From 758d733c06472abe9d004bad6dab2175f881632e Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 11 Feb 2025 15:29:48 +0100 Subject: [PATCH 01/29] o365 detections output normalization --- data_sources/o365.yml | 7 ++++ ...add_app_role_assignment_grant_to_user_.yml | 7 ++++ ..._role_assignment_to_service_principal_.yml | 7 ++++ data_sources/o365_add_mailboxpermission.yml | 7 ++++ data_sources/o365_add_member_to_role_.yml | 7 ++++ .../o365_add_owner_to_application_.yml | 7 ++++ data_sources/o365_add_service_principal_.yml | 7 ++++ data_sources/o365_change_user_license_.yml | 7 ++++ data_sources/o365_consent_to_application_.yml | 7 ++++ .../o365_disable_strong_authentication_.yml | 7 ++++ data_sources/o365_mailitemsaccessed.yml | 7 ++++ data_sources/o365_modifyfolderpermissions.yml | 7 ++++ .../o365_set_company_information_.yml | 7 ++++ data_sources/o365_set_mailbox.yml | 7 ++++ data_sources/o365_update_application_.yml | 7 ++++ .../o365_update_authorization_policy_.yml | 7 ++++ data_sources/o365_update_user_.yml | 7 ++++ data_sources/o365_userloggedin.yml | 7 ++++ data_sources/o365_userloginfailed.yml | 7 ++++ ...365_add_app_role_assignment_grant_user.yml | 13 +++--- .../cloud/o365_added_service_principal.yml | 24 ++++++----- ..._consent_bypassed_by_service_principal.yml | 27 ++++++++----- .../cloud/o365_advanced_audit_disabled.yml | 22 ++++++---- ...application_available_to_other_tenants.yml | 21 +++++----- ...5_application_registration_owner_added.yml | 14 ++++--- ...applicationimpersonation_role_assigned.yml | 10 +++-- ...k_user_consent_for_risky_apps_disabled.yml | 17 ++++---- .../cloud/o365_bypass_mfa_via_trusted_ip.yml | 37 ++++++++--------- ...365_compliance_content_search_exported.yml | 12 ++++-- ...o365_compliance_content_search_started.yml | 12 ++++-- ...concurrent_sessions_from_different_ips.yml | 16 ++++---- .../cloud/o365_cross_tenant_access_change.yml | 20 +++++----- detections/cloud/o365_disable_mfa.yml | 12 +++--- detections/cloud/o365_dlp_rule_triggered.yml | 40 +++++++++---------- ...5_elevated_mailbox_permission_assigned.yml | 13 +++--- ...email_access_by_security_administrator.yml | 13 +++--- ...mail_reported_by_admin_found_malicious.yml | 17 ++++---- ...email_reported_by_user_found_malicious.yml | 26 +++++++----- .../o365_email_security_feature_changed.yml | 12 +++--- .../o365_email_suspicious_behavior_alert.yml | 14 ++++--- ...xcessive_authentication_failures_alert.yml | 16 ++++---- .../cloud/o365_excessive_sso_logon_errors.yml | 14 ++++--- .../o365_external_guest_user_invited.yml | 23 ++++++----- .../o365_external_identity_policy_changed.yml | 40 ++++++++++--------- ...ed_application_consent_granted_by_user.yml | 19 +++++---- ...65_fullaccessasapp_permission_assigned.yml | 17 ++++---- ...ber_of_failed_authentications_for_user.yml | 12 ++++-- .../o365_high_privilege_role_granted.yml | 16 +++++--- ...ed_application_consent_granted_by_user.yml | 18 +++++---- .../o365_mailbox_email_forwarding_enabled.yml | 16 +++++--- ...ailbox_folder_read_permission_assigned.yml | 12 +++--- ...mailbox_folder_read_permission_granted.yml | 16 +++++--- ...box_inbox_folder_shared_with_all_users.yml | 15 ++++--- ...box_read_access_granted_to_application.yml | 18 ++++++--- ...ti_source_failed_authentications_spike.yml | 16 +++++--- ...ds_and_useragents_authentication_spike.yml | 13 +++--- ..._multiple_failed_mfa_requests_for_user.yml | 9 +++-- ...65_multiple_mailboxes_accessed_via_api.yml | 15 ++++--- ...le_os_vendors_authenticating_from_user.yml | 16 ++++---- ...tiple_service_principals_created_by_sp.yml | 18 ++++++--- ...ple_service_principals_created_by_user.yml | 16 +++++--- ..._users_failing_to_authenticate_from_ip.yml | 15 ++++--- ...o365_new_email_forwarding_rule_created.yml | 19 +++++---- ...o365_new_email_forwarding_rule_enabled.yml | 29 +++++++++----- .../cloud/o365_new_federated_domain_added.yml | 12 ++++-- ...5_new_forwarding_mailflow_rule_created.yml | 22 ++++++---- .../cloud/o365_new_mfa_method_registered.yml | 26 +++++++----- .../o365_oauth_app_mailbox_access_via_ews.yml | 13 +++--- ...oauth_app_mailbox_access_via_graph_api.yml | 10 +++-- ...ivileged_graph_api_permission_assigned.yml | 18 +++++---- .../cloud/o365_privileged_role_assigned.yml | 22 +++++----- ...ged_role_assigned_to_service_principal.yml | 22 +++++----- detections/cloud/o365_pst_export_alert.yml | 25 +++++++----- .../cloud/o365_safe_links_detection.yml | 19 ++++----- ...ecurity_and_compliance_alert_triggered.yml | 22 ++++++---- ...rvice_principal_new_client_credentials.yml | 11 +++-- ...service_principal_privilege_escalation.yml | 19 +++++---- ...repoint_allowed_domains_policy_changed.yml | 22 +++++----- .../o365_sharepoint_malware_detection.yml | 11 ++--- ...o365_tenant_wide_admin_consent_granted.yml | 17 +++++--- ...ntelligence_suspicious_email_delivered.yml | 14 +++---- ..._intelligence_suspicious_file_detected.yml | 15 ++++--- ..._consent_blocked_for_risky_application.yml | 14 ++++--- .../cloud/o365_zap_activity_detection.yml | 17 ++++---- 84 files changed, 808 insertions(+), 486 deletions(-) diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 8102ea7c9f..6ff163b465 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -11,3 +11,10 @@ supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 version: 4.7.0 +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 89ececa0d0..a990da31eb 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -106,3 +106,10 @@ example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, { "Type": 4}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 365604ba84..c032e74a26 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -111,3 +111,10 @@ example_log: '{"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1- "Type": 2}, {"ID": "Office 365 Exchange Online", "Type": 1}, {"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index c4869abc7a..062ec0c7b3 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -81,3 +81,10 @@ example_log: '{"AppId": "", "ClientAppId": "", "ClientIP": "18.159.234.121:30395 {"Name": "InheritanceType", "Value": "All"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "2be46662-a743-4a05-8744-c2f75f886512", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index c2403e0b25..2b970c4884 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -104,3 +104,10 @@ example_log: '{"CreationTime": "2023-10-20T16:50:46", "Id": "30a8b107-b190-406c- "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "lowpriv@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index fdeccc791b..e9c031ee3e 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -105,3 +105,10 @@ example_log: '{"CreationTime": "2023-09-07T13:42:04", "Id": "6e2c723b-8f6e-47f4- "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "user2@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index ae338dcc71..57dc6dab0f 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -114,3 +114,10 @@ example_log: '{"CreationTime": "2024-02-07T22:31:14", "Id": "f624ed92-b4a2-4d42- "Type": 2}, {"ID": "Malicious11", "Type": 1}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 2}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 17222c9261..cf0b01d560 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -98,3 +98,10 @@ example_log: '{"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494- "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index 4b96c68d96..7a7d345fea 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -105,3 +105,10 @@ example_log: '{"CreationTime": "2023-09-05T21:05:31", "Id": "5822e126-1fbc-4269- "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 4}], "TargetContextId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 53f37fa0ab..d3a66879b3 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -97,3 +97,10 @@ example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, { "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index d2bad265dc..672cafb1fd 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -92,3 +92,10 @@ example_log: '{"CreationTime": "2024-02-01T16:07:34", "Id": "9cef02e9-4bfa-4c73- "SizeInBytes": 44572}, {"InternetMessageId": "", "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 4}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index bf6d9f1855..75ec901b67 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -106,3 +106,10 @@ example_log: '{"CreationTime": "2023-09-07T18:19:07", "Id": "ff065c17-e638-4013- "ParentFolder": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index d40cca2fcb..fbdf92312e 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -113,3 +113,10 @@ example_log: '{"Actor": [{"ID": "bpatel@rodsoto.onmicrosoft.com", "Type": 5}, {" Services LLC", "Type": 1}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "bpatel@rodsoto.onmicrosoft.com", "UserKey": "100320010208B5DC@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 30ebad4b33..a0f4a31c6d 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -90,3 +90,10 @@ example_log: '{"AppId": "", "ClientAppId": "", "ClientIP": "18.192.200.190:52816 "Identity", "Value": "bpatel@rodsoto.onmicrosoft.com"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "86a7cd7c-3f42-4b68-b670-4024b5461a80", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index f78faf1948..093bcf36b8 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -114,3 +114,10 @@ example_log: '{"CreationTime": "2023-09-01T17:16:20", "Id": "c428c85c-4fa0-4e97- {"ID": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "Application", "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}], "TargetContextId": "58aee3b9-7433-46a0-b54e-2429487992a0"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index b53bce2417..e238a609c9 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -97,3 +97,10 @@ example_log: '{"CreationTime": "2023-10-26T19:22:20", "Id": "83774e72-313f-4d1f- "Target": [{"ID": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "Other", "Type": 2}, {"ID": "Authorization Policy", "Type": 1}], "TargetContextId": "a417c578-c7ee-480d-a225-d48057e74df5"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 5497544e68..b9655ba734 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -111,3 +111,10 @@ example_log: '{"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595- "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 540450b496..180688980b 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -101,3 +101,10 @@ example_log: '{"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b- "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index b03d5032ae..3ed4e9abb9 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -111,3 +111,10 @@ example_log: '{"CreationTime": "2023-10-10T17:08:65", "Id": "4593aac8-855f-4341- "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Chrome"}, {"Name": "IsCompliantAndManaged", "Value": "False"}], "ErrorNumber": "50126", "LogonError": "InvalidUserNameOrPassword"}' +output_fields: +- action +- dest +- user +- src +- vendor_account +- vendor_product \ No newline at end of file diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 40dbc0137d..02c07d040a 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -14,11 +14,11 @@ description: The following analytic detects the addition of an application role access to critical resources and data within the Office 365 environment. data_source: - O365 Add app role assignment grant to user. -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app - role assignment grant to user." | stats count min(_time) as firstTime max(_time) - as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type values(ModifiedProperties{}.Name) - as modified_properties_name by user dest ResultStatus Operation | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: The creation of a new Federation is not necessarily malicious, @@ -42,8 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ has created a new federation setting $modified_properties_name$ - on $dest$ + message: User $user$ added a new app role assignment risk_objects: - field: user type: user diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 239d6317b9..f47fc46edb 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -15,11 +15,13 @@ description: The following analytic detects the addition of new service principa leading to data breaches or further compromise. data_source: - O365 -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add - service principal*" OR (Operation = "*principal*" AND action = "created") | stats - count values(ModifiedProperties{}.NewValue) as new_value by src_user src_user_type - action Operation authentication_service Workload | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_added_service_principal_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: The creation of a new Federation is not necessarily malicious, @@ -31,12 +33,12 @@ references: - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack?hsLang=en drilldown_searches: -- name: View the detection results for - "$src_user$" - search: '%original_detection_search% | search src_user = "$src_user$"' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src_user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -45,9 +47,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $src_user$ has created new service principal $new_value$ in AzureActiveDirectory + message: User $user$ has created new service principal in AzureActiveDirectory risk_objects: - - field: src_user + - field: user type: user score: 42 threat_objects: [] diff --git a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml index 5ab812b900..0c546a2016 100644 --- a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml +++ b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml @@ -15,15 +15,21 @@ description: The following analytic identifies instances where a service princip leading to unauthorized access or privilege escalation. If confirmed malicious, this could allow an attacker to misuse automated processes to assign sensitive permissions, compromising the security of the environment. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add - app role assignment to service principal.\" | eval len=mvcount('Actor{}.ID') | eval - userType = mvindex('Actor{}.ID',len-1) | eval roleId = mvindex('ModifiedProperties{}.NewValue', - 0) | eval roleValue = mvindex('ModifiedProperties{}.NewValue', 1) | eval roleDescription - = mvindex('ModifiedProperties{}.NewValue', 2) | eval dest_user = mvindex('Target{}.ID', - 0) | search userType = \"ServicePrincipal\" | eval src_user = user | stats count - earliest(_time) as firstTime latest(_time) as lastTime by src_user dest_user roleId - roleValue roleDescription | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ - \ | `o365_admin_consent_bypassed_by_service_principal_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add app role assignment to service principal.\" + | eval len=mvcount('Actor{}.ID') + | eval userType = mvindex('Actor{}.ID',len-1) + | eval roleId = mvindex('ModifiedProperties{}.NewValue', 0) + | eval roleValue = mvindex('ModifiedProperties{}.NewValue', 1) + | eval roleDescription = mvindex('ModifiedProperties{}.NewValue', 2) + | eval dest_user = mvindex('Target{}.ID', 0) + | search userType = \"ServicePrincipal\" + | eval src_user = user + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product dest_user roleId roleValue roleDescription + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_admin_consent_bypassed_by_service_principal_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Service Principals are sometimes configured to legitimately @@ -50,8 +56,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Service principal $src_user$ bypassed the admin consent process and granted - permissions to $dest_user$ + message: Service principal $user$ bypassed the admin consent process and granted permissions to $dest_user$ risk_objects: - field: dest_user type: user diff --git a/detections/cloud/o365_advanced_audit_disabled.yml b/detections/cloud/o365_advanced_audit_disabled.yml index fde6c3a0f8..2be872134c 100644 --- a/detections/cloud/o365_advanced_audit_disabled.yml +++ b/detections/cloud/o365_advanced_audit_disabled.yml @@ -15,14 +15,20 @@ description: The following analytic detects instances where the O365 advanced au it can blind security teams to potential malicious actions. If confirmed malicious, attackers could operate within the user's mailbox or account with reduced risk of detection, leading to unauthorized data access, data exfiltration, or account compromise. -search: "`o365_management_activity` Operation=\"Change user license.\" | eval property_name - = mvindex ('ExtendedProperties{}.Name', 1) | search property_name = \"extendedAuditEventCategory\"\ - \ | eval additionalDetails = mvindex('ExtendedProperties{}.Value',0) | eval split_value=split(additionalDetails, - \"NewValue\") | eval possible_plan=mvindex(split_value, 1) | rex field=\"possible_plan\"\ - \ \"DisabledPlans=\\[(?P[^\\]]+)\\]\" | search DisabledPlans IN (\"\ - *M365_ADVANCED_AUDITING*\") | stats min(_time) as firstTime max(_time) as lastTime - by Operation user object DisabledPlans | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `o365_advanced_audit_disabled_filter`" +search: "`o365_management_activity` Operation=\"Change user license.\" + | eval property_name = mvindex ('ExtendedProperties{}.Name', 1) + | search property_name = \"extendedAuditEventCategory\" + | eval additionalDetails = mvindex('ExtendedProperties{}.Value',0) + | eval split_value=split(additionalDetails,\"NewValue\") + | eval possible_plan=mvindex(split_value, 1) + | rex field=\"possible_plan\" \"DisabledPlans=\\[(?P[^\\]]+)\\]\" + | search DisabledPlans IN (\"*M365_ADVANCED_AUDITING*\") + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product DisabledPlans object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_advanced_audit_disabled_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators might temporarily disable the advanced audit diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml index 0ecc7bab04..114e4e93c8 100644 --- a/detections/cloud/o365_application_available_to_other_tenants.yml +++ b/detections/cloud/o365_application_available_to_other_tenants.yml @@ -12,16 +12,19 @@ description: The following analytic identifies the configuration of Azure Active the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"\ - Add application.\",\"Update application.\") ModifiedProperties{}.Name=AvailableToOtherTenants +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add application.\",\"Update application.\") ModifiedProperties{}.Name=AvailableToOtherTenants | eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',\"\ - AvailableToOtherTenants\")),\"false\"),\"removed\",true(),\"added\"), object_name=mvindex('Target{}.ID', - 3), signature=Operation, object_attrs = \"AvailableToOtherTenants\", user = case(match(mvindex('Actor{}.ID',-1),\"\ - User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"\ - ),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | search result = \"added\"\ - \ | stats values(ActorIpAddress) as src, count, min(_time) as firstTime, max(_time) - as lastTime by signature, user, object, object_name, object_attrs, result | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | `o365_application_available_to_other_tenants_filter`" + AvailableToOtherTenants\")),\"false\"),\"removed\",true(),\"added\"), object_name=mvindex('Target{}.ID', + 3), signature=Operation, object_attrs = \"AvailableToOtherTenants\", user = case(match(mvindex('Actor{}.ID',-1),\"\ + User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"\ + ),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) + | search result = \"added\" + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product object_attrs object_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_application_available_to_other_tenants_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Business approved changes by known administrators. diff --git a/detections/cloud/o365_application_registration_owner_added.yml b/detections/cloud/o365_application_registration_owner_added.yml index 2dc6d1d411..462519c933 100644 --- a/detections/cloud/o365_application_registration_owner_added.yml +++ b/detections/cloud/o365_application_registration_owner_added.yml @@ -16,11 +16,15 @@ description: The following analytic identifies instances where a new owner is as an attacker could modify the application's settings, permissions, and behavior, leading to unauthorized data access, privilege escalation, or the introduction of malicious behavior within the application's operations. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add - owner to application.\" | eval app_id=mvindex('ModifiedProperties{}.NewValue', 0) - | eval app_displayName=mvindex('ModifiedProperties{}.NewValue', 1) | stats max(_time) - as lastTime values(ModifiedProperties{}.NewValue) by Operation, user, app_displayName, - object | `security_content_ctime(lastTime)` | `o365_application_registration_owner_added_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add owner to application.\" + | eval app_id=mvindex('ModifiedProperties{}.NewValue', 0) + | eval app_displayName=mvindex('ModifiedProperties{}.NewValue', 1) + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product app_id app_displayName object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_application_registration_owner_added_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Application owners may be added for legitimate reasons, filter diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml index 777f8755aa..5da7cc8ae6 100644 --- a/detections/cloud/o365_applicationimpersonation_role_assigned.yml +++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml @@ -15,9 +15,13 @@ description: The following analytic detects the assignment of the ApplicationImp malicious, an attacker could gain unauthorized access to sensitive information, manipulate mailbox data, and perform actions as a legitimate user, posing a severe security risk to the organization. -search: '`o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment" Role=ApplicationImpersonation - | rename User as target_user | stats max(_time) as lastTime by Operation, user, - object, ObjectId, Role, target_user | `security_content_ctime(lastTime)` | `o365_applicationimpersonation_role_assigned_filter`' +search: '`o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment" Role=ApplicationImpersonation + | rename User as target_user + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product target_user + | `security_content_ctime(lastTime)` + | `o365_applicationimpersonation_role_assigned_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: While infrequent, the ApplicationImpersonation role may be diff --git a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml index 2adc72537f..f6df6bed31 100644 --- a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml +++ b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml @@ -15,13 +15,16 @@ description: The following analytic detects when the "risk-based step-up consent to grant consent to malicious applications. If confirmed malicious, attackers could gain unauthorized access to user data and sensitive information, leading to data breaches and further compromise within the organization. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update - authorization policy.\" | eval index_number = if(mvfind('ModifiedProperties{}.Name', - \"AllowUserConsentForRiskyApps\") >= 0, mvfind('ModifiedProperties{}.Name', \"AllowUserConsentForRiskyApps\"\ - ), -1) | search index_number >= 0 | eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number) - | where AllowUserConsentForRiskyApps like \"%true%\" | stats count min(_time) as - firstTime max(_time) as lastTime by user, Operation, AllowUserConsentForRiskyApps, - user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update authorization policy.\" + | eval index_number = if(mvfind('ModifiedProperties{}.Name',\"AllowUserConsentForRiskyApps\") >= 0, mvfind('ModifiedProperties{}.Name',\"AllowUserConsentForRiskyApps\"), -1) + | search index_number >= 0 + | eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number) + | where AllowUserConsentForRiskyApps like \"%true%\" + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product AllowUserConsentForRiskyApps + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_block_user_consent_for_risky_apps_disabled_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 6ad687a266..174d42934f 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -16,15 +16,18 @@ description: The following analytic identifies instances where new IP addresses of the IP addition. data_source: - O365 Set Company Information. -search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy - | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" - | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" - | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand - ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) - |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) - as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account - status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `o365_bypass_mfa_via_trusted_ip_filter`' +search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy + | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" + | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" + | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") + | mvexpand ip_addresses_new_added + | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by action dest user src vendor_account vendor_product ip_addresses_new_added + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_bypass_mfa_via_trusted_ip_filter`' how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: Unless it is a special case, it is uncommon to continually @@ -34,12 +37,12 @@ references: - https://attack.mitre.org/techniques/T1562/007/ - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings drilldown_searches: -- name: View the detection results for - "$user_id$" - search: '%original_detection_search% | search user_id = "$user_id$"' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user_id$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$") +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -48,15 +51,13 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a + message: User $user$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA risk_objects: - - field: user_id + - field: user type: user score: 42 - threat_objects: - - field: ip_addresses_new_added - type: ip_address + threat_objects: [] tags: analytic_story: - Office 365 Persistence Mechanisms diff --git a/detections/cloud/o365_compliance_content_search_exported.yml b/detections/cloud/o365_compliance_content_search_exported.yml index 74ff0f6355..90b73d3a33 100644 --- a/detections/cloud/o365_compliance_content_search_exported.yml +++ b/detections/cloud/o365_compliance_content_search_exported.yml @@ -14,10 +14,14 @@ description: The following analytic identifies when the results of a content sea If confirmed malicious, an attacker could gain access to and exfiltrate sensitive information, posing a severe risk to the organization's data security and compliance posture. -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation="SearchExported" - | rename user_id as user | stats count earliest(_time) as firstTime latest(_time) - as lastTime by Operation, ObjectId, ExchangeLocations, user, Query |`security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `o365_compliance_content_search_exported_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation="SearchExported" + | rename user_id as user + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product ExchangeLocations Query + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_compliance_content_search_exported_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Compliance content searche exports may be executed for legitimate diff --git a/detections/cloud/o365_compliance_content_search_started.yml b/detections/cloud/o365_compliance_content_search_started.yml index 2b4440c1d1..13e7a1ef54 100644 --- a/detections/cloud/o365_compliance_content_search_started.yml +++ b/detections/cloud/o365_compliance_content_search_started.yml @@ -14,10 +14,14 @@ description: The following analytic detects when a content search is initiated w unauthorized data access, potential data exfiltration, and compliance violations. Monitoring this behavior helps ensure the integrity and security of organizational data. -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated - | rename user_id as user | stats count earliest(_time) as firstTime latest(_time) - as lastTime by Operation, ObjectId, ExchangeLocations, user, Query |`security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `o365_compliance_content_search_started_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated + | rename user_id as user + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product ExchangeLocations Query + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_compliance_content_search_started_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Compliance content searches may be executed for legitimate diff --git a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml index ba6d73effc..590b5faf7a 100644 --- a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml @@ -15,10 +15,14 @@ description: The following analytic identifies user sessions in Office 365 acces posing severe risks to organizational security. data_source: - O365 UserLoggedIn -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn - | stats min(_time) as firstTime max(_time) as lastTime values(src_ip) as ips values(user_agent) - as user_agents by Operation, user, SessionId | where mvcount(ips) > 1 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_concurrent_sessions_from_different_ips_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(src) as src by action dest user vendor_account vendor_product + | where mvcount(src) > 1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_concurrent_sessions_from_different_ips_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: Unknown @@ -47,9 +51,7 @@ rba: - field: user type: user score: 42 - threat_objects: - - field: ips - type: ip_address + threat_objects: [] tags: analytic_story: - Office 365 Account Takeover diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml index 5b893b95eb..4587e7a9d4 100644 --- a/detections/cloud/o365_cross_tenant_access_change.yml +++ b/detections/cloud/o365_cross_tenant_access_change.yml @@ -13,13 +13,16 @@ description: The following analytic identifies when cross-tenant access/synchron data_source: - Office 365 Universal Audit Log search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"\ - Add a partner to cross-tenant access setting.\",\"Delete partner specific cross-tenant - access setting.\") | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ - ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | stats - values(Workload) as category, values(ClientIP) as src, values(ModifiedProperties{}.Name) - as object_name, values(ModifiedProperties{}.NewValue) as object_attrs, count, min(_time) - as firstTime, max(_time) as lastTime by Id,user,Operation | rename Operation as - signature, Id as signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Add a partner to cross-tenant access setting.\",\"Delete partner specific cross-tenant + access setting.\") + | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ + ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) + | rename Operation as signature, Id as signature_id + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. @@ -44,8 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The user [$user$] changed the Azure cross-tenant access settings for $object_name$ - $object_attrs$ [$signature$] + message: The user [$user$] changed the Azure cross-tenant access settings risk_objects: - field: user type: user diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 94f658103a..521a84d8c4 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -16,11 +16,13 @@ description: The following analytic identifies instances where Multi-Factor Auth related to the affected account. data_source: - O365 Disable Strong Authentication. -search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats - count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation - UserId ResultStatus object | rename UserType AS user_type, Operation AS action, - UserId AS src_user, object AS user, ResultStatus AS result | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_disable_mfa_filter`' +search: '`o365_management_activity` Operation="Disable Strong Authentication." + | rename command as action UserId as user object as src_user + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product src_user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_disable_mfa_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: Unless it is a special case, it is uncommon to disable MFA diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index 16fcaaf2ee..8a03fd278c 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -13,18 +13,18 @@ description: The following analytic detects when Microsoft Office 365 Data Loss DLP events contain. data_source: - O365 Universal Audit Log -search: "`o365_management_activity` Operation=DLPRuleMatch | eval recipient = 'ExchangeMetaData.To{}', - signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' - , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', - result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',\"\ - Message Body\"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') - | stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature - values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) - as app values(result) as result by src_user,recipient,signature_id,reason | `o365_dlp_rule_triggered_filter` - | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(*) AS - * by src_user,signature_id | eval action = CASE(match(result,\"Halt\"),\"blocked\"\ - ,isnotnull(result),\"alert\",true(),\"allow\") |`security_content_ctime(firstTime)`\ - \ |`security_content_ctime(lastTime)`" +search: "`o365_management_activity` Operation=DLPRuleMatch + | eval recipient = 'ExchangeMetaData.To{}', + signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' + , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', + result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',\"\ + Message Body\"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_dlp_rule_triggered_filter` " how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions. @@ -33,12 +33,12 @@ known_false_positives: WIll depending on accuracy of DLP rules, these can be noi references: - https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp drilldown_searches: -- name: View the detection results for - "$src_user$" - search: '%original_detection_search% | search src_user = "$src_user$"' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src_user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -47,14 +47,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $src_user$ triggered a Microsoft Office DLP rule. + message: User $user$ triggered a Microsoft Office DLP rule. risk_objects: - - field: src_user + - field: user type: user score: 20 - threat_objects: - - field: recipient - type: email_address + threat_objects: [] tags: analytic_story: - Data Exfiltration diff --git a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml index 361a0b8cf7..83fd6d5b01 100644 --- a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml +++ b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml @@ -14,11 +14,14 @@ description: The following analytic identifies the assignment of elevated mailbo over mailboxes, which could lead to data exfiltration or privilege escalation. If confirmed malicious, attackers could gain extensive access to sensitive email data and potentially manipulate mailbox settings, posing a severe security risk. -search: '`o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission - | search (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner) - | rename Identity AS dest_user | stats count earliest(_time) as firstTime latest(_time) - as lastTime by user dest_user Operation AccessRights |`security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `o365_elevated_mailbox_permission_assigned_filter`' +search: '`o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner) + | rename Identity AS dest_user + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product dest_user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_elevated_mailbox_permission_assigned_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: FullAccess mailbox delegation may be assigned for legitimate diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index 99d7b99204..1f6a67c6cb 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -11,11 +11,14 @@ description: The following analytic identifies when a user with sufficient acces this premium feature to enumerate or exfiltrate sensitive data. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess - | stats values(Workload) as category, values(MailboxId) as user, values(Operation) - as signature, count, min(_time) as firstTime, max(_time) as lastTime by InternetMessageId, - UserId | rename InternetMessageId as signature_id, UserId as src_user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_email_access_by_security_administrator_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess + | rename InternetMessageId as signature_id, UserId as src_user + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product src_user signature_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_email_access_by_security_administrator_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license. diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index 0a5d4aa0fa..f98190f86c 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -12,12 +12,13 @@ description: The following analytic detects when an email manually submitted to that returns a Phish or Malware verdict upon submission. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission - | search RescanVerdict IN (Phish,Malware) | stats values(Subject) as subject, values(RescanVerdict) - as result, values(SenderIP) as src, values(P2Sender) as sender, values(P1Sender) - as src_user, values(Recipients{}) as user, count min(_time) as firstTime, max(_time) - as lastTime, by Id,Operation,UserId | rename Name as signature, Id as signature_id, - UserId as o365_adminuser | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission + | search RescanVerdict IN (Phish,Malware) + | rename Operation as action, Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id dest_user src_user Subject SubmissionContent + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_email_reported_by_admin_found_malicious_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -39,7 +40,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: O365 security admin $o365_adminuser$ manually reported a suspicious email + message: O365 security admin $user$ manually reported a suspicious email from $src_user$ risk_objects: - field: src_user @@ -49,7 +50,7 @@ rba: type: user score: 50 threat_objects: - - field: subject + - field: Subject type: email_subject tags: analytic_story: diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index edbf3a10b7..4006e3a84b 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -12,15 +12,21 @@ description: The following analytic detects when an email submitted to Microsoft that returns a Phish or Malware verdict upon submission. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated - Name="Email reported by user as*" | fromjson Data | rename _raw AS temp etps AS - _raw | extract pairdelim=";" kvdelim=":" | rename _raw AS etps temp AS _raw | search - RescanVerdict IN (Phish,Malware) | rex field=tsd "\<(?.+)\>" | eval src_user - = case(isnull(src_user),tsd,true(),src_user) | stats count min(_time) as firstTime - max(_time) as lastTime values(ms) as subject values(RescanVerdict) as result values(tsd) - as sender values(src_user) as src_user by AlertId,AlertEntityId,Operation,Name | - rename Name as signature, AlertId as signature_id, AlertEntityId as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_email_reported_by_user_found_malicious_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated + Name="Email reported by user as*" + | fromjson Data + | rename _raw AS temp etps AS _raw + | extract pairdelim=";" kvdelim=":" + | rename _raw AS etps temp AS _raw + | search RescanVerdict IN (Phish,Malware) + | rex field=tsd "\<(?.+)\>" + | eval src_user = case(isnull(src_user),tsd,true(),src_user) + | rename Operation as action, Name as signature, AlertId as signature_id, AlertEntityId as user, tsd as sender, ms as subject + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id src_user sender subject + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_email_reported_by_user_found_malicious_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy/allow the usage of the Microsoft Office Report A Message function. @@ -42,7 +48,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The user $user$ reported an email classified as $result$ from $src_user$ + message: The user $user$ reported an email classified from $src_user$ risk_objects: - field: src_user type: user diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index 9afe560662..af6f0ee1d6 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -12,11 +12,13 @@ description: The following analytic identifies when specific O365 advanced secur compromise, or other malicious activities without leaving a detailed audit trail. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") - Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") | stats - values(ObjectId) as object, min(_time) as firstTime, max(_time) as lastTime, count by - Id, UserId, Operation | rename Id as object_id, UserId as user, Operation as signature - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_security_feature_changed_filter`' +search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") + | rename Operation as action, Id as object_id, UserId as user, Operation as signature, ObjectId as object + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature object_id object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_email_security_feature_changed_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators might alter features for troubleshooting, performance diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index f6770028e1..5ae8e28b3a 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -13,12 +13,14 @@ description: The following analytic identifies when one of O365 the built-in sec functions. