From 5ee478a290412eeb9419717a1f43f06578dc360c Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sun, 7 Apr 2024 11:20:35 -0400
Subject: [PATCH 1/4] Add files via upload

---
 detections/cloud/o365_dlp_rule_triggered.yml  | 63 ++++++++++++++++
 ...email_access_by_security_administrator.yml | 64 ++++++++++++++++
 ...mail_reported_by_admin_found_malicious.yml | 63 ++++++++++++++++
 ...email_reported_by_user_found_malicious.yml | 73 +++++++++++++++++++
 .../o365_email_security_feature_changed.yml   | 56 ++++++++++++++
 .../o365_email_suspicious_behavior_alert.yml  | 57 +++++++++++++++
 .../cloud/o365_safe_links_detection.yml       | 63 ++++++++++++++++
 ...repoint_allowed_domains_policy_changed.yml | 59 +++++++++++++++
 .../o365_sharepoint_malware_detection.yml     | 66 +++++++++++++++++
 ...ntelligence_suspicious_email_delivered.yml | 66 +++++++++++++++++
 ..._intelligence_suspicious_file_detected.yml | 64 ++++++++++++++++
 .../cloud/o365_zap_activity_detection.yml     | 70 ++++++++++++++++++
 12 files changed, 764 insertions(+)
 create mode 100644 detections/cloud/o365_dlp_rule_triggered.yml
 create mode 100644 detections/cloud/o365_email_access_by_security_administrator.yml
 create mode 100644 detections/cloud/o365_email_reported_by_admin_found_malicious.yml
 create mode 100644 detections/cloud/o365_email_reported_by_user_found_malicious.yml
 create mode 100644 detections/cloud/o365_email_security_feature_changed.yml
 create mode 100644 detections/cloud/o365_email_suspicious_behavior_alert.yml
 create mode 100644 detections/cloud/o365_safe_links_detection.yml
 create mode 100644 detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
 create mode 100644 detections/cloud/o365_sharepoint_malware_detection.yml
 create mode 100644 detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
 create mode 100644 detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
 create mode 100644 detections/cloud/o365_zap_activity_detection.yml

diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml
new file mode 100644
index 0000000000..0b08dda841
--- /dev/null
+++ b/detections/cloud/o365_dlp_rule_triggered.yml
@@ -0,0 +1,63 @@
+name: O365 DLP Rule Triggered
+id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Operation=DLPRuleMatch
+| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
+| stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason
+| `o365_dlp_rule_triggered_filter`
+| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id
+| eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow")
+|`security_content_ctime(firstTime)` 
+|`security_content_ctime(lastTime)`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions.
+known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.
+references:
+- https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
+tags:
+  analytic_story: 
+  - Data Exfiltration
+  asset_type: Office 365
+  confidence: 50
+  impact: 40
+  message: User $src_user$ triggered a Microsoft Office DLP rule.
+  mitre_attack_id: 
+  - T1048
+  - T1567
+  observable: 
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: recipient
+    type: User
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Operation 
+  - ExchangeMetaData.To{}
+  - ExchangeMetaData.UniqueID
+  - PolicyDetails{}.Rules{}.RuleName
+  - UserId
+  - PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName
+  - PolicyDetails{}.Rules{}.Actions{}
+  - PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location 
+  risk_score: 20
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml
new file mode 100644
index 0000000000..75c2b89d35
--- /dev/null
+++ b/detections/cloud/o365_email_access_by_security_administrator.yml
@@ -0,0 +1,64 @@
+name: O365 Email Access By Security Administrator
+id: c6998a30-fef4-4e89-97ac-3bb0123719b4
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
+| stats values(Workload) as category, values(MailboxId) as user, values(Operation) as signature, count, min(_time) as firstTime, max(_time) as lastTime by InternetMessageId, UserId
+| rename InternetMessageId as signature_id, UserId as src_user  
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_email_access_by_security_administrator_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license.
+known_false_positives: Legitamate access by security administators for incident response measures.
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-investigate-delivered-malicious-email?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Data Exfiltration
+  - Azure Active Directory Account Takeover
+  - Office 365 Account Takeover
+  asset_type: Office 365
+  confidence: 50
+  impact: 50
+  message: A security administrator $src_user$ accessed email messages for $user$
+  mitre_attack_id: 
+  - T1567
+  - T1114
+  - T1114.002
+  observable: 
+  - name: user
+    type: User
+    role:
+  - name: src_user
+    type: User
+    role:	
+    - Victim
+  - name: signature_id
+    type: Other
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Workload
+  - Operation 
+  - MailboxId
+  - InternetMessageId
+  - UserId
+  risk_score: 25
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
new file mode 100644
index 0000000000..488b75920a
--- /dev/null
+++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
@@ -0,0 +1,63 @@
+name: O365 Email Reported By Admin Found Malicious
+id: 94396c3e-7728-422a-9956-e4b77b53dbdf
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission
+| search RescanVerdict IN (Phish,Malware)
+| stats values(Subject) as subject, values(RescanVerdict) as result, values(SenderIP) as src, values(P2Sender) as sender, values(P1Sender) as src_user, values(Recipients{}) as user, count min(_time) as firstTime, max(_time) as lastTime, by Id,Operation,UserId
+| rename Name as signature, Id as signature_id, UserId as o365_adminuser
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_email_reported_by_admin_found_malicious_filter`'
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
+known_false_positives: Administrators that submit known phishing training exercises.
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Spearphishing Attachments
+  - Suspicious Emails
+  asset_type: Office 365
+  confidence: 100
+  impact: 50
+  message: O365 security admin $o365_adminuser$ manually reported a suspicious email from $src_user$
+  mitre_attack_id: 
+  - T1566
+  - T1566.001
+  - T1566.002
+  observable: 
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: subject
+    type: Other
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Id
+  - Operation
+  - UserId
+  risk_score: 50
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml
new file mode 100644
index 0000000000..857cbad1d3
--- /dev/null
+++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml
@@ -0,0 +1,73 @@
+name: O365 Email Reported By User Found Malicious
+id: 7698b945-238e-4bb9-b172-81f5ca1685a1
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: ⁠
+The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=SecurityComplianceCenter  Operation=AlertEntityGenerated Name="Email reported by user as*" 
+| fromjson Data 
+| rename _raw AS temp etps AS _raw | extract pairdelim=";" kvdelim=":" | rename _raw AS etps temp AS _raw 
+| search RescanVerdict IN (Phish,Malware)
+| rex field=tsd "\<(?<src_user>.+)\>" 
+| eval src_user = case(isnull(src_user),tsd,true(),src_user) 
+| stats count min(_time) as firstTime max(_time) as lastTime values(ms) as subject values(RescanVerdict) as result values(tsd) as sender values(src_user) as src_user by AlertId,AlertEntityId,Operation,Name 
+| rename Name as signature, AlertId as signature_id, AlertEntityId as user 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_email_reported_by_user_found_malicious_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy/allow the usage of the Microsoft Office Report A Message function.
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Spearphishing Attachments
+  - Suspicious Emails
+  asset_type: Office 365
+  confidence: 100
+  impact: 75
+  message: The user $user$ reported an email classified as $result$ from $src_user$
+  mitre_attack_id: 
+  - T1566
+  - T1566.001
+  - T1566.002
+  observable: 
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: subject
+    type: Other
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Workload
+  - Operation
+  - Name
+  - Data
+  - AlertId
+  - AlertEntityId
+  - tsd
+  - etps
+  risk_score: 75
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml
new file mode 100644
index 0000000000..c104efb56c
--- /dev/null
+++ b/detections/cloud/o365_email_security_feature_changed.yml
@@ -0,0 +1,56 @@
+name: O365 Security Feature Changed
+id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when specific O365 advanced security settings are altered within the Office 365 tenant. If an attacker successfully disables O365 security settings, they can operate within the tenant with reduced risk of detection. This can lead to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail. 
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*")
+| stats values(ObjectId) as object, min(_time) as firstTime, max(_time) as lastTime, count  by Id, UserId, Operation
+| rename Id as object_id, UserId as user, Operation as signature
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_email_security_feature_changed_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
+known_false_positives: Administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. Filter as needed.
+references:
+- https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
+- https://attack.mitre.org/techniques/T1562/008/
+tags:
+  analytic_story: 
+  - Office 365 Persistence Mechanisms
+  - Office 365 Account Takeover
+  asset_type: Office 365
+  confidence: 25
+  impact: 100
+  message: An O365 security object [$object$] was altered by user $user$ using $signature$
+  mitre_attack_id: 
+  - T1562
+  - T1562.008
+  - T1562.001
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Id
+  - UserId
+  - Operation
+  - Workload
+  risk_score: 25
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml
new file mode 100644
index 0000000000..eb93d93be8
--- /dev/null
+++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml
@@ -0,0 +1,57 @@
+name: O365 Email Suspicious Behavior Alert
+id: 85c7555a-05af-4322-81aa-76b4ddf52baa
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when one of O365 the built-in security detections for suspicious email behaviors are triggered.  These alerts often indicate that an attacker may have compromised a mailbox within the environment. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded") 
+| fromjson Data
+| stats count min(_time) as firstTime max(_time) as lastTime by AlertId,ObjectId,Operation,Name
+| rename Name as signature, AlertId as signature_id, ObjectId as user
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_email_suspicious_behavior_alert_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The alerts must be enabled in the o365 security portal.
+known_false_positives: Users emailing for legitimate business purposes that appear suspicious.
+references:
+- https://learn.microsoft.com/en-us/purview/alert-policies
+tags:
+  analytic_story: 
+  - Suspicious Emails
+  - Office 365 Collection Techniques
+  - Office 365 Account Takeover
+  asset_type: Office 365
+  confidence: 100
+  impact: 90
+  message: The user $user$ triggered the O365 security alert [$signature$]
+  mitre_attack_id: 
+  - T1114
+  - T1114.003
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - AlertId
+  - ObjectId
+  - Operation
+  - Name
+  - Workload
+  risk_score: 90
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml
new file mode 100644
index 0000000000..aa07043b30
--- /dev/null
+++ b/detections/cloud/o365_safe_links_detection.yml
@@ -0,0 +1,63 @@
+name: O365 Safe Links Detection - $user$
+id: 711d9e8c-2cb0-45cf-8813-5f191ecb9b26
+version: 1
+date: '2024-03-30'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic detects when any Microsoft Safe Links alerting is triggered. This behavior may indicate when user has interacted with a phishing or otherwise malicious link within the Microsoft Office ecosystem.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated 
+| fromjson Data 
+| stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId) as url values(od) as desc by AlertId,trc,Operation,Name,ot 
+| rename Name as signature, AlertId as signature_id, trc as user,ot as action 
+| eval action = CASE(action == "Allowed", "allowed", action=="BlockPageOverride", "allowed", true(),"blocked") 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_safe_links_detection_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The Safe Links capability must be configured and is typically only available to E3/E5 level customers. 
+known_false_positives: Based on Safe Links policies, may vary.
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide
+- https://attack.mitre.org/techniques/T1566/
+tags:
+  analytic_story: 
+  - Office 365 Account Takeover
+  - Spearphishing Attachments
+  asset_type: Office 365
+  confidence: 100
+  impact: 40
+  message: $user$ triggered a Microsoft Safe Links detection.
+  mitre_attack_id: 
+  - T1566
+  - T1566.001
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: url
+    type: URL String
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - AlertId
+  - Operation
+  - Name
+  - AlertId
+  - trc
+  - ot  
+  risk_score: 40
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
new file mode 100644
index 0000000000..726b072f82
--- /dev/null
+++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
@@ -0,0 +1,59 @@
+name: O365 SharePoint Allowed Domains Policy Changed
+id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList
+| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",")
+| stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name
+| eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null))
+| eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null))
+| eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted")
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_sharepoint_allowed_domains_policy_changed_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. 
+known_false_positives: Business approved changes by known administrators.
+references:
+- https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview
+tags:
+  analytic_story: 
+  - Azure Active Directory Persistence
+  asset_type: Office 365
+  confidence: 100
+  impact: 75
+  message: The SharePoint Online domain allowlist was changed by $user$, $result$
+  mitre_attack_id: 
+  - T1136.003
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Workload
+  - Operation
+  - ModifiedProperties{}.Name
+  - CorrelationId
+  - ClientIP
+  - UserId
+  - ModifiedProperties{}.NewValue
+  - ModifiedProperties{}.OldValue
+  risk_score: 75
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml
new file mode 100644
index 0000000000..2cccf222ae
--- /dev/null
+++ b/detections/cloud/o365_sharepoint_malware_detection.yml
@@ -0,0 +1,66 @@
+name: O365 SharePoint Malware Detection
+id: 583c5de3-7709-44cb-abfc-0e828d301b59
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Operation=FileMalwareDetected
+| stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId
+| rename Id as signature_id, UserId as user  
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_sharepoint_malware_detection_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. 
