diff --git a/Detections/SigninLogs/AzurePortalSigninfromanotherAzureTenant.yaml b/Detections/SigninLogs/AzurePortalSigninfromanotherAzureTenant.yaml index 2dd0d779f3..dd907a1c8a 100644 --- a/Detections/SigninLogs/AzurePortalSigninfromanotherAzureTenant.yaml +++ b/Detections/SigninLogs/AzurePortalSigninfromanotherAzureTenant.yaml @@ -19,8 +19,9 @@ relevantTechniques: - T1199 query: | // Get details of current Azure Ranges (note this URL updates regularly so will need to be manually updated over time) + // You may find the name of the new JSON here: https://www.microsoft.com/download/details.aspx?id=56519 let azure_ranges = externaldata(changeNumber: string, cloud: string, values: dynamic) - ["https://download.microsoft.com/download/7/1/D/71D86715-5596-4529-9B13-DA13A5DE5B63/ServiceTags_Public_20211018.json"] + ["https://download.microsoft.com/download/7/1/D/71D86715-5596-4529-9B13-DA13A5DE5B63/ServiceTags_Public_20211108.json"] with(format='multijson') | mv-expand values | mv-expand values.properties.addressPrefixes