From 0a2b30b5567cf8221d69a8f02c84d3bfc6e1cb61 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 20 Jul 2023 10:35:03 +0200 Subject: [PATCH 01/10] o365_fix_update --- detections/cloud/o365_excessive_sso_logon_errors.yml | 8 +++++--- detections/cloud/o365_new_federated_domain_added.yml | 8 ++++---- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index ea5b9d514e..a41c0a08c7 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -9,9 +9,11 @@ description: This search detects accounts with high number of Single Sign ON (SS logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired - | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress - UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed + | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId Operation Workload + | where count >= 5 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index d3a5f76e2e..1fb1aba195 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -7,10 +7,10 @@ status: production type: TTP description: This search detects the addition of a new Federated domain. data_source: [] -search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" - | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) - as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId - UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Operation IN("*add*", "*new*") AND Operation="*domain*" + | stats count by Workload Operation Target{}.ID Actor{}.ID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. From 2985bdbde897a4cc074b52e48b208e28aed43bc8 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 20 Jul 2023 10:51:51 +0200 Subject: [PATCH 02/10] Update o365_excessive_sso_logon_errors.yml --- detections/cloud/o365_excessive_sso_logon_errors.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index a41c0a08c7..ea854acb05 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -57,6 +57,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2.json sourcetype: o365:management:activity source: o365 From 81b1cb34b4ae06a315edc94e9e14ee4edaafc2d9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 20 Jul 2023 11:23:10 +0200 Subject: [PATCH 03/10] Update o365_new_federated_domain_added.yml --- detections/cloud/o365_new_federated_domain_added.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 1fb1aba195..0d725777df 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -63,7 +63,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/add_federated_domain.log sourcetype: o365:management:activity source: exchange update_timestamp: true From 3908bc58e40c4360b5d1eac31bb90fa826340a5f Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 21 Jul 2023 12:42:47 +0200 Subject: [PATCH 04/10] o365_fix_update --- detections/cloud/o365_added_service_principal.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 2b43eb0af1..2610ba5a27 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -8,11 +8,10 @@ type: TTP description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service - principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) - as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) - as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress - Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") + | stats count by src_user src_user_type action Operation authentication_service Workload + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -63,6 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.log sourcetype: o365:management:activity source: o365 From 55b7d4633a4a5cf50980b008869d74c7ec6f89d0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 25 Jul 2023 19:43:20 +0200 Subject: [PATCH 05/10] Update o365_new_federated_domain_added.yml --- detections/cloud/o365_new_federated_domain_added.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 0d725777df..4450019d5e 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -63,7 +63,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/add_federated_domain.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain.log sourcetype: o365:management:activity source: exchange update_timestamp: true From 3215e94a4d47e6989125e5a1208b246eb15a9dcc Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 25 Jul 2023 20:03:31 +0200 Subject: [PATCH 06/10] Update o365_added_service_principal.yml --- detections/cloud/o365_added_service_principal.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 2610ba5a27..a537bd69e7 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -62,6 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal.log sourcetype: o365:management:activity source: o365 From 2cbe875ade07af209514e3b701c1e2d8884b9f84 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 25 Jul 2023 20:14:50 +0200 Subject: [PATCH 07/10] Update o365_new_federated_domain_added.yml --- detections/cloud/o365_new_federated_domain_added.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 4450019d5e..2f015e3843 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -65,5 +65,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain.log sourcetype: o365:management:activity - source: exchange + source: o365 update_timestamp: true From 97241fca899fe1e47a63152d4e03c4180f53a79c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 2 Aug 2023 08:55:25 -0700 Subject: [PATCH 08/10] Update o365_added_service_principal.yml --- detections/cloud/o365_added_service_principal.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index a537bd69e7..4483ff8063 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,7 +1,7 @@ name: O365 Added Service Principal id: 1668812a-6047-11eb-ae93-0242ac130002 -version: 1 -date: '2022-02-03' +version: 2 +date: '2023-08-02' author: Rod Soto, Splunk status: production type: TTP From ebcbbd4261f0a72513ca81c3cc68c0b869550e1a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 2 Aug 2023 08:55:42 -0700 Subject: [PATCH 09/10] Update o365_excessive_sso_logon_errors.yml --- detections/cloud/o365_excessive_sso_logon_errors.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index ea854acb05..5f6519b72b 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -1,7 +1,7 @@ name: O365 Excessive SSO logon errors id: 8158ccc4-6038-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-26' +version: 2 +date: '2023-08-02' author: Rod Soto, Splunk status: production type: Anomaly From 6e983e5abe82d30c4431eb371f15c147044f28e1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 2 Aug 2023 08:56:14 -0700 Subject: [PATCH 10/10] Update o365_new_federated_domain_added.yml --- detections/cloud/o365_new_federated_domain_added.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 2f015e3843..2db5563348 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -1,7 +1,7 @@ name: O365 New Federated Domain Added id: e155876a-6048-11eb-ae93-0242ac130002 -version: 1 -date: '2021-01-26' +version: 2 +date: '2023-08-02' author: Rod Soto, Splunk status: production type: TTP