cloudg 0.3.0__py3-none-any.whl

cloudg/rules/frameworks/mitre_attack_azure.yaml

@@ -0,0 +1,418 @@
+# Generated by scripts/import_prowler_compliance.py — do not edit by hand.
+# Framework: MITRE-ATTACK  (Azure)
+# Data source: Prowler (https://github.com/prowler-cloud/prowler), Apache-2.0.
+framework: MITRE-ATTACK-AZURE
+version: null
+source: Prowler compliance data (mitre_attack_azure.json), Apache-2.0, https://github.com/prowler-cloud/prowler
+provider: azure
+controls:
+- id: T1190
+  title: Adversaries may attempt to exploit a weakness in an Internet-facing host
+    or system to initially access a network. The weakness in the system can be a software
+    bug, a temporary glitch, or a misconfiguration.
+  checks:
+  - aks_clusters_created_with_private_nodes
+  - aks_clusters_public_access_disabled
+  - app_ensure_java_version_is_latest
+  - app_ensure_php_version_is_latest
+  - app_ensure_python_version_is_latest
+  - defender_assessments_vm_endpoint_protection_installed
+  - defender_auto_provisioning_log_analytics_agent_vms_on
+  - defender_auto_provisioning_vulnerabilty_assessments_machines_on
+  - defender_container_images_resolved_vulnerabilities
+  - defender_container_images_scan_enabled
+  - defender_ensure_defender_for_app_services_is_on
+  - defender_ensure_defender_for_arm_is_on
+  - defender_ensure_defender_for_azure_sql_databases_is_on
+  - defender_ensure_defender_for_containers_is_on
+  - defender_ensure_defender_for_cosmosdb_is_on
+  - defender_ensure_defender_for_databases_is_on
+  - defender_ensure_defender_for_dns_is_on
+  - defender_ensure_defender_for_keyvault_is_on
+  - defender_ensure_defender_for_os_relational_databases_is_on
+  - defender_ensure_defender_for_server_is_on
+  - defender_ensure_defender_for_sql_servers_is_on
+  - defender_ensure_defender_for_storage_is_on
+  - defender_ensure_iot_hub_defender_is_on
+  - defender_ensure_mcas_is_enabled
+  - defender_ensure_notify_alerts_severity_is_high
+  - defender_ensure_notify_emails_to_owners
+  - defender_ensure_system_updates_are_applied
+  - defender_ensure_wdatp_is_enabled
+- id: T1199
+  title: Adversaries may breach or otherwise leverage organizations who have access
+    to intended victims. Access through trusted third party relationship abuses an
+    existing connection that may not be protected or receives less scrutiny than standard
+    mechanisms of gaining access to a network.
+  checks:
+  - network_http_internet_access_restricted
+  - network_rdp_internet_access_restricted
+  - network_ssh_internet_access_restricted
+  - network_udp_internet_access_restricted
+- id: T1078
+  title: Adversaries may obtain and abuse credentials of existing accounts as a means
+    of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
+    Compromised credentials may be used to bypass access controls placed on various
+    resources on systems within the network and may even be used…
+  checks:
+  - entra_app_registration_credential_not_expired
+  - entra_conditional_access_policy_require_mfa_for_management_api
+  - entra_global_admin_in_less_than_five_users
+  - entra_non_privileged_user_has_mfa
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+  - entra_policy_restricts_user_consent_for_apps
+  - entra_policy_user_consent_for_verified_apps
+  - entra_privileged_user_has_mfa
+  - entra_security_defaults_enabled
+  - entra_trusted_named_locations_exists
+  - entra_user_with_vm_access_has_mfa
+  - entra_users_cannot_create_microsoft_365_groups
+- id: T1059
+  title: Adversaries may abuse command and script interpreters to execute commands,
+    scripts, or binaries. These interfaces and languages provide ways of interacting
+    with computer systems and are a common feature across many different platforms.
