t1213 | LoFP

t1213

Title	Tags
a self-hosted runner is automatically removed from github if it has not connected to github actions for more than 14 days.	t1078 t1078.004 t1213 t1213.003 t1526 github sigma
allowed self-hosted runners changes in the environment.	t1078 t1078.004 t1213 t1213.003 t1526 github sigma
an ephemeral self-hosted runner is automatically removed from github if it has not connected to github actions for more than 1 day.	t1078 t1078.004 t1213 t1213.003 t1526 github sigma
if the user is a developer or automation engineer, validate if this behavior was for testing purposes.	t1213 azure elastic
legitimate non-interactive access to sharepoint online via the microsoft authentication broker may occur in enterprise environments, especially with mdm solutions or automated scripts. however, this should be explicitly allowed and monitored.	t1213 azure elastic
legitimate user activity.	t1021 t1021.004 t1082 t1098 t1213 t1213.003 t1562 t1562.001 t1591 t1591.004 bitbucket sigma
some enterprise mdm or brokered flows may use refresh tokens legitimately (especially with hybrid/azure ad joined devices). automated scripts for legitimate tasks (e.g., reporting, backups) might use `python-requests`, though this should be explicitly allowed.	t1213 azure elastic
validate the actor if permitted to access the repo.	t1098 t1098.001 t1098.003 t1213 t1213.003 github sigma
validate the deletion activity is permitted. the \"actor\" field need to be validated.	t1213 t1213.003 github sigma
validate the multifactor authentication changes.	t1098 t1098.001 t1098.003 t1213 t1213.003 github sigma