1200KM / tag
azure — logsource-product tag
114 related reference pages for logsource-product: azure.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Account Created And Deleted Within A Close Time Frame · sigma-rule
- Account Disabled or Blocked for Sign in Attempts · sigma-rule
- Account Lockout · sigma-rule
- Activity From Anonymous IP Address · sigma-rule
- Added Credentials to Existing Application · sigma-rule
- Added Owner To Application · sigma-rule
- Anomalous Token · sigma-rule
- Anomalous User Activity · sigma-rule
- Anonymous IP Address · sigma-rule
- App Assigned To Azure RBAC/Microsoft Entra Role · sigma-rule
- App Granted Microsoft Permissions · sigma-rule
- App Granted Privileged Delegated Or App Permissions · sigma-rule
- Application AppID Uri Configuration Changes · sigma-rule
- Application URI Configuration Changes · sigma-rule
- Application Using Device Code Authentication Flow · sigma-rule
- Applications That Are Using ROPC Authentication Flow · sigma-rule
- Atypical Travel · sigma-rule
- Authentications To Important Apps Using Single Factor Authentication · sigma-rule
- Azure Active Directory Hybrid Health AD FS New Server · sigma-rule
- Azure Active Directory Hybrid Health AD FS Service Delete · sigma-rule
- Azure AD Account Credential Leaked · sigma-rule
- Azure AD Only Single Factor Authentication Required · sigma-rule
- Azure AD Threat Intelligence · sigma-rule
- Azure Application Deleted · sigma-rule
- Azure Container Registry Created or Deleted · sigma-rule
- Azure Device or Configuration Modified or Deleted · sigma-rule
- Azure DNS Zone Modified or Deleted · sigma-rule
- Azure Domain Federation Settings Modified · sigma-rule
- Azure Firewall Modified or Deleted · sigma-rule
- Azure Firewall Rule Collection Modified or Deleted · sigma-rule
- Azure Key Vault Modified or Deleted · sigma-rule
- Azure Keyvault Key Modified or Deleted · sigma-rule
- Azure Keyvault Secrets Modified or Deleted · sigma-rule
- Azure Kubernetes Admission Controller · sigma-rule
- Azure Kubernetes Cluster Created or Deleted · sigma-rule
- Azure Kubernetes CronJob · sigma-rule
- Azure Kubernetes Events Deleted · sigma-rule
- Azure Kubernetes Network Policy Change · sigma-rule
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted · sigma-rule
- Azure Kubernetes Secret or Config Object Access · sigma-rule
- Azure Kubernetes Sensitive Role Access · sigma-rule
- Azure Kubernetes Service Account Modified or Deleted · sigma-rule
- Azure Network Firewall Policy Modified or Deleted · sigma-rule
- Azure New CloudShell Created · sigma-rule
- Azure Subscription Permission Elevation Via ActivityLogs · sigma-rule
- Azure Subscription Permission Elevation Via AuditLogs · sigma-rule
- Azure Unusual Authentication Interruption · sigma-rule
- Bitlocker Key Retrieval · sigma-rule
- Bulk Deletion Changes To Privileged Account Permissions · sigma-rule
- CA Policy Removed by Non Approved Actor · sigma-rule
- CA Policy Updated by Non Approved Actor · sigma-rule
- Certificate-Based Authentication Enabled · sigma-rule
- Change to Authentication Method · sigma-rule
- Changes to Device Registration Policy · sigma-rule
- Changes To PIM Settings · sigma-rule
- Delegated Permissions Granted For All Users · sigma-rule
- Device Registration or Join Without MFA · sigma-rule
- Disabled MFA to Bypass Authentication Mechanisms · sigma-rule
- Discovery Using AzureHound · sigma-rule
- End User Consent · sigma-rule
- End User Consent Blocked · sigma-rule
- Failed Authentications From Countries You Do Not Operate Out Of · sigma-rule
- Granting Of Permissions To An Account · sigma-rule
- Guest User Invited By Non Approved Inviters · sigma-rule
- Guest Users Invited To Tenant By Non Approved Inviters · sigma-rule
- Impossible Travel · sigma-rule
- Increased Failed Authentications Of Any Type · sigma-rule
- Invalid PIM License · sigma-rule
- Login to Disabled Account · sigma-rule
- Malicious IP Address Sign-In Failure Rate · sigma-rule
- Malicious IP Address Sign-In Suspicious · sigma-rule
- Measurable Increase Of Successful Authentications · sigma-rule
- Multifactor Authentication Denied · sigma-rule
- Multifactor Authentication Interrupted · sigma-rule
- New CA Policy by Non-approved Actor · sigma-rule
- New Country · sigma-rule
- New Root Certificate Authority Added · sigma-rule
- Number Of Resource Creation Or Deployment Activities · sigma-rule
- Password Reset By User Account · sigma-rule
- Password Spray Activity · sigma-rule
- PIM Alert Setting Changes To Disabled · sigma-rule
- PIM Approvals And Deny Elevation · sigma-rule
- Potential MFA Bypass Using Legacy Client Authentication · sigma-rule
- Primary Refresh Token Access Attempt · sigma-rule
- Privileged Account Creation · sigma-rule
- Rare Subscription-level Operations In Azure · sigma-rule
- Roles Activated Too Frequently · sigma-rule
- Roles Activation Doesn't Require MFA · sigma-rule
- Roles Are Not Being Used · sigma-rule
- Roles Assigned Outside PIM · sigma-rule
- SAML Token Issuer Anomaly · sigma-rule
- Sign-in Failure Due to Conditional Access Requirements Not Met · sigma-rule
- Sign-In From Malware Infected IP · sigma-rule
- Sign-ins by Unknown Devices · sigma-rule
- Sign-ins from Non-Compliant Devices · sigma-rule
- Stale Accounts In A Privileged Role · sigma-rule
- Successful Authentications From Countries You Do Not Operate Out Of · sigma-rule
- Suspicious Browser Activity · sigma-rule
- Suspicious Inbox Forwarding Identity Protection · sigma-rule
- Suspicious Inbox Manipulation Rules · sigma-rule
- Suspicious SignIns From A Non Registered Device · sigma-rule
- Temporary Access Pass Added To An Account · sigma-rule
- Too Many Global Admins · sigma-rule
- Unfamiliar Sign-In Properties · sigma-rule
- Use of Legacy Authentication Protocols · sigma-rule
- User Access Blocked by Azure Conditional Access · sigma-rule
- User Added to an Administrator's Azure AD Role · sigma-rule
- User Added To Group With CA Policy Modification Access · sigma-rule
- User Added To Privilege Role · sigma-rule
- User Removed From Group With CA Policy Modification Access · sigma-rule
- User State Changed From Guest To Member · sigma-rule
- Users Added to Global or Device Admin Roles · sigma-rule
- Users Authenticating To Other Azure AD Tenants · sigma-rule
- Windows LAPS Credential Dump From Entra ID · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.