admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update o365_sharepoint_suspicious_search_behavior.yml

Browse Source
This commit is contained in:
Steven Dick
2025-01-08 15:39:12 -05:00
committed by GitHub
parent fd1b9e87d9
commit 0adf977246
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_sharepoint_suspicious_search_behavior.yml
+1 -1
View File
@@ -10,7 +10,7 @@ data_source:
- Office 365 Universal Audit Log
search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search*
| where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)"))
| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='EventData', command = SearchQueryText, -time = _time
| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=EventData, command = SearchQueryText, -time = _time
| bin _time span=1hr
| stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time
| where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing")