admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml

Browse Source
This commit is contained in:
Jonhnathan
2022-01-07 09:39:50 -03:00
parent ff124757d6
commit 5a50aeeff6
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
+6 -5
View File
@@ -1,19 +1,19 @@
[metadata]
creation_date = "2020/11/19"
maturity = "production"
updated_date = "2021/07/20"
updated_date = "2022/01/07"
integration = "o365"
[rule]
author = ["Elastic"]
description = """
Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert
Identifies when a malware filter policy has been deleted or disabled in Microsoft 365. A malware filter policy is used to alert
administrators that an internal user sent a message that contained malware. This may indicate an account or machine
compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection.
"""
false_positives = [
"""
A malware filter policy may be deleted by a system or network administrator. Verify that the configuration change
A malware filter policy may be deleted or disabled by a system or network administrator. Verify that the configuration change
was expected. Exceptions can be added to this rule to filter expected behavior.
""",
]
@@ -21,12 +21,13 @@ from = "now-30m"
index = ["filebeat-*", "logs-o365*"]
language = "kuery"
license = "Elastic License v2"
name = "Microsoft 365 Exchange Malware Filter Policy Deletion"
name = "Microsoft 365 Exchange Malware Filter Policy Deleted or Disabled"
note = """## Config
The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = [
"https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterpolicy?view=exchange-ps",
"https://docs.microsoft.com/en-us/powershell/module/exchange/disable-malwarefilterrule?view=exchange-ps"
]
risk_score = 47
rule_id = "d743ff2a-203e-4a46-a3e3-40512cfe8fbb"
@@ -36,7 +37,7 @@ timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Remove-MalwareFilterPolicy" and event.outcome:success
event.dataset:o365.audit and event.provider:Exchange and event.category:web and (event.action:"Remove-MalwareFilterPolicy" or event.action:"Disable-MalwareFilterRule") and event.outcome:success
'''