mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Handful of updates to pass validation
This commit is contained in:
ljstella
@@ -8,14 +8,15 @@ type: Anomaly
|
||||
description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain.
|
||||
data_source:
|
||||
- O365 Universal Audit Log
|
||||
search: '`o365_management_activity` Operation=DLPRuleMatch
|
||||
| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
|
||||
| stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason
|
||||
| `o365_dlp_rule_triggered_filter`
|
||||
| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id
|
||||
| eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow")
|
||||
|`security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)`'
|
||||
search: >
|
||||
`o365_management_activity` Operation=DLPRuleMatch
|
||||
| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
|
||||
| stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason
|
||||
| `o365_dlp_rule_triggered_filter`
|
||||
| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id
|
||||
| eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow")
|
||||
|`security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)`
|
||||
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions.
|
||||
known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.
|
||||
references:
|
||||
@@ -23,7 +24,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Data Exfiltration
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 50
|
||||
impact: 40
|
||||
message: User $src_user$ triggered a Microsoft Office DLP rule.
|
||||
|
||||
@@ -23,7 +23,7 @@ tags:
|
||||
- Data Exfiltration
|
||||
- Azure Active Directory Account Takeover
|
||||
- Office 365 Account Takeover
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 50
|
||||
impact: 50
|
||||
message: A security administrator $src_user$ accessed email messages for $user$
|
||||
@@ -35,6 +35,7 @@ tags:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: src_user
|
||||
type: User
|
||||
role:
|
||||
|
||||
@@ -23,7 +23,7 @@ tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
- Suspicious Emails
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 50
|
||||
message: O365 security admin $o365_adminuser$ manually reported a suspicious email from $src_user$
|
||||
|
||||
@@ -5,8 +5,7 @@ date: '2024-04-01'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
description:
|
||||
The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
|
||||
description: The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
|
||||
data_source:
|
||||
- O365 Universal Audit Log
|
||||
search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="Email reported by user as*"
|
||||
@@ -28,7 +27,7 @@ tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
- Suspicious Emails
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 75
|
||||
message: The user $user$ reported an email classified as $result$ from $src_user$
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
name: O365 Security Feature Changed
|
||||
name: O365 Email Security Feature Changed
|
||||
id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae
|
||||
version: 1
|
||||
date: '2024-04-01'
|
||||
@@ -23,7 +23,7 @@ tags:
|
||||
analytic_story:
|
||||
- Office 365 Persistence Mechanisms
|
||||
- Office 365 Account Takeover
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 25
|
||||
impact: 100
|
||||
message: An O365 security object [$object$] was altered by user $user$ using $signature$
|
||||
|
||||
@@ -24,7 +24,7 @@ tags:
|
||||
- Suspicious Emails
|
||||
- Office 365 Collection Techniques
|
||||
- Office 365 Account Takeover
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 90
|
||||
message: The user $user$ triggered the O365 security alert [$signature$]
|
||||
|
||||
@@ -25,7 +25,7 @@ tags:
|
||||
analytic_story:
|
||||
- Office 365 Account Takeover
|
||||
- Spearphishing Attachments
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 40
|
||||
message: $user$ triggered a Microsoft Safe Links detection.
|
||||
|
||||
@@ -8,15 +8,16 @@ type: TTP
|
||||
description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access.
|
||||
data_source:
|
||||
- O365 Universal Audit Log
|
||||
search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList
|
||||
| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",")
|
||||
| stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name
|
||||
| eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null))
|
||||
| eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null))
|
||||
| eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted")
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `o365_sharepoint_allowed_domains_policy_changed_filter`'
|
||||
search: >
|
||||
`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList
|
||||
| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",")
|
||||
| stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name
|
||||
| eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null))
|
||||
| eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null))
|
||||
| eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted")
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `o365_sharepoint_allowed_domains_policy_changed_filter`
|
||||
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
|
||||
known_false_positives: Business approved changes by known administrators.
|
||||
references:
|
||||
@@ -24,7 +25,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Azure Active Directory Persistence
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 75
|
||||
message: The SharePoint Online domain allowlist was changed by $user$, $result$
|
||||
|
||||
@@ -23,7 +23,7 @@ tags:
|
||||
- Azure Active Directory Persistence
|
||||
- Office 365 Account Takeover
|
||||
- Ransomware Cloud
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 75
|
||||
message: SharePoint detected a potentially malicious file $file_name$
|
||||
|
||||
@@ -23,7 +23,7 @@ tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
- Suspicious Emails
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 20
|
||||
message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature
|
||||
|
||||
@@ -24,7 +24,7 @@ tags:
|
||||
- Azure Active Directory Account Takeover
|
||||
- Office 365 Account Takeover
|
||||
- Ransomware Cloud
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 100
|
||||
impact: 50
|
||||
message: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$
|
||||
|
||||
@@ -24,7 +24,7 @@ tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
- Suspicious Emails
|
||||
asset_type: Office 365
|
||||
asset_type: O365 Tenant
|
||||
confidence: 50
|
||||
impact: 20
|
||||
message: User $user$ was included in a ZAP protection activity.
|
||||
|
||||
Reference in New Issue
Block a user