Update rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
SigmaHQ · Jan 8, 2025 · 61c0bea · 61c0bea
1 parent 5cdc148
commit 61c0bea
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml b/rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml
@@ -9,6 +9,9 @@ references:
     - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
     - https://github.com/JumpsecLabs/TokenSmith
 date: 2025-01-08
+tags:
+    - attack.defense-evasion
+    - attack.t1078
 logsource:
     service: audit
     product: m365