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated - Name IN ("Suspicious email sending patterns detected","User restricted from sending - email","Suspicious Email Forwarding Activity","Email sending limit exceeded") | - fromjson Data | stats count min(_time) as firstTime max(_time) as lastTime by AlertId,ObjectId,Operation,Name - | rename Name as signature, AlertId as signature_id, ObjectId as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_email_suspicious_behavior_alert_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded") + | fromjson Data + | rename Operation as action, Name as signature, AlertId as signature_id, ObjectId as user + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_email_suspicious_behavior_alert_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The alerts must be enabled in the o365 security portal. diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 1d5109fda8..283a251460 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -13,11 +13,13 @@ description: The following analytic identifies an excessive number of authentica this activity could lead to unauthorized access, data breaches, or further exploitation within the environment. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* - status=failure | stats count earliest(_time) AS firstTime latest(_time) AS lastTime - values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS - UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count - > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure + | rename Operation as action + | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS + user_agent values(status) AS status values(src_ip) AS src values(action) as action by user vendor_account vendor_product dest + | where count > 10 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -41,13 +43,13 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: User $user$ has caused excessive number of authentication failures from - $src_ip$ using UserAgent $UserAgent$. + $src$ using UserAgent $user_agent$. risk_objects: - field: user type: user score: 64 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 0d47e6d383..6d9c29e615 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -14,10 +14,12 @@ description: The following analytic detects accounts experiencing a high number movement within the organization. data_source: - O365 UserLoginFailed -search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* - Operation=UserLoginFailed | stats count min(_time) as firstTime max(_time) as lastTime - values(user) as user by src_ip signature user_agent authentication_service action| - where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed + | rename Operation as action + | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src vendor_account vendor_product dest action user_agent + | where count >= 5 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -40,13 +42,13 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Excessive number of SSO logon errors from $src_ip$ using UserAgent $user_agent$. + message: Excessive number of SSO logon errors from $src$ using UserAgent $user_agent$. risk_objects: - field: user type: user score: 64 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml index 91b1363e09..f7abade941 100644 --- a/detections/cloud/o365_external_guest_user_invited.yml +++ b/detections/cloud/o365_external_guest_user_invited.yml @@ -16,15 +16,20 @@ description: The following analytic identifies the invitation of an external gue source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory AND Operation=\"\ - Add user*\" AND ModifiedProperties{}.NewValue=\"[*Guest*]\" AND ModifiedProperties{}.NewValue=\"\ - [*Invitation*]\" | eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user - = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ - ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | rex - field=user \"(?[\\\\w\\\\.-]+@[\\\\w-]+\\\\.[\\\\w-]{2,4})\" | stats values(user) - as user, min(_time) as firstTime, max(_time) as lastTime, count by Operation,Id,src_user - | rename Operation as signature, Id as signature_id | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | `o365_external_guest_user_invited_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory AND Operation=\"Add user*\" AND ModifiedProperties{}.NewValue=\"[*Guest*]\" AND ModifiedProperties{}.NewValue=\"[*Invitation*]\" + | eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) + | rex + field=user \"(? + [ \\w\\.-]+@ + [ \\w-]+\\. + [ \\w-]{2,4})\" + | rename Operation as signature, Id as signature_id + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id src_user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_external_guest_user_invited_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrator may legitimately invite external guest users. diff --git a/detections/cloud/o365_external_identity_policy_changed.yml b/detections/cloud/o365_external_identity_policy_changed.yml index 8e0c76ddf5..5aa3e4235f 100644 --- a/detections/cloud/o365_external_identity_policy_changed.yml +++ b/detections/cloud/o365_external_identity_policy_changed.yml @@ -15,23 +15,27 @@ description: The following analytic identifies when changes are made to the exte by Abusing External Identities`. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update - policy.\" Target{}.ID=\"B2BManagementPolicy\" | eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), - object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), - signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ - ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | spath - input=object_attrs_old output=B2BOld path={} | spath input=B2BOld | rename B2BManagementPolicy.* - as B2BManagementPolicyOld.* | spath input=object_attrs output=B2BNew path={} | spath - input=B2BNew | eval object_attrs = 'B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' - , object_attrs_old = 'B2BManagementPolicyOld.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' - | eval diff_add=mvmap(object_attrs,if(isnull(mvfind(object_attrs_old,object_attrs)),object_attrs,null)) - | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs,object_attrs_old)),object_attrs_old,null)) - | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"\ - Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\"\ - ,isnotnull(diff_remove),\"deleted\") | stats values(object_attrs) as object_attrs, - values(action) as action, values(result) as result, values(B2BManagementPolicy*) - as B2BManagementPolicy*, count, min(_time) as firstTime, max(_time) as lastTime - by user,signature,object_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update policy.\" Target{}.ID=\"B2BManagementPolicy\" + | eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), + object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), + signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"), + mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) + | spath input=object_attrs_old output=B2BOld path={} + | spath input=B2BOld + | rename B2BManagementPolicy.* as B2BManagementPolicyOld.* + | spath input=object_attrs output=B2BNew path={} + | spath input=B2BNew + | eval object_attrs = 'B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' + , object_attrs_old = 'B2BManagementPolicyOld.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' + | eval diff_add=mvmap(object_attrs,if(isnull(mvfind(object_attrs_old,object_attrs)),object_attrs,null)) + | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs,object_attrs_old)),object_attrs_old,null)) + | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\",isnotnull(diff_remove),\"deleted\") + | stats values(object_attrs) as object_attrs, + values(action) as action, values(result) as result, values(B2BManagementPolicy*) + as B2BManagementPolicy*, count, min(_time) as firstTime, max(_time) as lastTime + by user signature object_name dest vendor_account vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_external_identity_policy_changed_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. @@ -54,7 +58,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ changed the external identity [$object_name$] policy - $result$ + message: User $user$ changed the external identity [$object_name$] policy risk_objects: - field: user type: user diff --git a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml index 006d23cf9b..e21290c07e 100644 --- a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml @@ -15,13 +15,18 @@ description: The following analytic identifies instances where a user in the Off is malicious or overly permissive. If confirmed malicious, this could lead to data breaches, data loss, or unauthorized data manipulation, necessitating immediate investigation to validate the application's legitimacy and assess potential risks. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent - to application.\" ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue', - 0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue', - 4) | rex field=permissions \"Scope: (?[^,]+)\" | makemv delim=\" \" Scope - | search Scope IN (\"Files.Read\", \"Files.Read.All\", \"Files.ReadWrite\", \"Files.ReadWrite.All\"\ - , \"Files.ReadWrite.AppFolder\") | stats max(_time) as lastTime values(Scope) by - Operation, user, object, ObjectId | `security_content_ctime(lastTime)` | `o365_file_permissioned_application_consent_granted_by_user_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Success + | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) + | search admin_consent=False + | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) + | rex field=permissions \"Scope:(?[^,]+)\" + | makemv delim=\" \" Scope + | search Scope IN (\"Files.Read\", \"Files.Read.All\", \"Files.ReadWrite\", \"Files.ReadWrite.All\", \"Files.ReadWrite.AppFolder\") + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by action dest user src vendor_account vendor_product object ObjectId + | `security_content_ctime(lastTime)` + | `o365_file_permissioned_application_consent_granted_by_user_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: OAuth applications that require file permissions may be legitimate, diff --git a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml index 35a366d9f8..4d485fa778 100644 --- a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml +++ b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml @@ -15,13 +15,16 @@ description: The following analytic detects the assignment of the 'full_access_a Office 365 operations, including access to all mailboxes and the ability to send mail as any user. If confirmed malicious, this could lead to unauthorized data access, exfiltration, or account compromise. Immediate investigation is required. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update - application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath - input=newvalue | search \"{}.ResourceAppId\"=\"00000002-0000-0ff1-ce00-000000000000\"\ - \ \"{}.RequiredAppPermissions{}.EntitlementId\"=\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\"\ - \ | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | stats count - earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user, - object, user_agent, Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" + | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) + | spath input=newvalue + | search \"{}.ResourceAppId\"=\"00000002-0000-0ff1-ce00-000000000000\"\"{}.RequiredAppPermissions{}.EntitlementId\"=\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\" + | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by action dest user src vendor_account vendor_product object user_agent + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_fullaccessasapp_permission_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml index 41d867d860..4f0e72763e 100644 --- a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml @@ -15,9 +15,13 @@ description: The following analytic identifies an O365 account experiencing more access to the O365 environment, potentially compromising sensitive emails, documents, and other data. Prompt investigation and action are crucial to prevent unauthorized access and data breaches. -search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon - Workload=AzureActiveDirectory | bucket span=5m _time | stats dc(_raw) AS failed_attempts values(src_ip) - as src_ip by user, _time | where failed_attempts > 10 | `o365_high_number_of_failed_authentications_for_user_filter`' +search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon Workload=AzureActiveDirectory + | bucket span=5m _time + | rename command as action + | fillnull + | stats dc(_raw) AS failed_attempts values(src_ip) as src by action user _time dest vendor_account vendor_product + | where failed_attempts > 10 + | `o365_high_number_of_failed_authentications_for_user_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Although unusual, users who have lost their passwords may trigger @@ -47,7 +51,7 @@ rba: type: user score: 35 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/o365_high_privilege_role_granted.yml b/detections/cloud/o365_high_privilege_role_granted.yml index bbe4d281d2..2e000f13a2 100644 --- a/detections/cloud/o365_high_privilege_role_granted.yml +++ b/detections/cloud/o365_high_privilege_role_granted.yml @@ -15,12 +15,16 @@ description: The following analytic detects when high-privilege roles such as "E over critical resources and data. If confirmed malicious, this could enable attackers to gain significant control over O365 resources, access, modify, or delete critical data, and compromise the overall security and functionality of the O365 environment. -search: "`o365_management_activity` Operation=\"Add member to role.\" Workload=AzureActiveDirectory - | eval role_id = mvindex('ModifiedProperties{}.NewValue',2) | eval role_name = mvindex('ModifiedProperties{}.NewValue',1) - | where role_id IN (\"29232cdf-9323-42fd-ade2-1d097af3e4de\", \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\"\ - , \"62e90394-69f5-4237-9190-012177145e10\") | stats earliest(_time) as firstTime - latest(_time) as lastTime by user Operation ObjectId role_name | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_high_privilege_role_granted_filter`" +search: "`o365_management_activity` Operation=\"Add member to role.\" Workload=AzureActiveDirectory + | eval role_id = mvindex('ModifiedProperties{}.NewValue',2) + | eval role_name = mvindex('ModifiedProperties{}.NewValue',1) + | where role_id IN (\"29232cdf-9323-42fd-ade2-1d097af3e4de\", \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\", \"62e90394-69f5-4237-9190-012177145e10\") + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product ObjectId role_name role_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_high_privilege_role_granted_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Privilege roles may be assigned for legitimate purposes, filter diff --git a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml index 6ebb47a835..f22cbb8481 100644 --- a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml @@ -16,13 +16,17 @@ description: The following analytic identifies instances where a user grants con data access, email forwarding, or sending malicious emails from the compromised account. Validating the legitimacy of the application and consent context is crucial to prevent data breaches. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent - to application.\" ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue', - 0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue', - 4) | rex field=permissions \"Scope: (?[^,]+)\" | makemv delim=\" \" Scope - | search Scope IN (\"Mail.Read\", \"Mail.ReadBasic\", \"Mail.ReadWrite\", \"Mail.Read.Shared\"\ - , \"Mail.ReadWrite.Shared\", \"Mail.Send\", \"Mail.Send.Shared\") | stats max(_time) - as lastTime values(Scope) by Operation, user, object, ObjectId | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Success + | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) + | search admin_consent=False + | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) + | rex field=permissions \"Scope:(?[^,]+)\" + | makemv delim=\" \" Scope + | search Scope IN (\"Mail.Read\", \"Mail.ReadBasic\", \"Mail.ReadWrite\", \"Mail.Read.Shared\", \"Mail.ReadWrite.Shared\", \"Mail.Send\", \"Mail.Send.Shared\") + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by action dest user src vendor_account vendor_product object ObjectId + | `security_content_ctime(lastTime)` | `o365_mail_permissioned_application_consent_granted_by_user_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml index 28c3e91e3f..1b84e37dca 100644 --- a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml +++ b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml @@ -14,12 +14,16 @@ description: The following analytic identifies instances where email forwarding to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches. -search: "`o365_management_activity` Operation=Set-Mailbox | eval match1=mvfind('Parameters{}.Name', - \"ForwardingAddress\") | eval match2=mvfind('Parameters{}.Name', \"ForwardingSmtpAddress\"\ - ) | where match1>= 0 OR match2>= 0 | eval ForwardTo=coalesce(ForwardingAddress, - ForwardingSmtpAddress) | search ForwardTo!=\"\" | rename user_id as user | stats - count earliest(_time) as firstTime latest(_time) as lastTime values(ForwardTo) as - ForwardTo by user ObjectId |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` +search: "`o365_management_activity` Operation=Set-Mailbox + | eval match1=mvfind('Parameters{}.Name',\"ForwardingAddress\") + | eval match2=mvfind('Parameters{}.Name', \"ForwardingSmtpAddress\") + | where match1>= 0 OR match2>= 0 + | eval ForwardTo=coalesce(ForwardingAddress,ForwardingSmtpAddress) + | search ForwardTo!=\"\" + | rename user_id as user, Operation as action + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ForwardTo) as ForwardTo by action dest user src vendor_account vendor_product object ObjectId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_mailbox_email_forwarding_enabled_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml index e3f85487ae..3ead44d4f5 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml @@ -14,12 +14,12 @@ description: The following analytic identifies instances where read permissions and potential information leakage. If confirmed malicious, an attacker could gain unauthorized access to sensitive emails, leading to data breaches and compromising the confidentiality of organizational communications. -search: "`o365_management_activity` Workload=Exchange (Operation=ModifyFolderPermissions - OR Operation=AddFolderPermissions) Workload=Exchange object!=Calendar object!=Contacts - object!=PersonMetadata | eval isReadRole=if(match('Item.ParentFolder.MemberRights', - \"(ReadAny)\"), \"true\", \"false\") | rename UserId as user | stats count earliest(_time) - as firstTime latest(_time) as lastTime by Operation, user, object, Item.ParentFolder.MemberUpn, - Item.ParentFolder.MemberRights | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=Exchange (Operation=ModifyFolderPermissions OR Operation=AddFolderPermissions) Workload=Exchange object!=Calendar object!=Contacts object!=PersonMetadata + | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") + | rename UserId as user, Operation as action + | stats count earliest(_time) as firstTime latest(_time) as lastTime by action user object dest Item.ParentFolder.MemberUpn Item.ParentFolder.MemberRights src vendor_account vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml index 6b0939ee72..9599190abc 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml @@ -14,12 +14,16 @@ description: The following analytic identifies instances where read permissions exposing sensitive email content. If confirmed malicious, an attacker could gain unauthorized access to read email communications, leading to data breaches or information leakage. -search: '`o365_management_activity` Workload=Exchange (Operation="Set-MailboxFolderPermission" - OR Operation="Add-MailboxFolderPermission" ) | eval isReadRole=if(match(AccessRights, - "^(ReadItems|Author|NonEditingAuthor|Owner|PublishingAuthor|Reviewer)$"), "true", - "false") | search isReadRole="true" | rename UserId as user | stats count earliest(_time) - as firstTime latest(_time) as lastTime by Operation, user, Identity, AccessRights - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_granted_filter`' +search: '`o365_management_activity` Workload=Exchange (Operation="Set-MailboxFolderPermission" OR Operation="Add-MailboxFolderPermission" ) + | eval isReadRole=if(match(AccessRights,"^(ReadItems|Author|NonEditingAuthor|Owner|PublishingAuthor|Reviewer)$"), "true", "false") + | search isReadRole="true" + | rename UserId as user + | rename Operation as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product Identity AccessRights + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_mailbox_folder_read_permission_granted_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Mailbox folder permissions may be configured for legitimate diff --git a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml index 253de4acee..20a553dd93 100644 --- a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml +++ b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml @@ -15,12 +15,15 @@ description: The following analytic detects instances where the inbox folder of emails. If confirmed malicious, this could lead to data breaches, exfiltration of confidential information, and further compromise through spear-phishing or other malicious activities based on the accessed email content. -search: "`o365_management_activity` Operation=ModifyFolderPermissions Workload=Exchange - object=Inbox Item.ParentFolder.MemberUpn=Everyone | eval isReadRole=if(match('Item.ParentFolder.MemberRights', - \"(ReadAny)\"), \"true\", \"false\") | search isReadRole = \"true\" | stats count - earliest(_time) as firstTime latest(_time) as lastTime by Operation, UserId, object, - MailboxOwnerUPN, Item.ParentFolder.MemberUpn, Item.ParentFolder.MemberRights | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_mailbox_inbox_folder_shared_with_all_users_filter`" +search: "`o365_management_activity` Operation=ModifyFolderPermissions Workload=Exchange object=Inbox Item.ParentFolder.MemberUpn=Everyone + | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") + | search isReadRole = \"true\" + | rename Operation as action, UserId as user + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime by action, user, dest, vendor_account, vendor_product, object, MailboxOwnerUPN, Item.ParentFolder.MemberUpn, Item.ParentFolder.MemberRights + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_mailbox_inbox_folder_shared_with_all_users_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators might temporarily share a mailbox with all users diff --git a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml index 73b115897f..13e2416c40 100644 --- a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml +++ b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml @@ -15,12 +15,18 @@ description: The following analytic identifies instances where the Mail.Read Gra read all emails within a user's mailbox, which often contain sensitive or confidential information. If confirmed malicious, this could lead to data exfiltration, spear-phishing attacks, or further compromise based on the information gathered from the emails. -search: "`o365_management_activity` Operation=\"Update application.