admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-08-02 10:29:15 -07:00
committed by GitHub
parent 412e217edc 3400373779
commit bc70bbd460
3 changed files with 23 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_added_service_principal.yml
+7 -8
View File
@@ -1,18 +1,17 @@
name: O365 Added Service Principal
id: 1668812a-6047-11eb-ae93-0242ac130002
version: 1
date: '2022-02-03'
version: 2
date: '2023-08-02'
author: Rod Soto, Splunk
status: production
type: TTP
description: This search detects the creation of a new Federation setting by alerting
about an specific event related to its creation.
data_source: []
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service
principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created")
| stats count by src_user src_user_type action Operation authentication_service Workload
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_added_service_principal_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
@@ -63,6 +62,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal.log
sourcetype: o365:management:activity
source: o365
detections/cloud/o365_excessive_sso_logon_errors.yml
+8 -6
View File
@@ -1,7 +1,7 @@
name: O365 Excessive SSO logon errors
id: 8158ccc4-6038-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
version: 2
date: '2023-08-02'
author: Rod Soto, Splunk
status: production
type: Anomaly
@@ -9,9 +9,11 @@ description: This search detects accounts with high number of Single Sign ON (SS
logon errors. Excessive logon errors may indicate attempts to bruteforce of password
or single sign on token hijack or reuse.
data_source: []
search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired
| stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress
UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
| stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId Operation Workload
| where count >= 5
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_excessive_sso_logon_errors_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
@@ -55,6 +57,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2.json
sourcetype: o365:management:activity
source: o365
detections/cloud/o365_new_federated_domain_added.yml
+8 -8
View File
@@ -1,16 +1,16 @@
name: O365 New Federated Domain Added
id: e155876a-6048-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
version: 2
date: '2023-08-02'
author: Rod Soto, Splunk
status: production
type: TTP
description: This search detects the addition of a new Federated domain.
data_source: []
search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`o365_management_activity` Operation IN("*add*", "*new*") AND Operation="*domain*"
| stats count by Workload Operation Target{}.ID Actor{}.ID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_new_federated_domain_added_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity.
@@ -63,7 +63,7 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain.log
sourcetype: o365:management:activity
source: exchange
source: o365
update_timestamp: true