+    Most systems come with some built-in command-line interface and…
+  checks:
+  - defender_assessments_vm_endpoint_protection_installed
+  - defender_ensure_defender_for_app_services_is_on
+- id: T1204
+  title: An adversary may rely upon specific actions by a user in order to gain execution.
+    Users may be subjected to social engineering to get them to execute malicious
+    code by, for example, opening a malicious document file or link. These user actions
+    will typically be observed as follow-on behavior from f…
+  checks:
+  - defender_assessments_vm_endpoint_protection_installed
+  - defender_ensure_defender_for_app_services_is_on
+- id: T1098
+  title: Adversaries may manipulate accounts to maintain access to victim systems.
+    Account manipulation may consist of any action that preserves adversary access
+    to a compromised account, such as modifying credentials or permission groups.
+    These actions could also include account activity designed to subver…
+  checks:
+  - entra_conditional_access_policy_require_mfa_for_management_api
+  - entra_global_admin_in_less_than_five_users
+  - entra_non_privileged_user_has_mfa
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+  - entra_policy_restricts_user_consent_for_apps
+  - entra_policy_user_consent_for_verified_apps
+  - entra_privileged_user_has_mfa
+  - entra_security_defaults_enabled
+  - entra_trusted_named_locations_exists
+  - entra_user_with_vm_access_has_mfa
+  - entra_users_cannot_create_microsoft_365_groups
+- id: T1525
+  title: Adversaries may implant cloud or container images with malicious code to
+    establish persistence after gaining access to an environment. Amazon Web Services
+    (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure
+    Images as well as popular container runtimes such as Docker ca…
+  checks:
+  - defender_container_images_scan_enabled
+  - defender_ensure_defender_for_containers_is_on
+- id: T1556
+  title: Adversaries may modify authentication mechanisms and processes to access
+    user credentials or enable otherwise unwarranted access to accounts. The authentication
+    process is handled by mechanisms, such as the Local Security Authentication Server
+    (LSASS) process and the Security Accounts Manager (SAM)…
+  checks:
+  - entra_conditional_access_policy_require_mfa_for_management_api
+  - entra_global_admin_in_less_than_five_users
+  - entra_non_privileged_user_has_mfa
+  - entra_privileged_user_has_mfa
+  - entra_user_with_vm_access_has_mfa
+- id: T1562
+  title: Adversaries may maliciously modify components of a victim environment in
+    order to hinder or disable defensive mechanisms. This not only involves impairing
+    preventative defenses, such as firewalls and anti-virus, but also detection capabilities
+    that defenders can use to audit activity and identify m…
+  checks:
+  - defender_ensure_defender_for_arm_is_on
+- id: T1578
+  title: An adversary may attempt to modify a cloud account's compute service infrastructure
+    to evade defenses. A modification to the compute service infrastructure can include
+    the creation, deletion, or modification of one or more components such as compute
+    instances, virtual machines, and snapshots.
+  checks:
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+  - entra_policy_restricts_user_consent_for_apps
+  - entra_policy_user_consent_for_verified_apps
+  - entra_privileged_user_has_mfa
+  - entra_security_defaults_enabled
+- id: T1550
+  title: Adversaries may use alternate authentication material, such as password hashes,
+    Kerberos tickets, and application access tokens, in order to move laterally within
+    an environment and bypass normal system access controls.
