Techniques
Sample rules
PIM Approvals And Deny Elevation
- source: sigma
- technicques:
- t1078
- t1078.004
Description
Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Detection logic
condition: selection
selection:
properties.message: Request Approved/Denied