From ab6d8cdfe10d4bbfd1fa84369e5b46e885ea8870 Mon Sep 17 00:00:00 2001
From: bpatel <bpatel@splunk.com>
Date: Wed, 13 Jan 2021 16:30:19 -0800
Subject: [PATCH] new detection file and test data

---
 .../cloud/o365_bypass_mfa_via_trusted_ip.yml  | 30 +++++++++++++++++++
 .../o365_bypass_mfa_via_trusted_ip.test.yml   | 12 ++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
 create mode 100644 tests/cloud/o365_bypass_mfa_via_trusted_ip.test.yml

diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
new file mode 100644
index 0000000000..9a4cdc963d
--- /dev/null
+++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
@@ -0,0 +1,30 @@
+author: Bhavin Patel, Splunk
+date: '2021-01-12'
+description: This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. 
+how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: c783dd98-c703-4252-9e8a-f19d9f5c949e
+known_false_positives: Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
+name: O365 Bypass MFA via Trusted IP
+references:
+- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
+- https://attack.mitre.org/techniques/T1562/007/
+search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
+| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
+| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
+| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0")
+| mvexpand ip_addresses_new_added
+| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
+|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)``
+  | `o365_bypass_mfa_via_trusted_ip_filter`'
+tags:
+  analytics_story:
+  - Office 365 Detections
+  asset_type: Office 365
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1562.007
+  security_domain: threat
+type: ESCU
+version: 1
diff --git a/tests/cloud/o365_bypass_mfa_via_trusted_ip.test.yml b/tests/cloud/o365_bypass_mfa_via_trusted_ip.test.yml
new file mode 100644
index 0000000000..43aa262bb4
--- /dev/null
+++ b/tests/cloud/o365_bypass_mfa_via_trusted_ip.test.yml
@@ -0,0 +1,12 @@
+name: O365 Bypass MFA via Trusted IP Unit Test
+tests:
+- name: O365 Bypass MFA via Trusted IP
+  file: cloud/o365_bypass_mfa_via_trusted_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: o365_bypass_mfa_via_trusted_ip.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_email_forwarding_rule.json
+    sourcetype: 'o365:management:activity'
+    source: 'o365'