admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inO365 Bypass MFA via Trusted IP

Browse Source
This commit is contained in:
root
2021-01-14 02:45:18 +00:00
parent 20242b93e6
commit 050b89ebef
1 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+16 -8
View File
@@ -1,21 +1,26 @@
author: Bhavin Patel, Splunk
date: '2021-01-12'
description: This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
description: This search detects newly added IP addresses/CIDR blocks to the list
of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
to use this technique so that they can bypass the MFA system.
how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
id: c783dd98-c703-4252-9e8a-f19d9f66949e
known_false_positives: Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
known_false_positives: Unless it is a special case, it is uncommon to continually
update Trusted IPs to MFA configuration.
name: O365 Bypass MFA via Trusted IP
references:
- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
- https://attack.mitre.org/techniques/T1562/007/
search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0")
| mvexpand ip_addresses_new_added
| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`'
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand
ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old)
as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account
status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`o365_bypass_mfa_via_trusted_ip_filter`'
tags:
analytics_story:
- Office 365 Detections
@@ -25,5 +30,8 @@ tags:
mitre_attack_id:
- T1562.007
security_domain: threat
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip.json
type: ESCU
version: 1