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Azure Active Directory Persistence
+  - Office 365 Account Takeover
+  - Ransomware Cloud
+  asset_type: Office 365
+  confidence: 100
+  impact: 75
+  message: SharePoint detected a potentially malicious file $file_name$
+  mitre_attack_id: 
+  - T1204.002
+  - T1204
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim	
+  - name: signature
+    type: Other
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - Operation 
+  - Workload
+  - SourceFileName
+  - ObjectId
+  - VirusInfo
+  - Id
+  - UserId
+  risk_score: 75
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
new file mode 100644
index 0000000000..5f489e2f9d
--- /dev/null
+++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
@@ -0,0 +1,66 @@
+name: O365 Threat Intelligence Suspicious Email Delivered - $user$
+id: 605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. Attackers may execute several attacks through email, any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound
+| rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action
+| stats values(SenderIp) as src, values(Subject) as subject, values(user) as user, values(action) as action, values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) as lastTime, count  by src_user,sender
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_threat_intelligence_suspicious_email_delivered_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. 
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide 
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-ti?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Spearphishing Attachments
+  - Suspicious Emails
+  asset_type: Office 365
+  confidence: 100
+  impact: 20
+  message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature
+  mitre_attack_id: 
+  - T1566
+  - T1566.001
+  - T1566.002
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: subject
+    type: Other
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time
+  - P2Sender
+  - P1Sender
+  - Recipients
+  - DeliveryAction
+  - Operation
+  - Workload
+  risk_score: 20
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
new file mode 100644
index 0000000000..706ee24940
--- /dev/null
+++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
@@ -0,0 +1,64 @@
+name: O365 Threat Intelligence Suspicious File Detected
+id: 00958c7b-35db-4e7a-ad13-31550a7a7c64
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: TTP
+description: The following analytic identifies when a malicious file is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection
+| stats values(DetectionMethod) as category  values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId
+| rename Id as signature_id, UserId as user  
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_threat_intelligence_suspicious_file_detected_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. 
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-real-time-detections-about?view=o365-worldwide
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Azure Active Directory Account Takeover
+  - Office 365 Account Takeover
+  - Ransomware Cloud
+  asset_type: Office 365
+  confidence: 100
+  impact: 50
+  message: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$
+  mitre_attack_id: 
+  - T1204.002
+  - T1204
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim
+  - name: signature
+    type: Other
+    role:
+    - Attacker
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time  
+  - Workload
+  - Operation
+  - Id
+  - UserId
+  risk_score: 50
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file
diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml
new file mode 100644
index 0000000000..5265457654
--- /dev/null
+++ b/detections/cloud/o365_zap_activity_detection.yml
@@ -0,0 +1,70 @@
+name: O365 ZAP Activity Detection
+id: 4df275fd-a0e5-4246-8b92-d3201edaef7a
+version: 1
+date: '2024-04-01'
+author: Steven Dick
+status: production
+type: Anomaly
+description: The following analytic detects when the Microsoft Zero-hour Automatic Purge (ZAP) capability takes action against a user's mailbox. This capability is an enhanced protection feature that retro-actively removes email with known malicious content for user inboxes. Since this is a retroactive capability, there is still a window in which the user may fall victim to the malicious content.
+data_source: 
+- O365 Universal Audit Log
+search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*"
+| fromjson Data
+| stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,Operation,Name
+| rename Name as signature, AlertId as signature_id, trc as user
+| eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";")
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `o365_zap_activity_detection_filter`'
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Some features of Zero-hour purge are only offered within E3/E5 license level tenants, events may not be available otherwise.
+known_false_positives: unknown
+references:
+- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide
+tags:
+  analytic_story: 
+  - Spearphishing Attachments
+  - Suspicious Emails
+  asset_type: Office 365
+  confidence: 50
+  impact: 20
+  message: User $user$ was included in a ZAP protection activity.
+  mitre_attack_id: 
+  - T1566
+  - T1566.001
+  - T1566.002
+  observable: 
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Attacker
+  - name: url
+    type: URL String
+    role:
+    - Attacker
+  - name: src_user
+    type: User
+    role:
+    - Attacker	
+  product: 
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields: 
+  - _time  
+  - Workload
+  - Operation
+  - Name
+  - Data
+  - AlertId
+  risk_score: 10
+  security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
+    sourcetype: o365:management:activity
+    source: o365
\ No newline at end of file

From 609366d71ba450f3fc1692d4f198ba02bb01e738 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sun, 7 Apr 2024 11:50:54 -0400
Subject: [PATCH 2/4] Update o365_safe_links_detection.yml

---
 detections/cloud/o365_safe_links_detection.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml
index aa07043b30..8b7a572ac2 100644
--- a/detections/cloud/o365_safe_links_detection.yml
+++ b/detections/cloud/o365_safe_links_detection.yml
@@ -1,4 +1,4 @@
-name: O365 Safe Links Detection - $user$
+name: O365 Safe Links Detection
 id: 711d9e8c-2cb0-45cf-8813-5f191ecb9b26
 version: 1
 date: '2024-03-30'
@@ -60,4 +60,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
     sourcetype: o365:management:activity
-    source: o365
\ No newline at end of file
+    source: o365

From add13ef1de31667d943a4974e9e6c90871b69986 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sun, 7 Apr 2024 11:51:24 -0400
Subject: [PATCH 3/4] Update
 o365_threat_intelligence_suspicious_email_delivered.yml

---
 .../o365_threat_intelligence_suspicious_email_delivered.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
index 5f489e2f9d..3b3fee2313 100644
--- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
+++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
@@ -1,4 +1,4 @@
-name: O365 Threat Intelligence Suspicious Email Delivered - $user$
+name: O365 Threat Intelligence Suspicious Email Delivered
 id: 605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2
 version: 1
 date: '2024-04-01'
@@ -63,4 +63,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
     sourcetype: o365:management:activity
-    source: o365
\ No newline at end of file
+    source: o365

From 46eb5c039726bf5b0bf660f467496ad56dcbfcfd Mon Sep 17 00:00:00 2001
From: ljstella <lstella@splunk.com>
Date: Thu, 25 Jul 2024 12:02:17 -0500
Subject: [PATCH 4/4] Handful of updates to pass validation

---
 detections/cloud/o365_dlp_rule_triggered.yml  | 19 +++++++++--------
 ...email_access_by_security_administrator.yml |  3 ++-
 ...mail_reported_by_admin_found_malicious.yml |  2 +-
 ...email_reported_by_user_found_malicious.yml |  5 ++---
 .../o365_email_security_feature_changed.yml   |  4 ++--
 .../o365_email_suspicious_behavior_alert.yml  |  2 +-
 .../cloud/o365_safe_links_detection.yml       |  2 +-
 ...repoint_allowed_domains_policy_changed.yml | 21 ++++++++++---------
 .../o365_sharepoint_malware_detection.yml     |  2 +-
 ...ntelligence_suspicious_email_delivered.yml |  2 +-
 ..._intelligence_suspicious_file_detected.yml |  2 +-
 .../cloud/o365_zap_activity_detection.yml     |  2 +-
 12 files changed, 34 insertions(+), 32 deletions(-)

diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml
index 0b08dda841..b41bb2c6c1 100644
--- a/detections/cloud/o365_dlp_rule_triggered.yml
+++ b/detections/cloud/o365_dlp_rule_triggered.yml
@@ -8,14 +8,15 @@ type: Anomaly
 description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain.
 data_source: 
 - O365 Universal Audit Log
-search: '`o365_management_activity` Operation=DLPRuleMatch
-| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
-| stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason
-| `o365_dlp_rule_triggered_filter`
-| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id
-| eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow")
-|`security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)`'
+search: >
+  `o365_management_activity` Operation=DLPRuleMatch
+  | eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
+  | stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason
+  | `o365_dlp_rule_triggered_filter`
+  | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id
+  | eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow")
+  |`security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions.
 known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.
 references:
@@ -23,7 +24,7 @@ references:
 tags:
   analytic_story: 
   - Data Exfiltration
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 50
   impact: 40
   message: User $src_user$ triggered a Microsoft Office DLP rule.
diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml
index 75c2b89d35..92f1ab9639 100644
--- a/detections/cloud/o365_email_access_by_security_administrator.yml
+++ b/detections/cloud/o365_email_access_by_security_administrator.yml
@@ -23,7 +23,7 @@ tags:
   - Data Exfiltration
   - Azure Active Directory Account Takeover
   - Office 365 Account Takeover
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 50
   impact: 50
   message: A security administrator $src_user$ accessed email messages for $user$
@@ -35,6 +35,7 @@ tags:
   - name: user
     type: User
     role:
+    - Victim
   - name: src_user
     type: User
     role:	
diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
index 488b75920a..8d12400350 100644
--- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
+++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
@@ -23,7 +23,7 @@ tags:
   analytic_story: 
   - Spearphishing Attachments
   - Suspicious Emails
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 50
   message: O365 security admin $o365_adminuser$ manually reported a suspicious email from $src_user$
diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml
index 857cbad1d3..1a8aca9532 100644
--- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml
+++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml
@@ -5,8 +5,7 @@ date: '2024-04-01'
 author: Steven Dick
 status: production
 type: TTP
-description: ⁠
-The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
+description: The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
 data_source: 
 - O365 Universal Audit Log
 search: '`o365_management_activity` Workload=SecurityComplianceCenter  Operation=AlertEntityGenerated Name="Email reported by user as*" 
@@ -28,7 +27,7 @@ tags:
   analytic_story: 
   - Spearphishing Attachments
   - Suspicious Emails
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 75
   message: The user $user$ reported an email classified as $result$ from $src_user$
diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml
index c104efb56c..7ab19a832f 100644
--- a/detections/cloud/o365_email_security_feature_changed.yml
+++ b/detections/cloud/o365_email_security_feature_changed.yml
@@ -1,4 +1,4 @@
-name: O365 Security Feature Changed
+name: O365 Email Security Feature Changed
 id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae
 version: 1
 date: '2024-04-01'
@@ -23,7 +23,7 @@ tags:
   analytic_story: 
   - Office 365 Persistence Mechanisms
   - Office 365 Account Takeover
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 25
   impact: 100
   message: An O365 security object [$object$] was altered by user $user$ using $signature$
diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml
index eb93d93be8..f2c61be3f5 100644
--- a/detections/cloud/o365_email_suspicious_behavior_alert.yml
+++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml
@@ -24,7 +24,7 @@ tags:
   - Suspicious Emails
   - Office 365 Collection Techniques
   - Office 365 Account Takeover
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 90
   message: The user $user$ triggered the O365 security alert [$signature$]
diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml
index 8b7a572ac2..02718f35b0 100644
--- a/detections/cloud/o365_safe_links_detection.yml
+++ b/detections/cloud/o365_safe_links_detection.yml
@@ -25,7 +25,7 @@ tags:
   analytic_story: 
   - Office 365 Account Takeover
   - Spearphishing Attachments
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 40
   message: $user$ triggered a Microsoft Safe Links detection.
diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
index 726b072f82..e150b2ab53 100644
--- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
+++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
@@ -8,15 +8,16 @@ type: TTP
 description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access.
 data_source: 
 - O365 Universal Audit Log
-search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList
-| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",")
-| stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name
-| eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null))
-| eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null))
-| eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted")
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`
-| `o365_sharepoint_allowed_domains_policy_changed_filter`'
+search: >
+  `o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList
+  | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",")
+  | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name
+  | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null))
+  | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null))
+  | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted")
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `o365_sharepoint_allowed_domains_policy_changed_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. 
 known_false_positives: Business approved changes by known administrators.
 references:
@@ -24,7 +25,7 @@ references:
 tags:
   analytic_story: 
   - Azure Active Directory Persistence
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 75
   message: The SharePoint Online domain allowlist was changed by $user$, $result$
diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml
index 2cccf222ae..740a738ff5 100644
--- a/detections/cloud/o365_sharepoint_malware_detection.yml
+++ b/detections/cloud/o365_sharepoint_malware_detection.yml
@@ -23,7 +23,7 @@ tags:
   - Azure Active Directory Persistence
   - Office 365 Account Takeover
   - Ransomware Cloud
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 75
   message: SharePoint detected a potentially malicious file $file_name$
diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
index 3b3fee2313..02ca94e31b 100644
--- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
+++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
@@ -23,7 +23,7 @@ tags:
   analytic_story: 
   - Spearphishing Attachments
   - Suspicious Emails
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 20
   message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature
diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
index 706ee24940..fbac1d3cc4 100644
--- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
+++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
@@ -24,7 +24,7 @@ tags:
   - Azure Active Directory Account Takeover
   - Office 365 Account Takeover
   - Ransomware Cloud
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 100
   impact: 50
   message: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$
diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml
index 5265457654..d3e775cbb4 100644
--- a/detections/cloud/o365_zap_activity_detection.yml
+++ b/detections/cloud/o365_zap_activity_detection.yml
@@ -24,7 +24,7 @@ tags:
   analytic_story: 
   - Spearphishing Attachments
   - Suspicious Emails
-  asset_type: Office 365
+  asset_type: O365 Tenant
   confidence: 50
   impact: 20
   message: User $user$ was included in a ZAP protection activity.