hunting/azure/queries/entra_excessive_non_interactive_sfa_sign_ins_across_users.toml
rules/integrations/azure/credential_access_entra_password_spraying_non_interactive_sfa.toml

hunting/aws/queries/signin_single_factor_console_login_via_federated_session.toml
rules/integrations/aws/initial_access_signin_console_login_no_mfa.toml

hunting/aws/queries/servicequotas_discovery_multi_region_get_service_quota_calls.toml
rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml

hunting/aws/queries/servicequotas_discovery_multi_region_get_service_quota_calls.toml
rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml

hunting/aws/queries/ec2_discovery_multi_region_describe_instance_calls.toml
rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml

hunting/aws/queries/ec2_discovery_multi_region_describe_instance_calls.toml
rules/integrations/aws/discovery_ec2_multi_region_describe_instances.toml