From a2bc2aa5df1ca2a157aad3bc3eef575e5f5bffc1 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 16 Dec 2020 14:25:18 +0000 Subject: [PATCH] Added detection testing service results inO365 Suspicious User Email Forwarding --- .../o365_suspicious_user_email_forwarding.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index df4965280d..09df22b713 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -2,15 +2,15 @@ name: O365 Suspicious User Email Forwarding id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 version: 1 date: '2020-12-16' -description: This search detects when multiple user configured a forwarding rule to the same destination. +description: This search detects when multiple user configured a forwarding rule to + the same destination. type: ESCU author: Patrick Bareiss, Splunk search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters - | rename Identity AS src_user | search ForwardingSmtpAddress=* - | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime - values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress - | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` - |`o365_suspicious_user_email_forwarding_filter`' + | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) + AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) + AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user + > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`' known_false_positives: unknown tags: analytics_story: @@ -26,3 +26,6 @@ tags: - DE.AE security_domain: threat asset_type: Office 365 + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json