\" | eval json_data=mvindex('ModifiedProperties{}.NewValue', - 0) | eval json_data=replace(json_data, \"^\\[\\s*\", \"\") | eval json_data=replace(json_data, - \"\\s*\\]$\", \"\") | spath input=json_data path=RequiredAppPermissions{}.EntitlementId - output=EntitlementIds | eval match_found=mvfind(EntitlementIds, \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\"\ - ) | where isnotnull(match_found) | stats max(_time) as lastTime values(EntitlementIds) - as EntitlementIds by Operation, user, object | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Operation=\"Update application.\" + | eval json_data=mvindex('ModifiedProperties{}.NewValue',0) + | eval json_data=replace(json_data,\"^\\[\\s*\",\"\") + | eval json_data=replace(json_data,\"\\s*\\]$\",\"\") + | spath input=json_data path=RequiredAppPermissions{}.EntitlementId output=EntitlementIds + | eval match_found=mvfind(EntitlementIds, \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\") + | where isnotnull(match_found) + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime max(_time) as lastTime values(EntitlementIds) as EntitlementIds by action, user, dest, vendor_account, vendor_product, object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_mailbox_read_access_granted_to_application_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_multi_source_failed_authentications_spike.yml b/detections/cloud/o365_multi_source_failed_authentications_spike.yml index 3c21195c01..9b3526520a 100644 --- a/detections/cloud/o365_multi_source_failed_authentications_spike.yml +++ b/detections/cloud/o365_multi_source_failed_authentications_spike.yml @@ -15,12 +15,16 @@ description: The following analytic identifies a spike in failed authentication If confirmed malicious, this activity could lead to unauthorized access, data breaches, privilege escalation, and lateral movement within the organization. Early detection is crucial to prevent account takeovers and mitigate subsequent threats. -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed - ErrorNumber=50126 | bucket span=5m _time | eval uniqueIPUserCombo = src_ip . "-" - . user | stats dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, - dc(src_ip) as uniqueIPs, values(user) as user, values(src_ip) as ips, values(user_agent) - as user_agents by _time | where uniqueIpUserCombinations > 20 AND uniqueUsers > - 20 AND uniqueIPs > 20 | `o365_multi_source_failed_authentications_spike_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126 + | bucket span=5m _time + | eval uniqueIPUserCombo = src_ip . "-" . user + | rename Operation as action + | fillnull + | stats earliest(_time) as firstTime max(_time) as lastTime dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, values(user) as user, values(src_ip) as ips, values(user_agent) as user_agents values(action) as action values(src) as src values(dest) as dest by _time vendor_account vendor_product + | where uniqueIpUserCombinations > 20 AND uniqueUsers > 20 AND uniqueIPs > 20 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_multi_source_failed_authentications_spike_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized diff --git a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml index 5efc86483e..e1bbd3fdcc 100644 --- a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml +++ b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml @@ -17,11 +17,12 @@ description: The following analytic identifies unusual authentication activity i it suggests a compromised account, potentially leading to unauthorized access, privilege escalation, and data exfiltration. Early detection is crucial to prevent further exploitation. -search: '`o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn - OR Operation=UserLoginFailed) | bucket span=5m _time | stats dc(_raw) as failed_attempts - dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) - values(OS) by _time user src_ip | where failed_attempts > 5 and unique_user_agents - > 5 and unique_app_ids > 2 | `o365_multiple_appids_and_useragents_authentication_spike_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed) + | bucket span=5m _time + | rename Operation as action + | stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(action) as action by _time user src vendor_account vendor_product dest + | where failed_attempts > 5 and unique_user_agents > 5 and unique_app_ids > 2 + | `o365_multiple_appids_and_useragents_authentication_spike_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Rapid authentication from the same user using more than 5 different @@ -54,7 +55,7 @@ rba: type: user score: 48 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml index 838942b528..e4a6cfa1af 100644 --- a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml @@ -16,10 +16,11 @@ description: The following analytic identifies potential "MFA fatigue" attacks t requests. If confirmed malicious, this could lead to data breaches, unauthorized data access, or further compromise within the O365 environment. Immediate investigation is crucial. -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed - ResultStatus=Success ErrorNumber=500121 | bucket span=10m _time | stats dc(_raw) - as mfa_prompts values(LogonError) as LogonError values(signature) as signature by - user, _time | where mfa_prompts > 9 | `o365_multiple_failed_mfa_requests_for_user_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ResultStatus=Success ErrorNumber=500121 + | bucket span=10m _time + | stats dc(_raw) as mfa_prompts values(LogonError) as LogonError values(signature) as signature values(action) as action values(src) as src by user _time vendor_account vendor_product dest + | where mfa_prompts > 9 + | `o365_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Multiple Failed MFA requests may also be a sign of authentication diff --git a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml index 5bc7b90235..76cea6e5bf 100644 --- a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml +++ b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml @@ -16,12 +16,15 @@ description: The following analytic detects when a high number of Office 365 Exc information, leading to data breaches and further exploitation of compromised accounts. The threshold is set to flag over five unique mailboxes accessed within 10 minutes, but should be tailored to your environment. -search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed - AppId=* ClientAppId=* | bucket span=10m _time | eval matchRegex=if(match(ClientInfoString, - "^Client=WebServices;ExchangeWebServices"), 1, 0) | search (AppId="00000003-0000-0000-c000-000000000000" - OR matchRegex=1) | stats values(ClientIPAddress) as src_ip dc(user) as unique_mailboxes - values(user) as user by _time ClientAppId ClientInfoString | where unique_mailboxes - > 5 | `o365_multiple_mailboxes_accessed_via_api_filter`' +search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=* + | bucket span=10m _time + | eval matchRegex=if(match(ClientInfoString,"^Client=WebServices;ExchangeWebServices"), 1, 0) + | search (AppId="00000003-0000-0000-c000-000000000000" OR matchRegex=1) + | rename Operation as action + | fillnull + | stats values(ClientIPAddress) as src dc(user) as unique_mailboxes values(user) as user by _time ClientAppId ClientInfoString vendor_account vendor_product dest action + | where unique_mailboxes > 5 + | `o365_multiple_mailboxes_accessed_via_api_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Legitimate applications may access multiple mailboxes via an diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml index 743aca09e9..e2fd7aa1fe 100644 --- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml @@ -9,14 +9,16 @@ description: The following analytic identifies when multiple operating systems a data_source: - Office 365 Universal Audit Log search: |- - `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) - | eval -time = _time - | bin _time span=15m - | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time - | where os_count >= 4 - | eval src = ClientIP, user = UserId + `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) + | eval -time = _time + | bin _time span=15m + | rename Operation as action + | fillnull + | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time, action, dest, vendor_account, vendor_product + | where os_count >= 4 + | eval src = ClientIP, user = UserId | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `o365_multiple_os_vendors_authenticating_from_user_filter` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. diff --git a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml index f23966ec6c..812e61eefb 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml @@ -15,12 +15,18 @@ description: The following analytic identifies instances where a single service attempting to expand control or access within the network. If confirmed malicious, this could lead to unauthorized access and potential lateral movement within the environment, posing a significant security risk. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add - service principal.\" | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | - eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"ServicePrincipal\"\ - \ | eval displayName = object | stats count earliest(_time) as firstTime latest(_time) - as lastTime values(displayName) as displayName dc(displayName) as unique_apps by - src_user | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add service principal.\" + | bucket span=10m _time + | eval len=mvcount('Actor{}.ID') + | eval userType = mvindex('Actor{}.ID',len-1) + | search userType = \"ServicePrincipal\" + | eval displayName = object + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest action + | where unique_apps > 3 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_sp_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_multiple_service_principals_created_by_user.yml b/detections/cloud/o365_multiple_service_principals_created_by_user.yml index 1ecd0908e9..3ad8d647df 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_user.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_user.yml @@ -15,12 +15,16 @@ description: The following analytic identifies instances where a single user cre potentially leading to broader network infiltration or privilege escalation. If confirmed malicious, this behavior could allow attackers to gain persistent access, escalate privileges, or exfiltrate sensitive information. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add - service principal.\" | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | - eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"User\" | eval - displayName = object | stats count earliest(_time) as firstTime latest(_time) as - lastTime values(displayName) as displayName dc(displayName) as unique_apps by src_user - | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add service principal.\" + | bucket span=10m _time + | eval len=mvcount('Actor{}.ID') + | eval userType = mvindex('Actor{}.ID',len-1) + | search userType = \"User\" + | eval displayName = object + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest action + | where unique_apps > 3 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_user_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml index 24496ddc87..c8b12efc47 100644 --- a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml @@ -16,10 +16,13 @@ description: The following analytic identifies instances where more than 10 uniq multiple accounts, potentially leading to unauthorized access. Immediate action is required to block or monitor the suspicious IP and notify affected users to enhance their security measures. -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed - ErrorNumber=50126 | bucket span=5m _time | stats dc(user) as unique_accounts values(user) - as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) - as UserAgent by _time, src_ip | where unique_accounts > 10 | `o365_multiple_users_failing_to_authenticate_from_ip_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126 + | bucket span=5m _time + | rename Operation as action + | fillnull + | stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as user_agent values(dest) as dest by _time src vendor_account vendor_product action + | where unique_accounts > 10 + | `o365_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: A source Ip failing to authenticate with multiple users in @@ -44,13 +47,13 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Source Ip $src_ip$ failed to authenticate with 20 users within 5 minutes. + message: Source Ip $src$ failed to authenticate with 20 users within 5 minutes. risk_objects: - field: user type: user score: 63 threat_objects: - - field: src_ip + - field: src type: ip_address tags: analytic_story: diff --git a/detections/cloud/o365_new_email_forwarding_rule_created.yml b/detections/cloud/o365_new_email_forwarding_rule_created.yml index cee90dcbdc..0bb9a56abe 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_created.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_created.yml @@ -14,13 +14,18 @@ description: The following analytic identifies the creation of new email forward unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches. -search: "`o365_management_activity` (Operation=New-InboxRule OR Operation=set-InboxRule) - | eval match1=mvfind('Parameters{}.Name', \"ForwardTo\") | eval match2=mvfind('Parameters{}.Name', - \"ForwardAsAttachmentTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectTo\"\ - ) | where match1>= 0 OR match2>= 0 OR match3>= 0 | eval ForwardTo=coalesce(ForwardTo, - ForwardAsAttachmentTo, RedirectTo) | stats count min(_time) as firstTime max(_time) - as lastTime values(Name) as Name by user Operation ForwardTo | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_created_filter`" +search: "`o365_management_activity` (Operation=New-InboxRule OR Operation=set-InboxRule) + | eval match1=mvfind('Parameters{}.Name', \"ForwardTo\") + | eval match2=mvfind('Parameters{}.Name', \"ForwardAsAttachmentTo\") + | eval match3=mvfind('Parameters{}.Name', \"RedirectTo\") + | where match1>= 0 OR match2>= 0 OR match3>= 0 + | eval ForwardTo=coalesce(ForwardTo, ForwardAsAttachmentTo, RedirectTo) + | rename command as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by action dest user src vendor_account vendor_product ForwardTo + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_new_email_forwarding_rule_created_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Users may create email forwarding rules for legitimate purposes. diff --git a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml index dcc6b1b909..9d6c2bd0f6 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml @@ -13,17 +13,24 @@ description: The following analytic identifies the creation of new email forward This activity is significant as it may indicate unauthorized email redirection, potentially leading to data exfiltration. If confirmed malicious, attackers could intercept sensitive communications, leading to data breaches and information leakage. -search: "`o365_management_activity` Workload=Exchange Operation=UpdateInboxRules \ - \ | eval match1=mvfind('OperationProperties{}.Value', \"ForwardToRecipientsAction\"\ - ) | eval match2=mvfind('OperationProperties{}.Value', \"ForwardAsAttachmentToRecipientsAction\"\ - ) | eval match3=mvfind('OperationProperties{}.Value', \"RedirectToRecipientsAction\"\ - ) | eval index = mvfind('OperationProperties{}.Name', \"ServerRule\") | where match1>= - 0 OR match2>= 0 OR match3>= 0 | eval ServerRule = mvindex('OperationProperties{}.Value', - index-1) | spath input=ServerRule path=Actions{}.Recipients{}.Values{}.Value output=valueExtracted - | mvexpand valueExtracted | search valueExtracted=\"*@*.*\" | eval ForwardTo=if(match(valueExtracted, - \"^[^@]+@[^@]+\\\\.[^@]+$\"), valueExtracted, null) | dedup ForwardTo | where isnotnull(ForwardTo) - | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name - by user Operation ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=Exchange Operation=UpdateInboxRules + | eval match1=mvfind('OperationProperties{}.Value', \"ForwardToRecipientsAction\") + | eval match2=mvfind('OperationProperties{}.Value', \"ForwardAsAttachmentToRecipientsAction\") + | eval match3=mvfind('OperationProperties{}.Value', \"RedirectToRecipientsAction\") + | eval index = mvfind('OperationProperties{}.Name', \"ServerRule\") + | where match1>=0 OR match2>= 0 OR match3>= 0 + | eval ServerRule = mvindex('OperationProperties{}.Value',index-1) + | spath input=ServerRule path=Actions{}.Recipients{}.Values{}.Value output=valueExtracted + | mvexpand valueExtracted + | search valueExtracted=\"*@*.*\" + | eval ForwardTo=if(match(valueExtracted,\"^[^@]+@[^@]+\\\\.[^@]+$\"), valueExtracted, null) + | dedup ForwardTo + | where isnotnull(ForwardTo) + | rename Operation as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by action dest user src vendor_account vendor_product ForwardTo + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_enabled_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 6dcebc1fbe..bd88806268 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -15,10 +15,14 @@ description: The following analytic identifies the addition of a new federated d to review the details of the added domain and any concurrent suspicious activities. data_source: - O365 -search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" - | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent - authentication_service action Workload Operation | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' +search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" + | rename Operation as action + | eval src="NA" + | fillnull + | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent authentication_service action Workload src vendor_account vendor_product dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_new_federated_domain_added_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. known_false_positives: The creation of a new Federated domain is not necessarily malicious, diff --git a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml index c97bba78de..c3dc2d23af 100644 --- a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml +++ b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml @@ -13,14 +13,20 @@ description: The following analytic detects the creation of new mail flow rules This activity is significant as it can indicate potential data exfiltration or unauthorized access to sensitive information. If confirmed malicious, attackers could intercept or redirect email communications, leading to data breaches or information leakage. -search: "`o365_management_activity` Workload=Exchange Operation=\"New-TransportRule\"\ - \ | eval match1=mvfind('Parameters{}.Name', \"BlindCopyTo\") | eval match2=mvfind('Parameters{}.Name', - \"CopyTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectMessageTo\") | where - match1>= 0 OR match2>= 0 OR match3>=0 | eval ForwardTo=coalesce(BlindCopyTo, CopyTo, - RedirectMessageTo) | search ForwardTo!=\"\" | rename UserId as user | stats count - earliest(_time) as firstTime latest(_time) as lastTime by Operation, user, Name, - ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ - \ | `o365_new_forwarding_mailflow_rule_created_filter`" +search: "`o365_management_activity` Workload=Exchange Operation=\"New-TransportRule\" + | eval match1=mvfind('Parameters{}.Name',\"BlindCopyTo\") + | eval match2=mvfind('Parameters{}.Name',\"CopyTo\") + | eval match3=mvfind('Parameters{}.Name', \"RedirectMessageTo\") + | where match1>= 0 OR match2>= 0 OR match3>=0 + | eval ForwardTo=coalesce(BlindCopyTo, CopyTo, RedirectMessageTo) + | search ForwardTo!=\"\" + | rename UserId as user + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, ForwardTo, vendor_account, vendor_product, dest, action + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_new_forwarding_mailflow_rule_created_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Forwarding mail flow rules may be created for legitimate reasons, diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml index f5278b8e52..af69d9d914 100644 --- a/detections/cloud/o365_new_mfa_method_registered.yml +++ b/detections/cloud/o365_new_mfa_method_registered.yml @@ -14,16 +14,22 @@ description: The following analytic detects the registration of a new Multi-Fact account. If confirmed malicious, the attacker could bypass existing security measures, solidify their access, and potentially escalate privileges or access sensitive data. Immediate verification and remediation are required to secure the affected account. