updating detection, adding new one. adding new stories

detections/cloud/high_number_of_login_failures_from_a_single_source.yml

@@ -5,22 +5,23 @@ date: '2020-12-16'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: This search will detect more than 5 login failures in Office365 Azure
-  Active Directory from a single source IP address. Please adjust the threshold value
-  of 5 as suited for your environment.
+description: This analytic detects multiple failed login attempts in Office365 Azure Active Directory from a single source IP address. Specifically, it identifies scenarios where there are more than 5 unsuccessful login attempts within a short time frame. The detection leverages Office365 management activity logs, specifically the AzureActiveDirectoryStsLogon records from the AzureActiveDirectory workload. It aggregates these logs in 5-minute intervals to count the number of failed login attempts and associates them with the originating source IP address. Multiple failed login attempts from a single source can be indicative of brute-force attacks, password spraying, or other malicious authentication attempts. Identifying and responding to these patterns promptly can prevent unauthorized access and potential breaches. If this detection represents a true positive, an attacker might be attempting to gain unauthorized access to an Office365 account. Successful compromise could lead to unauthorized access to sensitive data, potential lateral movement within the organization, or further malicious activities using the compromised account.
 data_source: []
 search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon 
   | bucket span=5m _time
   | stats dc(_raw) AS failed_attempts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip
   | where failed_attempts > 10
   | `high_number_of_login_failures_from_a_single_source_filter`'
-how_to_implement: ''
-known_false_positives: An Ip address with more than 20 failed authentication attempts
-  in the span of 5 minutes may also be triggered by a broken application.
-references: []
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Adjust the threshold value to suit the specific environment, as environments with naturally higher login failures might generate false positives at a lower threshold.
+known_false_positives: An Ip address with more than 10 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/001/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
+- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
 tags:
   analytic_story:
-  - Office 365 Detections
+  - O365 Identity Compromise Techniques
   asset_type: Office 365
   confidence: 50
   impact: 50

detections/cloud/o365_applicationimpersonation_role_assigned.yml

@@ -0,0 +1,50 @@
+name: O365 ApplicationImpersonation Role Assigned
+id: 49cdce75-f814-4d56-a7a4-c64ec3a481f2
+version: 1
+date: '2023-10-17'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: UPDATE_DESCRIPTION
+search: '`o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment"  Role=ApplicationImpersonation
+  | stats  max(_time) as lastTime by Operation, user, object, ObjectId, Role
+  | `security_content_ctime(lastTime)`
+  | `o365_applicationimpersonation_role_assigned_filter`'
+how_to_implement: UPDATE_HOW_TO_IMPLEMENT
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- https://attack.mitre.org/techniques/T1098/002/
+- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
+- https://www.mandiant.com/media/17656
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: Office 365 
+  atomic_guid:
+  - UPDATE atomic_guid
+  confidence: 70
+  impact: 80
+  message: UPDATE message
+  mitre_attack_id:
+  - T1098
+  - T1098.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 56
+  required_fields:
+  - UPDATE_required_fields
+  security_domain: audit
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/application_impersonation_role_assigned/application_impersonation_role_assigned.log
+    source: O365
+    sourcetype: o365:management:activity

detections/cloud/o365_high_number_of_failed_authentications_for_user.yml

@@ -19,7 +19,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/001/
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Identity Compromise Techniques
   asset_type: O365 tenant
   confidence: 70
   impact: 50

detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml

@@ -25,7 +25,7 @@ references:
 - REFERENCE
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Identity Compromise Techniques
   asset_type: UPDATE asset_type
   atomic_guid:
   - UPDATE atomic_guid

detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml

@@ -19,7 +19,7 @@ references:
 - https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Compromised Identity Abuse
   asset_type: Office 365 Tenant
   confidence: 70
   impact: 80

detections/cloud/o365_mailbox_read_access_granted_to_application.yml

@@ -35,7 +35,7 @@ references:
 - https://graphpermissions.merill.net/permission/Mail.Read
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Compromised Identity Abuse
   asset_type: Office 365 tenant
   confidence: 50
   impact: 90

detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml

@@ -21,7 +21,7 @@ references:
 - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Identity Compromise Techniques
   asset_type: Office 365 tenant
   atomic_guid:
   - UPDATE atomic_guid

detections/cloud/o365_user_consent_blocked_for_risky_application.yml

@@ -23,7 +23,7 @@ references:
 - REFERENCE
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Identity Compromise Techniques
   asset_type: O365 tenant
   atomic_guid:
   - UPDATE atomic_guid

detections/cloud/o365_user_consent_denied_for_oauth_application.yml

@@ -19,7 +19,7 @@ references:
 - REFERENCE
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - O365 Identity Compromise Techniques
   asset_type: O365 tenant
   confidence: 100
   impact: 30

stories/o365_compromised_identity_abuse.yml

@@ -0,0 +1,19 @@
+name: O365 Compromised Identity Abuse
+id: f2c72a90-e7ea-4819-91c7-8fc0f0faa940
+version: 1
+date: '2023-10-17'
+author: Mauricio Velazco, Splunk
+description: UPDATE_DESCRIPTION
+narrative: UPDATE_NARRATIVE
+references: []
+tags:
+  analytic_story: O365 Compromised Identity Abuse
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/o365_identity_compromise_techniques.yml

@@ -0,0 +1,19 @@
+name: O365 Identity Compromise Techniques
+id: 3d69980c-193b-4790-935c-5a9ef085dc60
+version: 1
+date: '2023-10-17'
+author: Mauricio Velazco, Splunk
+description: UPDATE_DESCRIPTION
+narrative: UPDATE_NARRATIVE
+references: []
+tags:
+  analytic_story: O365 Identity Compromise Techniques
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection