From 673d5a002bbb6bb2ab815bffac029be693dcd574 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 24 Apr 2024 10:49:55 -0400 Subject: [PATCH] Update o365_external_guest_user_invited.yml Update for better ServicePrincipal GUID --- detections/cloud/o365_external_guest_user_invited.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml index 8aede148c9..f448f16236 100644 --- a/detections/cloud/o365_external_guest_user_invited.yml +++ b/detections/cloud/o365_external_guest_user_invited.yml @@ -9,7 +9,7 @@ description: The following analytic identifies the invitation of an external gue data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=AzureActiveDirectory AND Operation="Add user*" AND ModifiedProperties{}.NewValue="[*Guest*]" AND ModifiedProperties{}.NewValue="[*Invitation*]" -| eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',1),true(),mvindex('Actor{}.ID',0)) +| eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | rex field=user "(?[\\w\\.-]+@[\\w-]+\\.[\\w-]{2,4})" | stats values(user) as user, min(_time) as firstTime, max(_time) as lastTime, count by Operation,Id,src_user | rename Operation as signature, Id as signature_id