diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml new file mode 100644 index 0000000000..46d766126e --- /dev/null +++ b/data_sources/office_365_universal_audit_log.yml @@ -0,0 +1,16 @@ +name: Office 365 Universal Audit Log +id: 86369e87-5b0b-46fe-8b96-310473dffe7f +version: 1 +date: '2025-02-21' +author: Bhavin Patel, Splunk +description: Data source object for Office 365 Universal Audit Log +source: o365 +sourcetype: o365:management:activity +separator: Operation +supported_TA: +- name: Splunk Microsoft Office 365 Add-on + url: https://splunkbase.splunk.com/app/4055 + version: 4.7.0 +fields: +- _time +example_log: |- diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index 16fcaaf2ee..ca6d6a6742 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -12,7 +12,7 @@ description: The following analytic detects when Microsoft Office 365 Data Loss be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: "`o365_management_activity` Operation=DLPRuleMatch | eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index df598e1fa9..170bee94b6 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -10,7 +10,7 @@ description: The following analytic identifies when a user with sufficient acces Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess | stats values(Workload) as category, values(MailboxId) as user, values(Operation) as signature, count, min(_time) as firstTime, max(_time) as lastTime by InternetMessageId, diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index 405e008e80..e8e7cb7b7d 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -11,7 +11,7 @@ description: The following analytic detects when an email manually submitted to users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission | search RescanVerdict IN (Phish,Malware) | stats values(Subject) as subject, values(RescanVerdict) as result, values(SenderIP) as src, values(P2Sender) as sender, values(P1Sender) diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index 685ecb2198..529f31967e 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -11,7 +11,7 @@ description: The following analytic detects when an email submitted to Microsoft to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="Email reported by user as*" | fromjson Data | rename _raw AS temp etps AS _raw | extract pairdelim=";" kvdelim=":" | rename _raw AS etps temp AS _raw | search diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index 983ce4e11a..cd77051277 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -11,7 +11,7 @@ description: The following analytic identifies when specific O365 advanced secur detection. This can lead to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") | stats values(ObjectId) as object, min(_time) as firstTime, max(_time) as lastTime, count by diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index 5714addcec..0d86c3038e 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -12,7 +12,7 @@ description: The following analytic identifies when one of O365 the built-in sec Certain premium Office 365 capabilities further enhance these detection and response functions. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded") | diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml index 48f5edc84e..58889f87e8 100644 --- a/detections/cloud/o365_safe_links_detection.yml +++ b/detections/cloud/o365_safe_links_detection.yml @@ -9,7 +9,7 @@ description: The following analytic detects when any Microsoft Safe Links alerti is triggered. This behavior may indicate when user has interacted with a phishing or otherwise malicious link within the Microsoft Office ecosystem. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated | fromjson Data | stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId) as url values(od) as desc by AlertId,trc,Operation,Name,ot | rename Name as signature, diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 8cbdd85c92..486275d7aa 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -12,7 +12,7 @@ description: The following analytic identifies when the allowed domain settings should be monitored by security teams as they could potentially lead to unauthorized access. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: "`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged \"ModifiedProperties{}.Name\"=AllowDomainList | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index e3ec3d7abc..d3feb8ce95 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -11,7 +11,7 @@ description: The following analytic identifies when a malicious file is detected 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Operation=FileMalwareDetected | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml index 80ffe96469..27951e71b7 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -12,7 +12,7 @@ description: The following analytic identifies when a suspicious email is detect and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound | rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action | stats values(SenderIp) diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index f6313dcc2c..f6c7f7648b 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -12,7 +12,7 @@ description: The following analytic identifies when a malicious file is detected and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index daab34fb89..fd8a62339d 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -11,7 +11,7 @@ description: The following analytic detects when the Microsoft Zero-hour Automat content for user inboxes. Since this is a retroactive capability, there is still a window in which the user may fall victim to the malicious content. data_source: -- O365 Universal Audit Log +- Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*" | fromjson Data | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms)