diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index 0b08dda841..b41bb2c6c1 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -8,14 +8,15 @@ type: Anomaly description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Operation=DLPRuleMatch -| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') -| stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason -| `o365_dlp_rule_triggered_filter` -| stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id -| eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow") -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)`' +search: > + `o365_management_activity` Operation=DLPRuleMatch + | eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') + | stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason + | `o365_dlp_rule_triggered_filter` + | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS * by src_user,signature_id + | eval action = CASE(match(result,"Halt"),"blocked",isnotnull(result),"alert",true(),"allow") + |`security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions. known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately. references: @@ -23,7 +24,7 @@ references: tags: analytic_story: - Data Exfiltration - asset_type: Office 365 + asset_type: O365 Tenant confidence: 50 impact: 40 message: User $src_user$ triggered a Microsoft Office DLP rule. diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index 75c2b89d35..92f1ab9639 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -23,7 +23,7 @@ tags: - Data Exfiltration - Azure Active Directory Account Takeover - Office 365 Account Takeover - asset_type: Office 365 + asset_type: O365 Tenant confidence: 50 impact: 50 message: A security administrator $src_user$ accessed email messages for $user$ @@ -35,6 +35,7 @@ tags: - name: user type: User role: + - Victim - name: src_user type: User role: diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index 488b75920a..8d12400350 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -23,7 +23,7 @@ tags: analytic_story: - Spearphishing Attachments - Suspicious Emails - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 50 message: O365 security admin $o365_adminuser$ manually reported a suspicious email from $src_user$ diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index 857cbad1d3..1a8aca9532 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -5,8 +5,7 @@ date: '2024-04-01' author: Steven Dick status: production type: TTP -description: ⁠ -The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission. +description: The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission. data_source: - O365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="Email reported by user as*" @@ -28,7 +27,7 @@ tags: analytic_story: - Spearphishing Attachments - Suspicious Emails - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 75 message: The user $user$ reported an email classified as $result$ from $src_user$ diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index c104efb56c..7ab19a832f 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -1,4 +1,4 @@ -name: O365 Security Feature Changed +name: O365 Email Security Feature Changed id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae version: 1 date: '2024-04-01' @@ -23,7 +23,7 @@ tags: analytic_story: - Office 365 Persistence Mechanisms - Office 365 Account Takeover - asset_type: Office 365 + asset_type: O365 Tenant confidence: 25 impact: 100 message: An O365 security object [$object$] was altered by user $user$ using $signature$ diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index eb93d93be8..f2c61be3f5 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -24,7 +24,7 @@ tags: - Suspicious Emails - Office 365 Collection Techniques - Office 365 Account Takeover - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 90 message: The user $user$ triggered the O365 security alert [$signature$] diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml index 8b7a572ac2..02718f35b0 100644 --- a/detections/cloud/o365_safe_links_detection.yml +++ b/detections/cloud/o365_safe_links_detection.yml @@ -25,7 +25,7 @@ tags: analytic_story: - Office 365 Account Takeover - Spearphishing Attachments - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 40 message: $user$ triggered a Microsoft Safe Links detection. diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 726b072f82..e150b2ab53 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -8,15 +8,16 @@ type: TTP description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList -| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",") -| stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name -| eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) -| eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) -| eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `o365_sharepoint_allowed_domains_policy_changed_filter`' +search: > + `o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList + | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",") + | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name + | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) + | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) + | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_sharepoint_allowed_domains_policy_changed_filter` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Business approved changes by known administrators. references: @@ -24,7 +25,7 @@ references: tags: analytic_story: - Azure Active Directory Persistence - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 75 message: The SharePoint Online domain allowlist was changed by $user$, $result$ diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index 2cccf222ae..740a738ff5 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -23,7 +23,7 @@ tags: - Azure Active Directory Persistence - Office 365 Account Takeover - Ransomware Cloud - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 75 message: SharePoint detected a potentially malicious file $file_name$ diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml index 3b3fee2313..02ca94e31b 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -23,7 +23,7 @@ tags: analytic_story: - Spearphishing Attachments - Suspicious Emails - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 20 message: A suspicious email was delivered to $user$ by $src_user$ matching the $signature$ signature diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index 706ee24940..fbac1d3cc4 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -24,7 +24,7 @@ tags: - Azure Active Directory Account Takeover - Office 365 Account Takeover - Ransomware Cloud - asset_type: Office 365 + asset_type: O365 Tenant confidence: 100 impact: 50 message: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$ diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index 5265457654..d3e775cbb4 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -24,7 +24,7 @@ tags: analytic_story: - Spearphishing Attachments - Suspicious Emails - asset_type: Office 365 + asset_type: O365 Tenant confidence: 50 impact: 20 message: User $user$ was included in a ZAP protection activity.