MITRE ATT&CK technique
Cloud Service Discovery detection rulesT1526
Cloud Service Discovery (T1526) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1526 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target azure, windows, github.
Discovery Using AzureHound
highDetects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.
azure
PUA - Seatbelt Execution
highDetects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
windows · process_creation
Github Self Hosted Runner Changes Detected
lowA self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.
github