+  checks:
+  - entra_global_admin_in_less_than_five_users
+  - entra_non_privileged_user_has_mfa
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+  - entra_policy_user_consent_for_verified_apps
+  - entra_privileged_user_has_mfa
+  - entra_user_with_vm_access_has_mfa
+- id: T1606
+  title: Adversaries may forge credential materials that can be used to gain access
+    to web applications or Internet services. Web applications and services (hosted
+    in cloud SaaS environments or on-premise servers) often use session cookies, tokens,
+    or other materials to authenticate and authorize user acces…
+  checks:
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+- id: T1040
+  title: Adversaries may sniff network traffic to capture information about an environment,
+    including authentication material passed over the network. Network sniffing refers
+    to using the network interface on a system to monitor or capture information sent
+    over a wired or wireless connection. An adversary m…
+  checks:
+  - app_client_certificates_on
+  - app_ensure_http_is_redirected_to_https
+  - app_minimum_tls_version_12
+  - entra_conditional_access_policy_require_mfa_for_management_api
+  - entra_global_admin_in_less_than_five_users
+  - entra_non_privileged_user_has_mfa
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+  - entra_policy_restricts_user_consent_for_apps
+  - entra_policy_user_consent_for_verified_apps
+  - entra_privileged_user_has_mfa
+  - entra_user_with_vm_access_has_mfa
+  - entra_users_cannot_create_microsoft_365_groups
+  - postgresql_flexible_server_enforce_ssl_enabled
+  - sqlserver_tde_encrypted_with_cmk
+  - sqlserver_tde_encryption_enabled
+  - storage_ensure_minimum_tls_version_12
+  - storage_secure_transfer_required_is_enabled
+- id: T1552
+  title: Adversaries may search compromised systems to find and obtain insecurely
+    stored credentials. These credentials can be stored and/or misplaced in many locations
+    on a system, including plaintext files (e.g. Bash History), operating system or
+    application-specific repositories (e.g. Credentials in Regi…
+  checks:
+  - defender_ensure_defender_for_app_services_is_on
+- id: T1048
+  title: Adversaries may steal data by exfiltrating it over a different protocol than
+    that of the existing command and control channel. The data may also be sent to
+    an alternate network location from the main command and control server.
+  checks:
+  - network_flow_log_captured_sent
+  - network_http_internet_access_restricted
+  - network_rdp_internet_access_restricted
+  - network_ssh_internet_access_restricted
+  - network_udp_internet_access_restricted
+  - network_watcher_enabled
+- id: T1537
+  title: Adversaries may exfiltrate data by transferring the data, including backups
+    of cloud environments, to another cloud account they control on the same service
+    to avoid typical file transfers/downloads and network-based exfiltration detection.
+  checks:
+  - defender_ensure_defender_for_storage_is_on
+- id: T1119
+  title: Once established within a system or network, an adversary may use automated
+    techniques for collecting internal data. Methods for performing this technique
+    could include use of a Command and Scripting Interpreter to search for and copy
+    information fitting set criteria such as file type, location, or…
+  checks:
+  - sqlserver_tde_encrypted_with_cmk
+  - sqlserver_tde_encryption_enabled
+  - vm_ensure_attached_disks_encrypted_with_cmk
+  - vm_ensure_unattached_disks_encrypted_with_cmk
+- id: T1530
+  title: Adversaries may collect sensitive data from these cloud storage solutions.
+    Providers typically offer security guides to help end users configure systems,
+    though misconfigurations are a common problem.[5][6][7] There have been numerous
+    incidents where cloud storage has been improperly secured, typic…
+  checks:
+  - aks_clusters_created_with_private_nodes
+  - aks_clusters_public_access_disabled
+  - cosmosdb_account_use_private_endpoints
+  - defender_ensure_defender_for_storage_is_on
+  - mysql_flexible_server_minimum_tls_version_12
+  - mysql_flexible_server_ssl_connection_enabled
+  - postgresql_flexible_server_enforce_ssl_enabled
+  - sqlserver_tde_encrypted_with_cmk
+  - sqlserver_tde_encryption_enabled
+  - storage_blob_public_access_level_is_disabled
+  - storage_ensure_azure_services_are_trusted_to_access_is_enabled
+  - storage_ensure_encryption_with_customer_managed_keys
+  - storage_ensure_private_endpoints_in_storage_accounts
+  - storage_infrastructure_encryption_is_enabled
+  - vm_ensure_attached_disks_encrypted_with_cmk
+  - vm_ensure_unattached_disks_encrypted_with_cmk
+- id: T1485
+  title: Adversaries may destroy data and files on specific systems or in large numbers
+    on a network to interrupt availability to systems, services, and network resources.
+    Data destruction is likely to render stored data irrecoverable by forensic techniques
+    through overwriting files or data on local and rem…
+  checks:
+  - defender_ensure_defender_for_storage_is_on
+  - monitor_alert_delete_nsg
+  - monitor_alert_delete_policy_assignment
+  - monitor_alert_delete_public_ip_address_rule
+  - monitor_alert_delete_security_solution
+  - monitor_alert_delete_sqlserver_fr
+  - storage_ensure_soft_delete_is_enabled
+- id: T1486
+  title: Adversaries may encrypt data on target systems or on large numbers of systems
+    in a network to interrupt availability to system and network resources. They can
+    attempt to render stored data inaccessible by encrypting files or data on local
+    and remote drives and withholding access to a decryption key…
+  checks:
+  - defender_ensure_defender_for_app_services_is_on
+  - defender_ensure_defender_for_arm_is_on
+  - defender_ensure_defender_for_azure_sql_databases_is_on
+  - defender_ensure_defender_for_containers_is_on
+  - defender_ensure_defender_for_cosmosdb_is_on
+  - defender_ensure_defender_for_databases_is_on
+  - defender_ensure_defender_for_dns_is_on
+  - defender_ensure_defender_for_keyvault_is_on
+  - defender_ensure_defender_for_os_relational_databases_is_on
+  - defender_ensure_defender_for_server_is_on
+  - defender_ensure_defender_for_sql_servers_is_on
+  - defender_ensure_defender_for_storage_is_on
+  - defender_ensure_iot_hub_defender_is_on
+  - defender_ensure_mcas_is_enabled
+  - defender_ensure_notify_alerts_severity_is_high
+  - defender_ensure_notify_emails_to_owners
+  - defender_ensure_system_updates_are_applied
+- id: T1499
+  title: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade
+    or block the availability of services to users. Endpoint DoS can be performed
+    by exhausting the system resources those services are hosted on or exploiting
+    the system to cause a persistent crash condition. Example services …
+  checks:
+  - defender_ensure_defender_for_app_services_is_on
+  - defender_ensure_defender_for_arm_is_on
+  - defender_ensure_defender_for_azure_sql_databases_is_on
+  - defender_ensure_defender_for_containers_is_on
+  - defender_ensure_defender_for_cosmosdb_is_on
+  - defender_ensure_defender_for_databases_is_on
+  - defender_ensure_defender_for_dns_is_on
+  - defender_ensure_defender_for_keyvault_is_on
+  - defender_ensure_defender_for_os_relational_databases_is_on
+  - defender_ensure_defender_for_server_is_on
+  - defender_ensure_defender_for_sql_servers_is_on
+  - defender_ensure_defender_for_storage_is_on
+  - defender_ensure_iot_hub_defender_is_on
+  - network_flow_log_captured_sent
+  - network_flow_log_more_than_90_days
+  - network_http_internet_access_restricted
+  - network_rdp_internet_access_restricted
+  - network_ssh_internet_access_restricted
+  - network_udp_internet_access_restricted
+  - network_watcher_enabled
+- id: T1496
+  title: Adversaries may leverage the resources of co-opted systems in order to solve
+    resource intensive problems, which may impact system and/or hosted service availability.
+  checks:
+  - defender_ensure_defender_for_app_services_is_on
+  - monitor_alert_create_policy_assignment
+  - monitor_alert_create_update_public_ip_address_rule
+  - monitor_alert_create_update_security_solution
+  - monitor_alert_create_update_sqlserver_fr
+  - monitor_alert_delete_nsg
+  - monitor_alert_delete_policy_assignment
+  - monitor_alert_delete_public_ip_address_rule
+  - monitor_alert_delete_security_solution
+  - monitor_alert_delete_sqlserver_fr
+- id: T1498
+  title: Adversaries may perform Network Denial of Service (DoS) attacks to degrade
+    or block the availability of targeted resources to users. Network DoS can be performed
+    by exhausting the network bandwidth services rely on. Example resources include
+    specific websites, email services, DNS, and web-based app…
+  checks:
+  - network_http_internet_access_restricted
+  - network_rdp_internet_access_restricted
+  - network_ssh_internet_access_restricted
+  - network_udp_internet_access_restricted
+  - network_watcher_enabled
+- id: T1087
+  title: Adversaries may attempt to get a listing of valid accounts, usernames, or
+    email addresses on a system or within a compromised environment. This information
+    can help adversaries determine which accounts exist, which can aid in follow-on
+    behavior such as brute-forcing, spear-phishing attacks, or acco…
+  checks:
+  - defender_ensure_defender_for_app_services_is_on
+  - defender_ensure_defender_for_arm_is_on
+- id: T1580
+  title: An adversary may attempt to discover infrastructure and resources that are
+    available within an infrastructure-as-a-service (IaaS) environment. This includes
+    compute service resources such as instances, virtual machines, and snapshots as
+    well as resources of other services including the storage and …
+  checks:
+  - defender_ensure_defender_for_arm_is_on
+  - defender_ensure_defender_for_keyvault_is_on
+  - entra_policy_default_users_cannot_create_security_groups
+  - entra_policy_ensure_default_user_cannot_create_apps
+  - entra_policy_ensure_default_user_cannot_create_tenants
+  - entra_policy_guest_invite_only_for_admin_roles
+  - entra_policy_guest_users_access_restrictions
+  - entra_policy_restricts_user_consent_for_apps
+  - entra_policy_user_consent_for_verified_apps
+- id: T1538
+  title: An adversary may use a cloud service dashboard GUI with stolen credentials
+    to gain useful information from an operational cloud environment, such as specific
+    services, resources, and features. For example, the GCP Command Center can be
+    used to view all assets, findings of potential security risks, …
+  checks:
+  - defender_ensure_defender_for_arm_is_on
+  - entra_privileged_user_has_mfa
+- id: T1526
+  title: An adversary may attempt to enumerate the cloud services running on a system
+    after gaining access. These methods can differ from platform-as-a-service (PaaS),
+    to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services
+    exist throughout the various cloud providers and can i…
+  checks:
+  - defender_ensure_defender_for_arm_is_on
+- id: T1046
+  title: Adversaries may attempt to get a listing of services running on remote hosts
+    and local network infrastructure devices, including those that may be vulnerable
+    to remote software exploitation. Common methods to acquire this information include
+    port and/or vulnerability scans using tools that are brou…
+  checks:
+  - network_http_internet_access_restricted
+  - network_rdp_internet_access_restricted
+  - network_ssh_internet_access_restricted
+  - network_udp_internet_access_restricted
+  - network_watcher_enabled
+- id: T1201
+  title: Adversaries may attempt to access detailed information about the password
+    policy used within an enterprise network or cloud environment. Password policies
+    are a way to enforce complex passwords that are difficult to guess or crack through
+    Brute Force. This information may help the adversary to crea…
+  checks:
+  - entra_global_admin_in_less_than_five_users
+  - entra_privileged_user_has_mfa
+  - entra_security_defaults_enabled
+- id: T1049
+  title: Adversaries may attempt to get a listing of network connections to or from
+    the compromised system they are currently accessing or from remote systems by
+    querying for information over the network.
+  checks:
+  - network_watcher_enabled
+- id: T1069
+  title: Adversaries may attempt to discover group and permission settings. This information
+    can help adversaries determine which user accounts and groups are available, the
+    membership of users in particular groups, and which users and groups have elevated
+    permissions.
+  checks:
+  - defender_ensure_defender_for_arm_is_on