate malicious intent.

Deprecated - AWS RDS Instance/Cluster Stoppage

Identifies that an Amazon Relational Database Service (RDS) cluster or instance has been stopped.

Deprecated - M365 Security Compliance Unusual Volume of File Deletion

Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security.

Suspicious File Renamed via SMB

Identifies suspicious file rename operation by the virtual System process. This may indicate a remote ransomware attack via the SMB protocol.

AWS S3 Bucket Enumeration or Brute Force

Identifies a high number of failed S3 operations against a single bucket from a single source address within a short timeframe. This activity can indicate attempts to collect bucket objects or cause an increase in billing to an account via internal "AccessDenied" errors.

Google Workspace MFA Enforcement Disabled For Organization

Detects when an administrator disables multi-factor authentication enforcement or removes the ability for users to enroll in 2-step verification across a Google Workspace organization or organizational unit. Adversaries with administrative access may weaken tenant-wide authentication requirements to enable password-only sign-ins, facilitate credential abuse at scale, and reduce friction for follow-on account takeover across the domain.

Abnormally Large DNS Response

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

AWS EC2 EBS Snapshot Access Removed

Identifies the removal of access permissions from a shared AWS EC2 EBS snapshot. EBS snapshots are essential for data retention and disaster recovery. Adversaries may revoke or modify snapshot permissions to prevent legitimate users from accessing backups, thereby obstructing recovery efforts after data loss or destructive actions. This tactic can also be used to evade detection or maintain exclusive access to critical backups, ultimately increasing the impact of an attack and complicating incid

GCP Storage Bucket Deletion

Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in order to disrupt their target's business operations.

AWS RDS DB Instance or Cluster Deleted

Identifies the deletion of an Amazon RDS DB instance, Aurora cluster, or global database cluster. Deleting these resources permanently destroys stored data and can cause major service disruption. Adversaries with sufficient permissions may delete RDS resources to impede recovery, destroy evidence, or inflict operational impact on the environment.

M365 Purview Security Compliance Signal

Collects alerts generated by Microsoft Purview (formerly Office 365 Security & Compliance Center) through the SecurityComplianceCenter provider. These alerts represent policy violations, compliance issues, and threats detected by Microsoft Purview's built-in detection capabilities including DLP policy matches, eDiscovery actions, retention policy violations, and other compliance-related events. This building block rule generates security events for correlation, threat hunting, and telemetry coll

Attempt to Revoke Okta API Token

Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations.