diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml new file mode 100644 index 0000000000..b41bb2c6c1 --- /dev/null +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -0,0 +1,64 @@ +name: O365 DLP Rule Triggered +id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871 +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain. +data_source: +- O365 Universal Audit Log +search: > + `o365_management_activity` Operation=DLPRuleMatch + | eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') + | stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason + | `o365_dlp_rule_triggered_filter` + | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id + | eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow") + |`security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions. +known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately. +references: +- https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp +tags: + analytic_story: + - Data Exfiltration + asset_type: O365 Tenant + confidence: 50 + impact: 40 + message: User $src_user$ triggered a Microsoft Office DLP rule. + mitre_attack_id: + - T1048 + - T1567 + observable: + - name: src_user + type: User + role: + - Victim + - name: recipient + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Operation + - ExchangeMetaData.To{} + - ExchangeMetaData.UniqueID + - PolicyDetails{}.Rules{}.RuleName + - UserId + - PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName + - PolicyDetails{}.Rules{}.Actions{} + - PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location + risk_score: 20 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml new file mode 100644 index 0000000000..92f1ab9639 --- /dev/null +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -0,0 +1,65 @@ +name: O365 Email Access By Security Administrator +id: c6998a30-fef4-4e89-97ac-3bb0123719b4 +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess +| stats values(Workload) as category, values(MailboxId) as user, values(Operation) as signature, count, min(_time) as firstTime, max(_time) as lastTime by InternetMessageId, UserId +| rename InternetMessageId as signature_id, UserId as src_user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_email_access_by_security_administrator_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license. +known_false_positives: Legitamate access by security administators for incident response measures. +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-investigate-delivered-malicious-email?view=o365-worldwide +tags: + analytic_story: + - Data Exfiltration + - Azure Active Directory Account Takeover + - Office 365 Account Takeover + asset_type: O365 Tenant + confidence: 50 + impact: 50 + message: A security administrator $src_user$ accessed email messages for $user$ + mitre_attack_id: + - T1567 + - T1114 + - T1114.002 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: signature_id + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - MailboxId + - InternetMessageId + - UserId + risk_score: 25 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml new file mode 100644 index 0000000000..8d12400350 --- /dev/null +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -0,0 +1,63 @@ +name: O365 Email Reported By Admin Found Malicious +id: 94396c3e-7728-422a-9956-e4b77b53dbdf +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission +| search RescanVerdict IN (Phish,Malware) +| stats values(Subject) as subject, values(RescanVerdict) as result, values(SenderIP) as src, values(P2Sender) as sender, values(P1Sender) as src_user, values(Recipients{}) as user, count min(_time) as firstTime, max(_time) as lastTime, by Id,Operation,UserId +| rename Name as signature, Id as signature_id, UserId as o365_adminuser +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_email_reported_by_admin_found_malicious_filter`' +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +known_false_positives: Administrators that submit known phishing training exercises. +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide +tags: + analytic_story: + - Spearphishing Attachments + - Suspicious Emails + asset_type: O365 Tenant + confidence: 100 + impact: 50 + message: O365 security admin $o365_adminuser$ manually reported a suspicious email from $src_user$ + mitre_attack_id: + - T1566 + - T1566.001 + - T1566.002 + observable: + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + - name: subject + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Id + - Operation + - UserId + risk_score: 50 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml new file mode 100644 index 0000000000..1a8aca9532 --- /dev/null +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -0,0 +1,72 @@ +name: O365 Email Reported By User Found Malicious +id: 7698b945-238e-4bb9-b172-81f5ca1685a1 +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="Email reported by user as*" +| fromjson Data +| rename _raw AS temp etps AS _raw | extract pairdelim=";" kvdelim=":" | rename _raw AS etps temp AS _raw +| search RescanVerdict IN (Phish,Malware) +| rex field=tsd "\<(?.+)\>" +| eval src_user = case(isnull(src_user),tsd,true(),src_user) +| stats count min(_time) as firstTime max(_time) as lastTime values(ms) as subject values(RescanVerdict) as result values(tsd) as sender values(src_user) as src_user by AlertId,AlertEntityId,Operation,Name +| rename Name as signature, AlertId as signature_id, AlertEntityId as user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_email_reported_by_user_found_malicious_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy/allow the usage of the Microsoft Office Report A Message function. +known_false_positives: unknown +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide +tags: + analytic_story: + - Spearphishing Attachments + - Suspicious Emails + asset_type: O365 Tenant + confidence: 100 + impact: 75 + message: The user $user$ reported an email classified as $result$ from $src_user$ + mitre_attack_id: + - T1566 + - T1566.001 + - T1566.002 + observable: + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + - name: subject + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - Name + - Data + - AlertId + - AlertEntityId + - tsd + - etps + risk_score: 75 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml new file mode 100644 index 0000000000..7ab19a832f --- /dev/null +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -0,0 +1,56 @@ +name: O365 Email Security Feature Changed +id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when specific O365 advanced security settings are altered within the Office 365 tenant. If an attacker successfully disables O365 security settings, they can operate within the tenant with reduced risk of detection. This can lead to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") +| stats values(ObjectId) as object, min(_time) as firstTime, max(_time) as lastTime, count by Id, UserId, Operation +| rename Id as object_id, UserId as user, Operation as signature +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_email_security_feature_changed_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. +known_false_positives: Administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. Filter as needed. +references: +- https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults +- https://attack.mitre.org/techniques/T1562/008/ +tags: + analytic_story: + - Office 365 Persistence Mechanisms + - Office 365 Account Takeover + asset_type: O365 Tenant + confidence: 25 + impact: 100 + message: An O365 security object [$object$] was altered by user $user$ using $signature$ + mitre_attack_id: + - T1562 + - T1562.008 + - T1562.001 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Id + - UserId + - Operation + - Workload + risk_score: 25 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml new file mode 100644 index 0000000000..f2c61be3f5 --- /dev/null +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -0,0 +1,57 @@ +name: O365 Email Suspicious Behavior Alert +id: 85c7555a-05af-4322-81aa-76b4ddf52baa +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when one of O365 the built-in security detections for suspicious email behaviors are triggered. These alerts often indicate that an attacker may have compromised a mailbox within the environment. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded") +| fromjson Data +| stats count min(_time) as firstTime max(_time) as lastTime by AlertId,ObjectId,Operation,Name +| rename Name as signature, AlertId as signature_id, ObjectId as user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_email_suspicious_behavior_alert_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The alerts must be enabled in the o365 security portal. +known_false_positives: Users emailing for legitimate business purposes that appear suspicious. +references: +- https://learn.microsoft.com/en-us/purview/alert-policies +tags: + analytic_story: + - Suspicious Emails + - Office 365 Collection Techniques + - Office 365 Account Takeover + asset_type: O365 Tenant + confidence: 100 + impact: 90 + message: The user $user$ triggered the O365 security alert [$signature$] + mitre_attack_id: + - T1114 + - T1114.003 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - AlertId + - ObjectId + - Operation + - Name + - Workload + risk_score: 90 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml new file mode 100644 index 0000000000..02718f35b0 --- /dev/null +++ b/detections/cloud/o365_safe_links_detection.yml @@ -0,0 +1,63 @@ +name: O365 Safe Links Detection +id: 711d9e8c-2cb0-45cf-8813-5f191ecb9b26 +version: 1 +date: '2024-03-30' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects when any Microsoft Safe Links alerting is triggered. This behavior may indicate when user has interacted with a phishing or otherwise malicious link within the Microsoft Office ecosystem. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated +| fromjson Data +| stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId) as url values(od) as desc by AlertId,trc,Operation,Name,ot +| rename Name as signature, AlertId as signature_id, trc as user,ot as action +| eval action = CASE(action == "Allowed", "allowed", action=="BlockPageOverride", "allowed", true(),"blocked") +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_safe_links_detection_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The Safe Links capability must be configured and is typically only available to E3/E5 level customers. +known_false_positives: Based on Safe Links policies, may vary. +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide +- https://attack.mitre.org/techniques/T1566/ +tags: + analytic_story: + - Office 365 Account Takeover + - Spearphishing Attachments + asset_type: O365 Tenant + confidence: 100 + impact: 40 + message: $user$ triggered a Microsoft Safe Links detection. + mitre_attack_id: + - T1566 + - T1566.001 + observable: + - name: user + type: User + role: + - Victim + - name: url + type: URL String + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - AlertId + - Operation + - Name + - AlertId + - trc + - ot + risk_score: 40 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml new file mode 100644 index 0000000000..e150b2ab53 --- /dev/null +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -0,0 +1,60 @@ +name: O365 SharePoint Allowed Domains Policy Changed +id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access. +data_source: +- O365 Universal Audit Log +search: > + `o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList + | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",") + | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name + | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) + | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) + | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_sharepoint_allowed_domains_policy_changed_filter` +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. +known_false_positives: Business approved changes by known administrators. +references: +- https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: O365 Tenant + confidence: 100 + impact: 75 + message: The SharePoint Online domain allowlist was changed by $user$, $result$ + mitre_attack_id: + - T1136.003 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - ModifiedProperties{}.Name + - CorrelationId + - ClientIP + - UserId + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + risk_score: 75 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml new file mode 100644 index 0000000000..740a738ff5 --- /dev/null +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -0,0 +1,66 @@ +name: O365 SharePoint Malware Detection +id: 583c5de3-7709-44cb-abfc-0e828d301b59 +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Operation=FileMalwareDetected +| stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId +| rename Id as signature_id, UserId as user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_sharepoint_malware_detection_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. +known_false_positives: unknown +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide +tags: + analytic_story: + - Azure Active Directory Persistence + - Office 365 Account Takeover + - Ransomware Cloud + asset_type: O365 Tenant + confidence: 100 + impact: 75 + message: SharePoint detected a potentially malicious file $file_name$ + mitre_attack_id: + - T1204.002 + - T1204 + observable: + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Victim + - name: signature + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Operation + - Workload + - SourceFileName + - ObjectId + - VirusInfo + - Id + - UserId + risk_score: 75 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml new file mode 100644 index 0000000000..02ca94e31b --- /dev/null +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -0,0 +1,66 @@ +name: O365 Threat Intelligence Suspicious Email Delivered +id: 605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2 +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. Attackers may execute several attacks through email, any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound +| rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action +| stats values(SenderIp) as src, values(Subject) as subject, values(user) as user, values(action) as action, values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) as lastTime, count by src_user,sender +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_threat_intelligence_suspicious_email_delivered_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. +known_false_positives: unknown +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-ti?view=o365-worldwide +tags: + analytic_story: + - Spearphishing Attachments + - Suspicious Emails + asset_type: O365 Tenant + confidence: 100 + impact: 20 + message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature + mitre_attack_id: + - T1566 + - T1566.001 + - T1566.002 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: subject + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - P2Sender + - P1Sender + - Recipients + - DeliveryAction + - Operation + - Workload + risk_score: 20 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml new file mode 100644 index 0000000000..fbac1d3cc4 --- /dev/null +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -0,0 +1,64 @@ +name: O365 Threat Intelligence Suspicious File Detected +id: 00958c7b-35db-4e7a-ad13-31550a7a7c64 +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when a malicious file is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection +| stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId +| rename Id as signature_id, UserId as user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_threat_intelligence_suspicious_file_detected_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. +known_false_positives: unknown +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-real-time-detections-about?view=o365-worldwide +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide +tags: + analytic_story: + - Azure Active Directory Account Takeover + - Office 365 Account Takeover + - Ransomware Cloud + asset_type: O365 Tenant + confidence: 100 + impact: 50 + message: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$ + mitre_attack_id: + - T1204.002 + - T1204 + observable: + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Victim + - name: signature + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - Id + - UserId + risk_score: 50 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml new file mode 100644 index 0000000000..d3e775cbb4 --- /dev/null +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -0,0 +1,70 @@ +name: O365 ZAP Activity Detection +id: 4df275fd-a0e5-4246-8b92-d3201edaef7a +version: 1 +date: '2024-04-01' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic detects when the Microsoft Zero-hour Automatic Purge (ZAP) capability takes action against a user's mailbox. This capability is an enhanced protection feature that retro-actively removes email with known malicious content for user inboxes. Since this is a retroactive capability, there is still a window in which the user may fall victim to the malicious content. +data_source: +- O365 Universal Audit Log +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*" +| fromjson Data +| stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,Operation,Name +| rename Name as signature, AlertId as signature_id, trc as user +| eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";") +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_zap_activity_detection_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Some features of Zero-hour purge are only offered within E3/E5 license level tenants, events may not be available otherwise. +known_false_positives: unknown +references: +- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide +tags: + analytic_story: + - Spearphishing Attachments + - Suspicious Emails + asset_type: O365 Tenant + confidence: 50 + impact: 20 + message: User $user$ was included in a ZAP protection activity. + mitre_attack_id: + - T1566 + - T1566.001 + - T1566.002 + observable: + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + - name: url + type: URL String + role: + - Attacker + - name: src_user + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Workload + - Operation + - Name + - Data + - AlertId + risk_score: 10 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + sourcetype: o365:management:activity + source: o365 \ No newline at end of file