admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inO365 Suspicious User Email Forwarding

Browse Source
This commit is contained in:
root
2020-12-16 14:25:18 +00:00
parent 5f929693fd
commit a2bc2aa5df
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_suspicious_user_email_forwarding.yml
+9 -6
View File
@@ -2,15 +2,15 @@ name: O365 Suspicious User Email Forwarding
id: f8dfe015-dbb3-4569-ba75-b13787e06aa4
version: 1
date: '2020-12-16'
description: This search detects when multiple user configured a forwarding rule to the same destination.
description: This search detects when multiple user configured a forwarding rule to
the same destination.
type: ESCU
author: Patrick Bareiss, Splunk
search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters
| rename Identity AS src_user | search ForwardingSmtpAddress=*
| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime
values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress
| where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
|`o365_suspicious_user_email_forwarding_filter`'
| rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user)
AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user)
AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user
> 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`'
known_false_positives: unknown
tags:
analytics_story:
@@ -26,3 +26,6 @@ tags:
- DE.AE
security_domain: threat
asset_type: Office 365
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json