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update - user.\" | eval propertyName = mvindex('ModifiedProperties{}.Name', 0) | search - propertyName = StrongAuthenticationMethod | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0) - | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | rex field=newvalue - max_match=0 \"(?i)(?\\\"MethodType\\\")\" | rex field=oldvalue - max_match=0 \"(?i)(?\\\"MethodType\\\")\" | eval count_new_method_type - = coalesce(mvcount(new_method_type), 0) | eval count_old_method_type = coalesce(mvcount(old_method_type), - 0) | where count_new_method_type > count_old_method_type | stats earliest(_time) - as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_mfa_method_registered_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update user.\" + | eval propertyName = mvindex('ModifiedProperties{}.Name', 0) + | search propertyName = StrongAuthenticationMethod + | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0) + | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) + | rex field=newvalue max_match=0 \"(?i)(?\\\"MethodType\\\")\" + | rex field=oldvalue max_match=0 \"(?i)(?\\\"MethodType\\\")\" + | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) + | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) + | where count_new_method_type > count_old_method_type + | rename Operation as action + | fillnull + | stats earliest(_time) as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue vendor_account vendor_product dest action src + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_new_mfa_method_registered_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Users may register MFA methods legitimally, investigate and diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml index 6d65874c2c..025512e3e1 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml @@ -15,11 +15,14 @@ description: The following analytic detects when emails are accessed in Office 3 emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confirmed malicious, this activity could lead to unauthorized email access, data exfiltration, or further compromise of sensitive information. -search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed - AppId=* ClientAppId=* | regex ClientInfoString="^Client=WebServices;ExchangeWebServices" - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) - as src_ip by user ClientAppId OperationCount AppId ClientInfoString | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_oauth_app_mailbox_access_via_ews_filter`' +search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=* + | regex ClientInfoString="^Client=WebServices;ExchangeWebServices" + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src by user ClientAppId OperationCount AppId vendor_account vendor_product dest action ClientInfoString + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_oauth_app_mailbox_access_via_ews_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: OAuth applications may access mailboxes for legitimate purposes, diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml index 97b83569fd..3142df21a5 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml @@ -14,10 +14,12 @@ description: The following analytic detects when emails are accessed in Office 3 access to emails can lead to data breaches and information theft. If confirmed malicious, attackers could exfiltrate sensitive information, compromise user accounts, and further infiltrate the organization’s network. -search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed - AppId=* AppId=00000003-0000-0000-c000-000000000000 | stats count earliest(_time) - as firstTime latest(_time) as lastTime values(ClientIPAddress) by user ClientAppId - OperationCount AppId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* AppId=00000003-0000-0000-c000-000000000000 + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src by user ClientAppId OperationCount AppId vendor_account vendor_product dest action + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_oauth_app_mailbox_access_via_graph_api_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml index 6f5a154912..82c3bc7c43 100644 --- a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml +++ b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml @@ -15,14 +15,16 @@ description: The following analytic detects the assignment of critical Graph API provide extensive control over Azure AD settings, posing a high risk if misused. If confirmed malicious, this could allow unauthorized modifications, leading to potential data breaches or privilege escalation. Immediate investigation is crucial. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update - application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath - input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\"\ - \ OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"06b708a9-e830-4db3-a914-8e69da51d44f\"\ - \ OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\"\ - \ | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | stats count - earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user, - object, user_agent, Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" + | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) + | spath input=newvalue + | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" + | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent action vendor_account vendor_product dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_privileged_graph_api_permission_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 975cdaa4a0..07ffad0c7a 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -11,18 +11,16 @@ description: The following analytic identifies the assignment of sensitive and p AD environment. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"\ - Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, - src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ - ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name - = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"\ - Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"\ - Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = - mvindex('Target{}.ID',2) | stats count, min(_time) as firstTime, max(_time) as lastTime - by src_user, user, category, result, object_name, object_id, signature | lookup - privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole - | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") + | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) + | rename Operation as action + | fillnull + | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, action, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest + | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole + | search isprvilegedadrole=\"TRUE\" category=\"User\" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_privileged_role_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators will legitimately assign the privileged roles diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index f984d8f1de..8a75a4026f 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -15,18 +15,16 @@ description: The following analytic detects potential privilege escalation threa source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"\ - Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, - src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ - ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name - = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"\ - Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"\ - Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = - mvindex('Target{}.ID',2) | stats count, min(_time) as firstTime, max(_time) as lastTime - by src_user, user, category, result, object_name, object_id, signature | lookup - privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole - | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") + | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) + | rename Operation as action + | fillnull + | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, action, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest + | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole + | search isprvilegedadrole=\"TRUE\" category!=\"User\" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_privileged_role_assigned_to_service_principal_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators may legitimately assign the privileged roles diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 3e936f968c..936987b36f 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -16,10 +16,13 @@ description: The following analytic detects instances where a user has initiated Immediate investigation is required. data_source: - O365 -search: '`o365_management_activity` Category=ThreatManagement Name="eDiscovery search - started or exported" | stats count earliest(_time) as firstTime latest(_time) as - lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`' +search: '`o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" + | rename Operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId action Name user src vendor_account vendor_product dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_pst_export_alert_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: PST export can be done for legitimate purposes but due to the @@ -27,12 +30,12 @@ known_false_positives: PST export can be done for legitimate purposes but due to references: - https://attack.mitre.org/techniques/T1114/ drilldown_searches: -- name: View the detection results for - "$Source$" - search: '%original_detection_search% | search Source = "$Source$"' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Source$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Source$") +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -41,10 +44,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $Source$ has exported a PST file from the search using this operation- - $Operation$ with a severity of $Severity$ + message: User $user$ has exported a PST file from the search using this operation- + $action$ with a severity of $Severity$ risk_objects: - - field: Source + - field: user type: user score: 48 threat_objects: [] diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml index 1c85c2120c..c148f82cf7 100644 --- a/detections/cloud/o365_safe_links_detection.yml +++ b/detections/cloud/o365_safe_links_detection.yml @@ -10,12 +10,15 @@ description: The following analytic detects when any Microsoft Safe Links alerti or otherwise malicious link within the Microsoft Office ecosystem. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated - | fromjson Data | stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId) - as url values(od) as desc by AlertId,trc,Operation,Name,ot | rename Name as signature, - AlertId as signature_id, trc as user,ot as action | eval action = CASE(action == - "Allowed", "allowed", action=="BlockPageOverride", "allowed", true(),"blocked") - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_safe_links_detection_filter`' +search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated + | fromjson Data + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId) as url values(od) as desc by AlertId, trc, Name, ot, dest, vendor_account, vendor_product, src + | rename Name as signature, AlertId as signature_id, trc as user, ot as action + | eval action = CASE(action == "Allowed", "allowed", action=="BlockPageOverride", "allowed", true(),"blocked") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_safe_links_detection_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The Safe Links capability must be configured and is typically only available to E3/E5 level customers. @@ -43,9 +46,7 @@ rba: - field: user type: user score: 40 - threat_objects: - - field: url - type: url + threat_objects: [] tags: analytic_story: - Office 365 Account Takeover diff --git a/detections/cloud/o365_security_and_compliance_alert_triggered.yml b/detections/cloud/o365_security_and_compliance_alert_triggered.yml index f7a2340203..3f7ff02959 100644 --- a/detections/cloud/o365_security_and_compliance_alert_triggered.yml +++ b/detections/cloud/o365_security_and_compliance_alert_triggered.yml @@ -15,14 +15,20 @@ description: The following analytic identifies alerts triggered by the Office 36 If confirmed malicious, these alerts could indicate attempts to breach security policies, leading to unauthorized access, data exfiltration, or other malicious activities. -search: '`o365_management_activity` Workload=SecurityComplianceCenter Category=ThreatManagement - Operation=AlertTriggered | spath input=Data path=f3u output=user | spath input=Data - path=op output=operation | spath input=_raw path=wl | spath input=Data path=rid - output=rule_id | spath input=Data path=ad output=alert_description | spath input=Data - path=lon output=operation_name | spath input=Data path=an output=alert_name | spath - input=Data path=sev output=severity | stats count earliest(_time) as firstTime - latest(_time) as lastTime by user, Name, operation, rule_id, alert_description, - alert_name, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=SecurityComplianceCenter Category=ThreatManagement Operation=AlertTriggered + | spath input=Data path=f3u output=user + | spath input=Data path=op output=operation + | spath input=_raw path=wl + | spath input=Data path=rid output=rule_id + | spath input=Data path=ad output=alert_description + | spath input=Data path=lon output=operation_name + | spath input=Data path=an output=alert_name + | spath input=Data path=sev output=severity + | rename operation as action + | fillnull + | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, action, rule_id, alert_description, alert_name, severity, dest, src, vendor_account, vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_security_and_compliance_alert_triggered_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml index 4748ee38f9..9ae051185f 100644 --- a/detections/cloud/o365_service_principal_new_client_credentials.yml +++ b/detections/cloud/o365_service_principal_new_client_credentials.yml @@ -15,10 +15,13 @@ description: The following analytic detects the addition of new credentials for operations under the application's identity. data_source: - O365 -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Update - application*Certificates and secrets management " | stats earliest(_time) as firstTime - latest(_time) as lastTime by user ModifiedProperties{}.NewValue object ObjectId - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_service_principal_new_client_credentials_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Update application*Certificates and secrets management " + | rename Operation as action + | fillnull + | stats earliest(_time) as firstTime latest(_time) as lastTime by user ModifiedProperties{}.NewValue object ObjectId dest action src vendor_account vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_service_principal_new_client_credentials_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Service Principal client credential modifications may be part diff --git a/detections/cloud/o365_service_principal_privilege_escalation.yml b/detections/cloud/o365_service_principal_privilege_escalation.yml index ee93c75401..3caf94d540 100644 --- a/detections/cloud/o365_service_principal_privilege_escalation.yml +++ b/detections/cloud/o365_service_principal_privilege_escalation.yml @@ -9,13 +9,18 @@ type: TTP status: production description: This detection identifies when an Azure Service Principal elevates privileges by adding themself to a new app role assignment. search: >- - `o365_management_activity` Operation="Add app role assignment to service principal." "Actor{}.ID"=ServicePrincipal ResultStatus=Success - | spath path=ModifiedProperties{} output=targetResources - | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id - | spath input=appRole path=NewValue output=appRole - | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal - | where servicePrincipal=targetServicePrincipal - | table _time Operation servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId + `o365_management_activity` Operation="Add app role assignment to service principal." "Actor{}.ID"=ServicePrincipal ResultStatus=Success + | spath path=ModifiedProperties{} output=targetResources + | eval src="NA" + | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id user dest src vendor_account vendor_product + | spath input=appRole path=NewValue output=appRole + | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal + | where servicePrincipal=targetServicePrincipal + | rename Operation as action + | fillnull + | stats earliest(_time) as firstTime latest(_time) as lastTime by action servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId user dest src vendor_account vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_service_principal_privilege_escalation_filter` how_to_implement: The Splunk Add-on for Microsoft Office 365 add-on is required to ingest EntraID audit logs via the 365 API. See references for links for further details on how to onboard this log source. known_false_positives: Unknown diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 8cbdd85c92..37c46dba0a 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -13,18 +13,16 @@ description: The following analytic identifies when the allowed domain settings access. data_source: - O365 Universal Audit Log -search: "`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged - \"ModifiedProperties{}.Name\"=AllowDomainList | eval signature_id = CorrelationId, - signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', - object_attrs_new = split(replace('ModifiedProperties{}.NewValue',\"\\.\\.\\.\",\"\ - \"),\",\"), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',\"\\\ - .\\.\\.\",\"\"),\",\") | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) - as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) - as lastTime by user,signature,signature_id,object_name | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) - | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) - | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"\ - Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\"\ - ,isnotnull(diff_remove),\"deleted\") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged \"ModifiedProperties{}.Name\"=AllowDomainList + | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',\"\\.\\.\\.\",\"\"),\",\"), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',\"\\.\\.\\.\",\"\"),\",\") + | rename Operation as action + | fillnull + | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product + | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) + | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) + | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\",isnotnull(diff_remove),\"deleted\") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_sharepoint_allowed_domains_policy_changed_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index a3136a5595..ecbe9eb713 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -12,11 +12,12 @@ description: The following analytic identifies when a malicious file is detected Office 365 capabilities further enhance these detection and response functions. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Operation=FileMalwareDetected | stats values(Workload) - as category, values(SourceFileName) as file_name values(ObjectId) as file_path, - values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime - by Id, UserId | rename Id as signature_id, UserId as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_sharepoint_malware_detection_filter`' +search: '`o365_management_activity` Operation=FileMalwareDetected + | rename Operation as action, UserId as user, Id as signature_id + | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by signature_id, user, action, dest, src, vendor_account, vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_sharepoint_malware_detection_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: unknown diff --git a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml index 5375087924..76a246214d 100644 --- a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml +++ b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml @@ -15,12 +15,17 @@ description: The following analytic identifies instances where admin consent is data. If confirmed malicious, an attacker could gain extensive and persistent access to organizational data, leading to data exfiltration, espionage, further malicious activities, and potential compliance violations. -search: "`o365_management_activity` Operation=\"Consent to application.\" | eval - new_field=mvindex('ModifiedProperties{}.NewValue', 4) | rex field=new_field \"ConsentType: - (?[^\\,]+)\" | rex field=new_field \"Scope: (?[^\\,]+)\" | - search ConsentType = \"AllPrincipals\" | stats count min(_time) as firstTime max(_time) - as lastTime by Operation, user, object, ObjectId, ConsentType, Scope | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | `o365_tenant_wide_admin_consent_granted_filter`" +search: "`o365_management_activity` Operation=\"Consent to application.\" + | eval new_field=mvindex('ModifiedProperties{}.NewValue', 4) + | rex field=new_field \"ConsentType: (?[^\\,]+)\" + | rex field=new_field \"Scope: (?[^\\,]+)\" + | search ConsentType = \"AllPrincipals\" + | rename Operation as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by action, user, object, ObjectId, ConsentType, Scope, dest, vendor_account, vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_tenant_wide_admin_consent_granted_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Legitimate applications may be granted tenant wide consent, diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml index b2142169f6..47f4a99d7f 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -13,15 +13,11 @@ description: The following analytic identifies when a suspicious email is detect Safe Attachment and Safe Links further enhance these detection and response functions. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData - DeliveryAction!=Blocked Directionality=InBound | rename P2Sender as src_user, P1Sender - as sender, Recipients{} as user, DeliveryAction as action | stats values(SenderIp) - as src, values(Subject) as subject, values(user) as user, values(action) as action, - values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, - values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) - as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) - as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) - as lastTime, count by src_user,sender | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound + | rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action + | stats values(SenderIp) as src, values(Subject) as subject, values(user) as user, values(action) as action, values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) as lastTime, count by src_user,sender,dest,vendor_account,vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_threat_intelligence_suspicious_email_delivered_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index d7fcb9eb0a..121895ef7b 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -13,12 +13,15 @@ description: The following analytic identifies when a malicious file is detected Safe Attachment and Safe Links further enhance these detection and response functions. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection - | stats values(DetectionMethod) as category values(FileData.FileName) as file_name - values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) - as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId - | rename Id as signature_id, UserId as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `o365_threat_intelligence_suspicious_file_detected_filter`' +search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection + | rename Operation as action + | eval dest="NA" + | eval src="NA" + | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId, action, dest, src, vendor_account, vendor_product + | rename Id as signature_id, UserId as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_threat_intelligence_suspicious_file_detected_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. diff --git a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml index f345c04d9e..97a02c95de 100644 --- a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml @@ -16,11 +16,15 @@ description: The following analytic identifies instances where Office 365 has bl the organization. If confirmed malicious, this activity suggests that O365's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent - to application.\" ResultStatus=Failure | eval permissions =mvindex('ModifiedProperties{}.NewValue', - 4) | eval reason =mvindex('ModifiedProperties{}.NewValue', 5) | search reason = - \"Risky application detected\" | rex field=permissions \"Scope: (?[^,]+)\"\ - \ | stats max(_time) as lastTime by Operation, user, reason, object, Scope | `security_content_ctime(lastTime)` +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Failure + | eval permissions =mvindex('ModifiedProperties{}.NewValue', 4) + | eval reason =mvindex('ModifiedProperties{}.NewValue', 5) + | search reason = \"Risky application detected\" + | rex field=permissions \"Scope: (?[^,]+)\" + | rename Operation as action + | fillnull + | stats max(_time) as lastTime by action, user, reason, object, Scope, dest, src, vendor_account, vendor_product + | `security_content_ctime(lastTime)` | `o365_user_consent_blocked_for_risky_application_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index b16c86afb1..30e12d2594 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -12,13 +12,16 @@ description: The following analytic detects when the Microsoft Zero-hour Automat a window in which the user may fall victim to the malicious content. data_source: - O365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated - Name="*messages containing malicious*" | fromjson Data | stats count min(_time) - as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) - as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,Operation,Name - | rename Name as signature, AlertId as signature_id, trc as user | eval action = - CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";") - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_zap_activity_detection_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*" + | fromjson Data + | rename Operation as action + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,action,Name,dest,src,vendor_account,vendor_product + | rename Name as signature, AlertId as signature_id, trc as user + | eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_zap_activity_detection_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Some features of Zero-hour purge are only offered within E3/E5 license level tenants, events may not be available otherwise. From c46223df566c314b80762b87e39edab8114aa8ae Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 18 Feb 2025 13:27:02 +0100 Subject: [PATCH 02/29] version bump --- detections/cloud/o365_added_service_principal.yml | 2 +- .../o365_admin_consent_bypassed_by_service_principal.yml | 2 +- .../cloud/o365_applicationimpersonation_role_assigned.yml | 2 +- .../cloud/o365_block_user_consent_for_risky_apps_disabled.yml | 2 +- detections/cloud/o365_dlp_rule_triggered.yml | 2 +- .../cloud/o365_email_reported_by_user_found_malicious.yml | 2 +- .../cloud/o365_excessive_authentication_failures_alert.yml | 2 +- detections/cloud/o365_external_identity_policy_changed.yml | 2 +- detections/cloud/o365_fullaccessasapp_permission_assigned.yml | 2 +- .../cloud/o365_mailbox_folder_read_permission_assigned.yml | 2 +- .../cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml | 2 +- .../cloud/o365_mailbox_read_access_granted_to_application.yml | 2 +- .../cloud/o365_multiple_service_principals_created_by_sp.yml | 2 +- .../o365_multiple_service_principals_created_by_user.yml | 2 +- detections/cloud/o365_new_email_forwarding_rule_created.yml | 2 +- detections/cloud/o365_new_email_forwarding_rule_enabled.yml | 2 +- detections/cloud/o365_new_mfa_method_registered.yml | 2 +- .../cloud/o365_oauth_app_mailbox_access_via_graph_api.yml | 4 ++-- .../cloud/o365_privileged_graph_api_permission_assigned.yml | 2 +- .../cloud/o365_service_principal_privilege_escalation.yml | 2 +- .../cloud/o365_user_consent_blocked_for_risky_application.yml | 2 +- 21 files changed, 22 insertions(+), 22 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index cc20a69acb..d497790658 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,6 +1,6 @@ name: O365 Added Service Principal id: 1668812a-6047-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2025-02-10' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml index 0c546a2016..1faa14aa54 100644 --- a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml +++ b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml @@ -1,6 +1,6 @@ name: O365 Admin Consent Bypassed by Service Principal id: 8a1b22eb-50ce-4e26-a691-97ff52349569 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk data_source: diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml index 8f96eb1b82..5777eab80b 100644 --- a/detections/cloud/o365_applicationimpersonation_role_assigned.yml +++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml @@ -1,6 +1,6 @@ name: O365 ApplicationImpersonation Role Assigned id: 49cdce75-f814-4d56-a7a4-c64ec3a481f2 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml index f6df6bed31..20e1788176 100644 --- a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml +++ b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml @@ -1,6 +1,6 @@ name: O365 Block User Consent For Risky Apps Disabled id: 12a23592-e3da-4344-8545-205d3290647c -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index 8a03fd278c..1e303d030e 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -1,6 +1,6 @@ name: O365 DLP Rule Triggered id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871 -version: 4 +version: 5 date: '2024-11-14' author: Steven Dick status: production diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index 0dcddb85b9..e38709835b 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -1,6 +1,6 @@ name: O365 Email Reported By User Found Malicious id: 7698b945-238e-4bb9-b172-81f5ca1685a1 -version: 4 +version: 5 date: '2025-02-10' author: Steven Dick status: production diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 283a251460..244432a71d 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -1,6 +1,6 @@ name: O365 Excessive Authentication Failures Alert id: d441364c-349c-453b-b55f-12eccab67cf9 -version: 5 +version: 6 date: '2024-11-14' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_external_identity_policy_changed.yml b/detections/cloud/o365_external_identity_policy_changed.yml index 5aa3e4235f..b87c85479c 100644 --- a/detections/cloud/o365_external_identity_policy_changed.yml +++ b/detections/cloud/o365_external_identity_policy_changed.yml @@ -1,6 +1,6 @@ name: O365 External Identity Policy Changed id: 29af1725-7a72-4d2d-8a18-e697e79a62d3 -version: 4 +version: 5 date: '2024-11-14' author: Steven Dick status: production diff --git a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml index 4d485fa778..916f3436a8 100644 --- a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml +++ b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml @@ -1,6 +1,6 @@ name: O365 FullAccessAsApp Permission Assigned id: 01a510b3-a6ac-4d50-8812-7e8a3cde3d79 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml index 55c41d6377..cc0b18fbcf 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml @@ -1,6 +1,6 @@ name: O365 Mailbox Folder Read Permission Assigned id: 1435475e-2128-4417-a34f-59770733b0d5 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml index bdd214cd3a..43d60f90fe 100644 --- a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml +++ b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml @@ -1,6 +1,6 @@ name: O365 Mailbox Inbox Folder Shared with All Users id: 21421896-a692-4594-9888-5faeb8a53106 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml index 9680943a2c..1944436f12 100644 --- a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml +++ b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml @@ -1,6 +1,6 @@ name: O365 Mailbox Read Access Granted to Application id: 27ab61c5-f08a-438a-b4d3-325e666490b3 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml index 812e61eefb..0bb33432f2 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml @@ -1,6 +1,6 @@ name: O365 Multiple Service Principals Created by SP id: ef4c3f20-d1ad-4ad1-a3f4-d5f391c005fe -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk data_source: diff --git a/detections/cloud/o365_multiple_service_principals_created_by_user.yml b/detections/cloud/o365_multiple_service_principals_created_by_user.yml index 3ad8d647df..430b28d883 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_user.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_user.yml @@ -1,6 +1,6 @@ name: O365 Multiple Service Principals Created by User id: a34e65d0-54de-4b02-9db8-5a04522067f6 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk data_source: diff --git a/detections/cloud/o365_new_email_forwarding_rule_created.yml b/detections/cloud/o365_new_email_forwarding_rule_created.yml index 664c67f203..09d9ac9b0f 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_created.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_created.yml @@ -1,6 +1,6 @@ name: O365 New Email Forwarding Rule Created id: 68469fd0-1315-44ba-b7e4-e92847bb76d6 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml index d1c2b231ef..d752f9af9b 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml @@ -1,6 +1,6 @@ name: O365 New Email Forwarding Rule Enabled id: ac7c4d0a-06a3-4278-aa59-88a5e537f981 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml index cd0acbab78..fb25641ee6 100644 --- a/detections/cloud/o365_new_mfa_method_registered.yml +++ b/detections/cloud/o365_new_mfa_method_registered.yml @@ -1,6 +1,6 @@ name: O365 New MFA Method Registered id: 4e12db1f-f7c7-486d-8152-a221cad6ac2b -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml index 3142df21a5..9e80fd6a88 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml @@ -1,6 +1,6 @@ name: O365 OAuth App Mailbox Access via Graph API id: 9db0d5b0-4058-4cb7-baaf-77d8143539a2 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production @@ -13,7 +13,7 @@ description: The following analytic detects when emails are accessed in Office 3 on OAuth-authenticated applications. This activity is significant as unauthorized access to emails can lead to data breaches and information theft. If confirmed malicious, attackers could exfiltrate sensitive information, compromise user accounts, and - further infiltrate the organization’s network. + further infiltrate the organization's network. search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* AppId=00000003-0000-0000-c000-000000000000 | rename Operation as action | fillnull diff --git a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml index 82c3bc7c43..5f4bc51217 100644 --- a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml +++ b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml @@ -1,6 +1,6 @@ name: O365 Privileged Graph API Permission Assigned id: 868f3131-d5e1-4bf1-af5b-9b0fbaaaedbb -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_service_principal_privilege_escalation.yml b/detections/cloud/o365_service_principal_privilege_escalation.yml index b9df47c2d1..54a00d1684 100644 --- a/detections/cloud/o365_service_principal_privilege_escalation.yml +++ b/detections/cloud/o365_service_principal_privilege_escalation.yml @@ -1,6 +1,6 @@ name: O365 Service Principal Privilege Escalation id: b686d0bd-cca7-44ca-ae07-87f6465131d9 -version: 2 +version: 3 date: '2025-02-10' author: Dean Luxton data_source: diff --git a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml index 97a02c95de..adc93bc23e 100644 --- a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml @@ -1,6 +1,6 @@ name: O365 User Consent Blocked for Risky Application id: 242e4d30-cb59-4051-b0cf-58895e218f40 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production From cfded93af923ee080422ace60506df28ef54aab3 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 18 Feb 2025 13:30:23 +0100 Subject: [PATCH 03/29] version bump --- detections/cloud/o365_application_registration_owner_added.yml | 2 +- .../cloud/o365_concurrent_sessions_from_different_ips.yml | 2 +- detections/cloud/o365_cross_tenant_access_change.yml | 2 +- detections/cloud/o365_disable_mfa.yml | 2 +- detections/cloud/o365_excessive_sso_logon_errors.yml | 2 +- detections/cloud/o365_external_guest_user_invited.yml | 2 +- ...65_file_permissioned_application_consent_granted_by_user.yml | 2 +- ...65_mail_permissioned_application_consent_granted_by_user.yml | 2 +- ...o365_multiple_appids_and_useragents_authentication_spike.yml | 2 +- detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml | 2 +- detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml | 2 +- detections/cloud/o365_new_forwarding_mailflow_rule_created.yml | 2 +- detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml | 2 +- detections/cloud/o365_pst_export_alert.yml | 2 +- .../cloud/o365_sharepoint_allowed_domains_policy_changed.yml | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/detections/cloud/o365_application_registration_owner_added.yml b/detections/cloud/o365_application_registration_owner_added.yml index 462519c933..cdd517ac29 100644 --- a/detections/cloud/o365_application_registration_owner_added.yml +++ b/detections/cloud/o365_application_registration_owner_added.yml @@ -1,6 +1,6 @@ name: O365 Application Registration Owner Added id: c068d53f-6aaa-4558-8011-3734df878266 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml index 590b5faf7a..24e69d72c0 100644 --- a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml @@ -1,6 +1,6 @@ name: O365 Concurrent Sessions From Different Ips id: 58e034de-1f87-4812-9dc3-a4f68c7db930 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml index 4587e7a9d4..a4396b3aed 100644 --- a/detections/cloud/o365_cross_tenant_access_change.yml +++ b/detections/cloud/o365_cross_tenant_access_change.yml @@ -1,6 +1,6 @@ name: O365 Cross-Tenant Access Change id: 7c0fa490-12b0-4d0b-b9f5-e101d1e0e06f -version: 4 +version: 5 date: '2024-11-14' author: Steven Dick status: production diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 521a84d8c4..2cff372480 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -1,6 +1,6 @@ name: O365 Disable MFA id: c783dd98-c703-4252-9e8a-f19d9f5c949e -version: 5 +version: 6 date: '2024-11-14' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 6d9c29e615..5024d2e8a7 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -1,6 +1,6 @@ name: O365 Excessive SSO logon errors id: 8158ccc4-6038-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2024-11-14' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml index f7abade941..994c69dc56 100644 --- a/detections/cloud/o365_external_guest_user_invited.yml +++ b/detections/cloud/o365_external_guest_user_invited.yml @@ -1,6 +1,6 @@ name: O365 External Guest User Invited id: 8c6d52ec-d5f2-4b2f-8ba1-f32c047a71fa -version: 4 +version: 5 date: '2024-11-14' author: Steven Dick status: production diff --git a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml index e21290c07e..71886b8e8a 100644 --- a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml @@ -1,6 +1,6 @@ name: O365 File Permissioned Application Consent Granted by User id: 6c382336-22b8-4023-9b80-1689e799f21f -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml index f22cbb8481..5bfac56963 100644 --- a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml @@ -1,6 +1,6 @@ name: O365 Mail Permissioned Application Consent Granted by User id: fddad083-cdf5-419d-83c6-baa85e329595 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml index e1bbd3fdcc..a231372892 100644 --- a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml +++ b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml @@ -1,6 +1,6 @@ name: O365 Multiple AppIDs and UserAgents Authentication Spike id: 66adc486-224d-45c1-8e4d-9e7eeaba988f -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml index e4a6cfa1af..93b6de4dc0 100644 --- a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml @@ -1,6 +1,6 @@ name: O365 Multiple Failed MFA Requests For User id: fd22124e-dbac-4744-a8ce-be10d8ec3e26 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml index 76cea6e5bf..d1c04ab8b1 100644 --- a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml +++ b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml @@ -1,6 +1,6 @@ name: O365 Multiple Mailboxes Accessed via API id: 7cd853e9-d370-412f-965d-a2bcff2a2908 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk data_source: diff --git a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml index c3dc2d23af..dc10e44ab3 100644 --- a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml +++ b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml @@ -1,6 +1,6 @@ name: O365 New Forwarding Mailflow Rule Created id: 289ed0a1-4c78-4a43-9321-44ea2e089c14 -version: 4 +version: 5 date: '2024-11-14' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml index 025512e3e1..db5e078758 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml @@ -1,6 +1,6 @@ name: O365 OAuth App Mailbox Access via EWS id: e600cf1a-0bef-4426-b42e-00176d610a4d -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 936987b36f..4b4eacbbd8 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -1,6 +1,6 @@ name: O365 PST export alert id: 5f694cc4-a678-4a60-9410-bffca1b647dc -version: 5 +version: 6 date: '2024-11-14' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 37c46dba0a..a269d78881 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -1,6 +1,6 @@ name: O365 SharePoint Allowed Domains Policy Changed id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c -version: 5 +version: 6 date: '2024-11-14' author: Steven Dick status: production From 53578e73be3626fd4c9158e4eaf369a113671290 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Wed, 26 Feb 2025 11:36:20 +0100 Subject: [PATCH 04/29] gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index c441750030..2a6e590e07 100644 --- a/.gitignore +++ b/.gitignore @@ -16,6 +16,7 @@ external_repos/ # IDE .vscode/ +.cursor/ # usual mac files .DS_Store From 96ca892fe80ca6b33ecbbe56bb6c4c7e5b129e9a Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Wed, 26 Feb 2025 11:42:57 +0100 Subject: [PATCH 05/29] version bump --- detections/cloud/o365_add_app_role_assignment_grant_user.yml | 2 +- detections/cloud/o365_advanced_audit_disabled.yml | 2 +- .../cloud/o365_application_available_to_other_tenants.yml | 2 +- detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 2 +- detections/cloud/o365_compliance_content_search_exported.yml | 2 +- detections/cloud/o365_compliance_content_search_started.yml | 2 +- detections/cloud/o365_elevated_mailbox_permission_assigned.yml | 2 +- .../o365_high_number_of_failed_authentications_for_user.yml | 2 +- detections/cloud/o365_high_privilege_role_granted.yml | 2 +- detections/cloud/o365_mailbox_email_forwarding_enabled.yml | 2 +- .../cloud/o365_mailbox_folder_read_permission_granted.yml | 2 +- .../cloud/o365_multi_source_failed_authentications_spike.yml | 2 +- .../cloud/o365_multiple_os_vendors_authenticating_from_user.yml | 2 +- .../o365_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 2 +- detections/cloud/o365_privileged_role_assigned.yml | 2 +- .../o365_privileged_role_assigned_to_service_principal.yml | 2 +- .../cloud/o365_security_and_compliance_alert_triggered.yml | 2 +- .../cloud/o365_service_principal_new_client_credentials.yml | 2 +- detections/cloud/o365_tenant_wide_admin_consent_granted.yml | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 4d50363712..d28ad15950 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -1,6 +1,6 @@ name: O365 Add App Role Assignment Grant User id: b2c81cc6-6040-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2025-02-10' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_advanced_audit_disabled.yml b/detections/cloud/o365_advanced_audit_disabled.yml index e528b4cf1d..ecc1cd2cdb 100644 --- a/detections/cloud/o365_advanced_audit_disabled.yml +++ b/detections/cloud/o365_advanced_audit_disabled.yml @@ -1,6 +1,6 @@ name: O365 Advanced Audit Disabled id: 49862dd4-9cb2-4c48-a542-8c8a588d9361 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Michael Haag, Splunk status: production diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml index 3459210d8f..ab6737d5d1 100644 --- a/detections/cloud/o365_application_available_to_other_tenants.yml +++ b/detections/cloud/o365_application_available_to_other_tenants.yml @@ -1,6 +1,6 @@ name: O365 Application Available To Other Tenants id: 942548a3-0273-47a4-8dbd-e5202437395c -version: 5 +version: 6 date: '2025-02-10' author: Steven Dick status: production diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index d64b88d1cf..b2d0f57eab 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -1,6 +1,6 @@ name: O365 Bypass MFA via Trusted IP id: c783dd98-c703-4252-9e8a-f19d9f66949e -version: 7 +version: 8 date: '2025-02-10' author: Bhavin Patel, Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_compliance_content_search_exported.yml b/detections/cloud/o365_compliance_content_search_exported.yml index e2fc1eb5c7..91250f2771 100644 --- a/detections/cloud/o365_compliance_content_search_exported.yml +++ b/detections/cloud/o365_compliance_content_search_exported.yml @@ -1,6 +1,6 @@ name: O365 Compliance Content Search Exported id: 2ce9f31d-ab4f-4179-b2b7-c77a9652e1d8 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_compliance_content_search_started.yml b/detections/cloud/o365_compliance_content_search_started.yml index e23517b5e9..717c5356d5 100644 --- a/detections/cloud/o365_compliance_content_search_started.yml +++ b/detections/cloud/o365_compliance_content_search_started.yml @@ -1,6 +1,6 @@ name: O365 Compliance Content Search Started id: f4cabbc7-c19a-4e41-8be5-98daeaccbb50 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml index 20b9a38aa4..7076c41535 100644 --- a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml +++ b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml @@ -1,6 +1,6 @@ name: O365 Elevated Mailbox Permission Assigned id: 2246c142-a678-45f8-8546-aaed7e0efd30 -version: 6 +version: 7 date: '2025-02-10' author: Patrick Bareiss, Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml index 58ae217ead..9cefde051b 100644 --- a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml @@ -1,6 +1,6 @@ name: O365 High Number Of Failed Authentications for User id: 31641378-2fa9-42b1-948e-25e281cb98f7 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_high_privilege_role_granted.yml b/detections/cloud/o365_high_privilege_role_granted.yml index 32ec7075b3..7adfb192a8 100644 --- a/detections/cloud/o365_high_privilege_role_granted.yml +++ b/detections/cloud/o365_high_privilege_role_granted.yml @@ -1,6 +1,6 @@ name: O365 High Privilege Role Granted id: e78a1037-4548-4072-bb1b-ad99ae416426 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml index a5aafdf129..8131fc9d16 100644 --- a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml +++ b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml @@ -1,6 +1,6 @@ name: O365 Mailbox Email Forwarding Enabled id: 0b6bc75c-05d1-4101-9fc3-97e706168f24 -version: 5 +version: 6 date: '2025-02-10' author: Patrick Bareiss, Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml index f0b86dd3b6..8bb4e9bf08 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml @@ -1,6 +1,6 @@ name: O365 Mailbox Folder Read Permission Granted id: cd15c0a8-470e-4b12-9517-046e4927db30 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_multi_source_failed_authentications_spike.yml b/detections/cloud/o365_multi_source_failed_authentications_spike.yml index 1aafcc51c8..3c3fd4bc95 100644 --- a/detections/cloud/o365_multi_source_failed_authentications_spike.yml +++ b/detections/cloud/o365_multi_source_failed_authentications_spike.yml @@ -1,6 +1,6 @@ name: O365 Multi-Source Failed Authentications Spike id: ea4e2c41-dbfb-4f5f-a7b6-9ac1b7f104aa -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml index e2fd7aa1fe..fc336ac3ec 100644 --- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml @@ -1,6 +1,6 @@ name: O365 Multiple OS Vendors Authenticating From User id: 3451e58a-9457-4985-a600-b616b0cbfda1 -version: 1 +version: 2 date: '2024-12-19' author: Steven Dick status: production diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml index 83e6bae200..c33107d2ca 100644 --- a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml @@ -1,6 +1,6 @@ name: O365 Multiple Users Failing To Authenticate From Ip id: 8d486e2e-3235-4cfe-ac35-0d042e24ecb4 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 9850120cd5..14538d698e 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -1,6 +1,6 @@ name: O365 New Federated Domain Added id: e155876a-6048-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2025-02-10' author: Rod Soto, Mauricio Velazco Splunk status: production diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 497ceea270..3d23771557 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -1,6 +1,6 @@ name: O365 Privileged Role Assigned id: db435700-4ddc-4c23-892e-49e7525d7d39 -version: 5 +version: 6 date: '2025-02-10' author: Steven Dick status: production diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index e60d19ec44..5d8bb35825 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -1,6 +1,6 @@ name: O365 Privileged Role Assigned To Service Principal id: 80f3fc1b-705f-4080-bf08-f61bf013b900 -version: 5 +version: 6 date: '2025-02-10' author: Steven Dick status: production diff --git a/detections/cloud/o365_security_and_compliance_alert_triggered.yml b/detections/cloud/o365_security_and_compliance_alert_triggered.yml index c2e63e9a10..58374b6be1 100644 --- a/detections/cloud/o365_security_and_compliance_alert_triggered.yml +++ b/detections/cloud/o365_security_and_compliance_alert_triggered.yml @@ -1,6 +1,6 @@ name: O365 Security And Compliance Alert Triggered id: 5b367cdd-8dfc-49ac-a9b7-6406cf27f33e -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: [] diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml index 89c747f93f..2467738cb8 100644 --- a/detections/cloud/o365_service_principal_new_client_credentials.yml +++ b/detections/cloud/o365_service_principal_new_client_credentials.yml @@ -1,6 +1,6 @@ name: O365 Service Principal New Client Credentials id: a1b229e9-d962-4222-8c62-905a8a010453 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml index a9eb22edbd..0df1b7a792 100644 --- a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml +++ b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml @@ -1,6 +1,6 @@ name: O365 Tenant Wide Admin Consent Granted id: 50eaabf8-5180-4e86-bfb2-011472c359fc -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production From a0d8dff5c45998473ca5390f3065206321189b06 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Mon, 17 Mar 2025 19:29:23 +0100 Subject: [PATCH 06/29] O365 output normalization --- data_sources/o365.yml | 1 - .../o365_add_app_role_assignment_grant_to_user_.yml | 1 - ..._add_app_role_assignment_to_service_principal_.yml | 1 - data_sources/o365_add_mailboxpermission.yml | 1 - data_sources/o365_add_member_to_role_.yml | 1 - data_sources/o365_add_owner_to_application_.yml | 1 - data_sources/o365_add_service_principal_.yml | 1 - data_sources/o365_change_user_license_.yml | 1 - data_sources/o365_consent_to_application_.yml | 1 - data_sources/o365_disable_strong_authentication_.yml | 1 - data_sources/o365_mailitemsaccessed.yml | 1 - data_sources/o365_modifyfolderpermissions.yml | 1 - data_sources/o365_set_company_information_.yml | 1 - data_sources/o365_set_mailbox.yml | 1 - data_sources/o365_update_application_.yml | 1 - data_sources/o365_update_authorization_policy_.yml | 1 - data_sources/o365_update_user_.yml | 1 - data_sources/o365_userloggedin.yml | 1 - data_sources/o365_userloginfailed.yml | 1 - ..._number_of_login_failures_from_a_single_source.yml | 11 +++++++---- .../cloud/o365_add_app_role_assignment_grant_user.yml | 3 +-- detections/cloud/o365_added_service_principal.yml | 3 +-- ...65_admin_consent_bypassed_by_service_principal.yml | 3 +-- detections/cloud/o365_advanced_audit_disabled.yml | 5 ++--- .../o365_application_available_to_other_tenants.yml | 3 +-- .../o365_application_registration_owner_added.yml | 3 +-- .../o365_applicationimpersonation_role_assigned.yml | 5 ++--- ...365_block_user_consent_for_risky_apps_disabled.yml | 3 +-- detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 3 +-- .../cloud/o365_compliance_content_search_exported.yml | 3 +-- .../cloud/o365_compliance_content_search_started.yml | 3 +-- .../o365_concurrent_sessions_from_different_ips.yml | 3 +-- detections/cloud/o365_cross_tenant_access_change.yml | 4 +--- detections/cloud/o365_disable_mfa.yml | 6 +++--- detections/cloud/o365_dlp_rule_triggered.yml | 1 - .../o365_elevated_mailbox_permission_assigned.yml | 3 +-- .../o365_email_access_by_security_administrator.yml | 5 ++--- .../o365_email_reported_by_admin_found_malicious.yml | 4 ++-- .../o365_email_reported_by_user_found_malicious.yml | 4 ++-- .../cloud/o365_email_security_feature_changed.yml | 4 ++-- .../cloud/o365_email_suspicious_behavior_alert.yml | 4 ++-- .../cloud/o365_email_transport_rule_changed.yml | 4 ++-- .../o365_excessive_authentication_failures_alert.yml | 3 +-- detections/cloud/o365_excessive_sso_logon_errors.yml | 5 ++--- detections/cloud/o365_external_guest_user_invited.yml | 3 +-- ...rmissioned_application_consent_granted_by_user.yml | 5 ++--- .../o365_fullaccessasapp_permission_assigned.yml | 3 +-- ...high_number_of_failed_authentications_for_user.yml | 3 +-- detections/cloud/o365_high_privilege_role_granted.yml | 3 +-- ...rmissioned_application_consent_granted_by_user.yml | 3 +-- .../cloud/o365_mailbox_email_forwarding_enabled.yml | 4 ++-- .../o365_mailbox_folder_read_permission_assigned.yml | 4 ++-- .../o365_mailbox_folder_read_permission_granted.yml | 5 ++--- ...365_mailbox_inbox_folder_shared_with_all_users.yml | 4 ++-- ...365_mailbox_read_access_granted_to_application.yml | 3 +-- ...o365_multi_source_failed_authentications_spike.yml | 3 +-- ...ple_appids_and_useragents_authentication_spike.yml | 3 +-- .../o365_multiple_mailboxes_accessed_via_api.yml | 3 +-- ...5_multiple_os_vendors_authenticating_from_user.yml | 3 +-- ...o365_multiple_service_principals_created_by_sp.yml | 4 ++-- ...65_multiple_service_principals_created_by_user.yml | 3 ++- ...multiple_users_failing_to_authenticate_from_ip.yml | 3 +-- .../cloud/o365_new_email_forwarding_rule_created.yml | 5 ++--- .../cloud/o365_new_email_forwarding_rule_enabled.yml | 3 +-- detections/cloud/o365_new_federated_domain_added.yml | 3 +-- .../o365_new_forwarding_mailflow_rule_created.yml | 3 +-- detections/cloud/o365_new_mfa_method_registered.yml | 3 +-- .../cloud/o365_oauth_app_mailbox_access_via_ews.yml | 3 +-- .../o365_oauth_app_mailbox_access_via_graph_api.yml | 3 +-- .../o365_privileged_graph_api_permission_assigned.yml | 3 +-- detections/cloud/o365_privileged_role_assigned.yml | 3 +-- ..._privileged_role_assigned_to_service_principal.yml | 3 +-- detections/cloud/o365_pst_export_alert.yml | 5 ++--- .../o365_security_and_compliance_alert_triggered.yml | 3 +-- .../o365_service_principal_new_client_credentials.yml | 3 +-- .../o365_service_principal_privilege_escalation.yml | 3 +-- ...o365_sharepoint_allowed_domains_policy_changed.yml | 1 - .../cloud/o365_sharepoint_malware_detection.yml | 4 ++-- .../cloud/o365_tenant_wide_admin_consent_granted.yml | 3 +-- ...5_threat_intelligence_suspicious_file_detected.yml | 3 +-- ...365_user_consent_blocked_for_risky_application.yml | 3 +-- ...o365_user_consent_denied_for_oauth_application.yml | 8 +++++--- detections/cloud/o365_zap_activity_detection.yml | 5 ++--- 83 files changed, 94 insertions(+), 158 deletions(-) diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 6ff163b465..bb9ed13a10 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -12,7 +12,6 @@ supported_TA: url: https://splunkbase.splunk.com/app/4055 version: 4.7.0 output_fields: -- action - dest - user - src diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index a990da31eb..1628d0a521 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -107,7 +107,6 @@ example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, { "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index c032e74a26..7dfdf48ad0 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -112,7 +112,6 @@ example_log: '{"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1- "Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 062ec0c7b3..a2123a211d 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -82,7 +82,6 @@ example_log: '{"AppId": "", "ClientAppId": "", "ClientIP": "18.159.234.121:30395 "SessionId": "2be46662-a743-4a05-8744-c2f75f886512", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index 2b970c4884..db9c16b3e4 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -105,7 +105,6 @@ example_log: '{"CreationTime": "2023-10-20T16:50:46", "Id": "30a8b107-b190-406c- "Type": 2}, {"ID": "lowpriv@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index e9c031ee3e..62d6d3f947 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -106,7 +106,6 @@ example_log: '{"CreationTime": "2023-09-07T13:42:04", "Id": "6e2c723b-8f6e-47f4- "Type": 2}, {"ID": "user2@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 57dc6dab0f..a41bbbd0f4 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -115,7 +115,6 @@ example_log: '{"CreationTime": "2024-02-07T22:31:14", "Id": "f624ed92-b4a2-4d42- "Type": 2}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index cf0b01d560..2495549a5f 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -99,7 +99,6 @@ example_log: '{"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494- "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index 7a7d345fea..8c87875fdc 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -106,7 +106,6 @@ example_log: '{"CreationTime": "2023-09-05T21:05:31", "Id": "5822e126-1fbc-4269- "Type": 2}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 4}], "TargetContextId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index d3a66879b3..fa9c23f245 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -98,7 +98,6 @@ example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, { "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 672cafb1fd..5b8a7cfc94 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -93,7 +93,6 @@ example_log: '{"CreationTime": "2024-02-01T16:07:34", "Id": "9cef02e9-4bfa-4c73- "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 4}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 75ec901b67..f4561d6550 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -107,7 +107,6 @@ example_log: '{"CreationTime": "2023-09-07T18:19:07", "Id": "ff065c17-e638-4013- "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index fbdf92312e..6d0052145c 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -114,7 +114,6 @@ example_log: '{"Actor": [{"ID": "bpatel@rodsoto.onmicrosoft.com", "Type": 5}, {" "UserId": "bpatel@rodsoto.onmicrosoft.com", "UserKey": "100320010208B5DC@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index a0f4a31c6d..fc631dda82 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -91,7 +91,6 @@ example_log: '{"AppId": "", "ClientAppId": "", "ClientIP": "18.192.200.190:52816 "True", "SessionId": "86a7cd7c-3f42-4b68-b670-4024b5461a80", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 093bcf36b8..13caca264c 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -115,7 +115,6 @@ example_log: '{"CreationTime": "2023-09-01T17:16:20", "Id": "c428c85c-4fa0-4e97- "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}], "TargetContextId": "58aee3b9-7433-46a0-b54e-2429487992a0"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index e238a609c9..5f2f0c46c3 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -98,7 +98,6 @@ example_log: '{"CreationTime": "2023-10-26T19:22:20", "Id": "83774e72-313f-4d1f- 2}, {"ID": "24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "Other", "Type": 2}, {"ID": "Authorization Policy", "Type": 1}], "TargetContextId": "a417c578-c7ee-480d-a225-d48057e74df5"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index b9655ba734..71f52bba6d 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -112,7 +112,6 @@ example_log: '{"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595- "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 180688980b..25fa605611 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -102,7 +102,6 @@ example_log: '{"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b- "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}' output_fields: -- action - dest - user - src diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index 3ed4e9abb9..141b0cfaba 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -112,7 +112,6 @@ example_log: '{"CreationTime": "2023-10-10T17:08:65", "Id": "4593aac8-855f-4341- "IsCompliantAndManaged", "Value": "False"}], "ErrorNumber": "50126", "LogonError": "InvalidUserNameOrPassword"}' output_fields: -- action - dest - user - src diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml index 7f6fe588f5..aa8606aae6 100644 --- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -16,10 +16,13 @@ description: The following analytic detects multiple failed login attempts in Of data_source: - O365 UserLoginFailed search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed - record_type=AzureActiveDirectoryStsLogon | bucket span=5m _time | stats dc(_raw) - AS failed_attempts values(user) as user values(LogonError) as LogonError values(signature) - as signature values(UserAgent) as UserAgent by _time, src_ip | where failed_attempts - > 10 | `high_number_of_login_failures_from_a_single_source_filter`' + record_type=AzureActiveDirectoryStsLogon + | bucket span=5m _time + | stats dc(_raw) AS failed_attempts values(user) as user values(LogonError) as LogonError values(signature) + as signature values(UserAgent) as UserAgent values(dest) as dest values(vendor_account) as vendor_account values(vendor_product) as vendor_product + by _time, src_ip + | where failed_attempts > 10 + | `high_number_of_login_failures_from_a_single_source_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Adjust the threshold value to suit the specific environment, as environments with naturally higher login failures might generate diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index d28ad15950..a42e32f5c6 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -15,9 +15,8 @@ description: The following analytic detects the addition of an application role data_source: - O365 Add app role assignment grant to user. search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index d497790658..4d59e18a3c 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -16,9 +16,8 @@ description: The following analytic detects the addition of new service principa data_source: - O365 search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' diff --git a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml index 1faa14aa54..8f8fccb35f 100644 --- a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml +++ b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml @@ -24,9 +24,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Ad | eval dest_user = mvindex('Target{}.ID', 0) | search userType = \"ServicePrincipal\" | eval src_user = user - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product dest_user roleId roleValue roleDescription + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product dest_user roleId roleValue roleDescription | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_admin_consent_bypassed_by_service_principal_filter`" diff --git a/detections/cloud/o365_advanced_audit_disabled.yml b/detections/cloud/o365_advanced_audit_disabled.yml index ecc1cd2cdb..fb35aed091 100644 --- a/detections/cloud/o365_advanced_audit_disabled.yml +++ b/detections/cloud/o365_advanced_audit_disabled.yml @@ -22,10 +22,9 @@ search: "`o365_management_activity` Operation=\"Change user license.\" | eval split_value=split(additionalDetails,\"NewValue\") | eval possible_plan=mvindex(split_value, 1) | rex field=\"possible_plan\" \"DisabledPlans=\\[(?P[^\\]]+)\\]\" - | search DisabledPlans IN (\"*M365_ADVANCED_AUDITING*\") - | rename command as action + | search DisabledPlans IN (\"*M365_ADVANCED_AUDITING*\") | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product DisabledPlans object + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product DisabledPlans object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_advanced_audit_disabled_filter`" diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml index ab6737d5d1..580d7b31f2 100644 --- a/detections/cloud/o365_application_available_to_other_tenants.yml +++ b/detections/cloud/o365_application_available_to_other_tenants.yml @@ -19,9 +19,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN ( User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"\ ),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | search result = \"added\" - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product object_attrs object_name + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product object_attrs object_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_available_to_other_tenants_filter`" diff --git a/detections/cloud/o365_application_registration_owner_added.yml b/detections/cloud/o365_application_registration_owner_added.yml index cdd517ac29..d5b5599246 100644 --- a/detections/cloud/o365_application_registration_owner_added.yml +++ b/detections/cloud/o365_application_registration_owner_added.yml @@ -19,9 +19,8 @@ description: The following analytic identifies instances where a new owner is as search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add owner to application.\" | eval app_id=mvindex('ModifiedProperties{}.NewValue', 0) | eval app_displayName=mvindex('ModifiedProperties{}.NewValue', 1) - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product app_id app_displayName object + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product app_id app_displayName object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_registration_owner_added_filter`" diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml index 5777eab80b..de5277200c 100644 --- a/detections/cloud/o365_applicationimpersonation_role_assigned.yml +++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml @@ -16,10 +16,9 @@ description: The following analytic detects the assignment of the ApplicationImp manipulate mailbox data, and perform actions as a legitimate user, posing a severe security risk to the organization. search: '`o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment" Role=ApplicationImpersonation - | rename User as target_user - | rename command as action + | rename User as target_user | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product target_user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product target_user | `security_content_ctime(lastTime)` | `o365_applicationimpersonation_role_assigned_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml index 20e1788176..82eae1c519 100644 --- a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml +++ b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml @@ -20,9 +20,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Up | search index_number >= 0 | eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number) | where AllowUserConsentForRiskyApps like \"%true%\" - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product AllowUserConsentForRiskyApps + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product AllowUserConsentForRiskyApps | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_block_user_consent_for_risky_apps_disabled_filter`" diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index b2d0f57eab..5921cb5fd1 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -22,9 +22,8 @@ search: '`o365_management_activity` Operation="Set Company Information." Modifie | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by action dest user src vendor_account vendor_product ip_addresses_new_added + | stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by signature dest user src vendor_account vendor_product ip_addresses_new_added | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter`' diff --git a/detections/cloud/o365_compliance_content_search_exported.yml b/detections/cloud/o365_compliance_content_search_exported.yml index 91250f2771..d8ef313ffa 100644 --- a/detections/cloud/o365_compliance_content_search_exported.yml +++ b/detections/cloud/o365_compliance_content_search_exported.yml @@ -16,9 +16,8 @@ description: The following analytic identifies when the results of a content sea posture. search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation="SearchExported" | rename user_id as user - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product ExchangeLocations Query + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product ExchangeLocations Query | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_compliance_content_search_exported_filter`' diff --git a/detections/cloud/o365_compliance_content_search_started.yml b/detections/cloud/o365_compliance_content_search_started.yml index 717c5356d5..e4c07c7bf2 100644 --- a/detections/cloud/o365_compliance_content_search_started.yml +++ b/detections/cloud/o365_compliance_content_search_started.yml @@ -16,9 +16,8 @@ description: The following analytic detects when a content search is initiated w data. search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated | rename user_id as user - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product ExchangeLocations Query + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product ExchangeLocations Query | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_compliance_content_search_started_filter`' diff --git a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml index 24e69d72c0..f7b0e7fa7f 100644 --- a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml @@ -16,9 +16,8 @@ description: The following analytic identifies user sessions in Office 365 acces data_source: - O365 UserLoggedIn search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(src) as src by action dest user vendor_account vendor_product + | stats count min(_time) as firstTime max(_time) as lastTime values(src) as src by signature dest user vendor_account vendor_product | where mvcount(src) > 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml index a4396b3aed..aafe4636ea 100644 --- a/detections/cloud/o365_cross_tenant_access_change.yml +++ b/detections/cloud/o365_cross_tenant_access_change.yml @@ -17,10 +17,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN ( access setting.\") | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) - | rename Operation as signature, Id as signature_id - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id + | stats count min(_time) as firstTime max(_time) as lastTime by sigature dest user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`" diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 2cff372480..b74ac1f443 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -17,9 +17,9 @@ description: The following analytic identifies instances where Multi-Factor Auth data_source: - O365 Disable Strong Authentication. search: '`o365_management_activity` Operation="Disable Strong Authentication." - | rename command as action UserId as user object as src_user + | rename UserId as user object as src_user | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product src_user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product src_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_disable_mfa_filter`' @@ -44,7 +44,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $src_user$ has executed an operation $action$ for user $user$ + message: User $src_user$ has executed an operation $signature$ for user $user$ risk_objects: - field: user type: user diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index a8ccfa3956..a649675c52 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -19,7 +19,6 @@ search: "`o365_management_activity` Operation=DLPRuleMatch , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',\"\ Message Body\"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') - | rename command as action | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason | `security_content_ctime(firstTime)` diff --git a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml index 7076c41535..a2f2b47938 100644 --- a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml +++ b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml @@ -16,9 +16,8 @@ description: The following analytic identifies the assignment of elevated mailbo and potentially manipulate mailbox settings, posing a severe security risk. search: '`o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner) | rename Identity AS dest_user - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product dest_user + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product dest_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_elevated_mailbox_permission_assigned_filter`' diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index 1cf6b1155e..3734d422af 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -12,10 +12,9 @@ description: The following analytic identifies when a user with sufficient acces data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess - | rename InternetMessageId as signature_id, UserId as src_user - | rename command as action + | rename InternetMessageId as signature_id, UserId as src_user | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product src_user signature_id + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product src_user signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_access_by_security_administrator_filter`' diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index 72e62b40f7..890b073552 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -14,9 +14,9 @@ data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission | search RescanVerdict IN (Phish,Malware) - | rename Operation as action, Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user + | rename Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id dest_user src_user Subject SubmissionContent + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id dest_user src_user Subject SubmissionContent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_reported_by_admin_found_malicious_filter`' diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index 41d64a7d94..c907f6c149 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -21,9 +21,9 @@ search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation= | search RescanVerdict IN (Phish,Malware) | rex field=tsd "\<(?.+)\>" | eval src_user = case(isnull(src_user),tsd,true(),src_user) - | rename Operation as action, Name as signature, AlertId as signature_id, AlertEntityId as user, tsd as sender, ms as subject + | rename Name as signature, AlertId as signature_id, AlertEntityId as user, tsd as sender, ms as subject | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id src_user sender subject + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id src_user sender subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_reported_by_user_found_malicious_filter`' diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index 89535a31b6..c81ed93ced 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -13,9 +13,9 @@ description: The following analytic identifies when specific O365 advanced secur data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") - | rename Operation as action, Id as object_id, UserId as user, Operation as signature, ObjectId as object + | rename Id as object_id, UserId as user, Operation as signature, ObjectId as object | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature object_id object + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product signature object_id object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_security_feature_changed_filter`' diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index 92dd3020e6..9a3ab59202 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -15,9 +15,9 @@ data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded") | fromjson Data - | rename Operation as action, Name as signature, AlertId as signature_id, ObjectId as user + | rename Name as signature, AlertId as signature_id, ObjectId as user | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_suspicious_behavior_alert_filter`' diff --git a/detections/cloud/o365_email_transport_rule_changed.yml b/detections/cloud/o365_email_transport_rule_changed.yml index bd7a4f1ee2..915be8f702 100644 --- a/detections/cloud/o365_email_transport_rule_changed.yml +++ b/detections/cloud/o365_email_transport_rule_changed.yml @@ -11,8 +11,8 @@ data_source: search: |- `o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*TransportRule" | eval object_name = case('Parameters{}.Name'=="Name",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Name$")),true(),ObjectId), object_id = case('Parameters{}.Name'=="Identity",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Identity$")),true(),Id) - | stats values(object_name) as object_name, min(_time) as firstTime, max(_time) as lastTime, count by object_id, UserId, Operation - | rename UserId as user, Operation as signature + | stats values(object_name) as object_name, min(_time) as firstTime, max(_time) as lastTime, count by object_id, UserId, Operation, signature + | rename UserId as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_transport_rule_changed_filter` diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 244432a71d..e525cbffeb 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -14,9 +14,8 @@ description: The following analytic identifies an excessive number of authentica within the environment. data_source: [] search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure - | rename Operation as action | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS - user_agent values(status) AS status values(src_ip) AS src values(action) as action by user vendor_account vendor_product dest + user_agent values(status) AS status values(src_ip) AS src values(signature) as signature by user vendor_account vendor_product dest | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 5024d2e8a7..b839a28d7f 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -14,9 +14,8 @@ description: The following analytic detects accounts experiencing a high number movement within the organization. data_source: - O365 UserLoginFailed -search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed - | rename Operation as action - | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src vendor_account vendor_product dest action user_agent +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed + | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src vendor_account vendor_product dest signature user_agent | where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml index 994c69dc56..76dd77493e 100644 --- a/detections/cloud/o365_external_guest_user_invited.yml +++ b/detections/cloud/o365_external_guest_user_invited.yml @@ -24,9 +24,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory AND Operation= [ \\w-]+\\. [ \\w-]{2,4})\" | rename Operation as signature, Id as signature_id - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product signature signature_id src_user + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id src_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_guest_user_invited_filter`" diff --git a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml index 71886b8e8a..2df7f0c411 100644 --- a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml @@ -21,10 +21,9 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Co | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions \"Scope:(?[^,]+)\" | makemv delim=\" \" Scope - | search Scope IN (\"Files.Read\", \"Files.Read.All\", \"Files.ReadWrite\", \"Files.ReadWrite.All\", \"Files.ReadWrite.AppFolder\") - | rename command as action + | search Scope IN (\"Files.Read\", \"Files.Read.All\", \"Files.ReadWrite\", \"Files.ReadWrite.All\", \"Files.ReadWrite.AppFolder\") | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by action dest user src vendor_account vendor_product object ObjectId + | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_file_permissioned_application_consent_granted_by_user_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml index 916f3436a8..cc4e2ddf0d 100644 --- a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml +++ b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml @@ -20,9 +20,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Up | spath input=newvalue | search \"{}.ResourceAppId\"=\"00000002-0000-0ff1-ce00-000000000000\"\"{}.RequiredAppPermissions{}.EntitlementId\"=\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by action dest user src vendor_account vendor_product object user_agent + | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_fullaccessasapp_permission_assigned_filter`" diff --git a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml index 9cefde051b..f622c8d372 100644 --- a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml @@ -17,9 +17,8 @@ description: The following analytic identifies an O365 account experiencing more access and data breaches. search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon Workload=AzureActiveDirectory | bucket span=5m _time - | rename command as action | fillnull - | stats dc(_raw) AS failed_attempts values(src_ip) as src by action user _time dest vendor_account vendor_product + | stats dc(_raw) AS failed_attempts values(src_ip) as src by signature user _time dest vendor_account vendor_product | where failed_attempts > 10 | `o365_high_number_of_failed_authentications_for_user_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_high_privilege_role_granted.yml b/detections/cloud/o365_high_privilege_role_granted.yml index 7adfb192a8..e691520afc 100644 --- a/detections/cloud/o365_high_privilege_role_granted.yml +++ b/detections/cloud/o365_high_privilege_role_granted.yml @@ -19,9 +19,8 @@ search: "`o365_management_activity` Operation=\"Add member to role.\" Workload=A | eval role_id = mvindex('ModifiedProperties{}.NewValue',2) | eval role_name = mvindex('ModifiedProperties{}.NewValue',1) | where role_id IN (\"29232cdf-9323-42fd-ade2-1d097af3e4de\", \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\", \"62e90394-69f5-4237-9190-012177145e10\") - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product ObjectId role_name role_id + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product ObjectId role_name role_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_high_privilege_role_granted_filter`" diff --git a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml index 5bfac56963..1c0c53d253 100644 --- a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml @@ -23,9 +23,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Co | rex field=permissions \"Scope:(?[^,]+)\" | makemv delim=\" \" Scope | search Scope IN (\"Mail.Read\", \"Mail.ReadBasic\", \"Mail.ReadWrite\", \"Mail.Read.Shared\", \"Mail.ReadWrite.Shared\", \"Mail.Send\", \"Mail.Send.Shared\") - | rename command as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by action dest user src vendor_account vendor_product object ObjectId + | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_mail_permissioned_application_consent_granted_by_user_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml index 8131fc9d16..16a0cc2c0c 100644 --- a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml +++ b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml @@ -20,8 +20,8 @@ search: "`o365_management_activity` Operation=Set-Mailbox | where match1>= 0 OR match2>= 0 | eval ForwardTo=coalesce(ForwardingAddress,ForwardingSmtpAddress) | search ForwardTo!=\"\" - | rename user_id as user, Operation as action - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ForwardTo) as ForwardTo by action dest user src vendor_account vendor_product object ObjectId + | rename user_id as user + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ForwardTo) as ForwardTo by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_email_forwarding_enabled_filter`" diff --git a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml index cc0b18fbcf..8a6736ce8f 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml @@ -16,8 +16,8 @@ description: The following analytic identifies instances where read permissions the confidentiality of organizational communications. search: "`o365_management_activity` Workload=Exchange (Operation=ModifyFolderPermissions OR Operation=AddFolderPermissions) Workload=Exchange object!=Calendar object!=Contacts object!=PersonMetadata | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") - | rename UserId as user, Operation as action - | stats count earliest(_time) as firstTime latest(_time) as lastTime by action user object dest Item.ParentFolder.MemberUpn Item.ParentFolder.MemberRights src vendor_account vendor_product + | rename UserId as user + | stats count earliest(_time) as firstTime latest(_time) as lastTime by signature user object dest Item.ParentFolder.MemberUpn Item.ParentFolder.MemberRights src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_assigned_filter`" diff --git a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml index 8bb4e9bf08..28a54a9e8e 100644 --- a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml +++ b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml @@ -17,10 +17,9 @@ description: The following analytic identifies instances where read permissions search: '`o365_management_activity` Workload=Exchange (Operation="Set-MailboxFolderPermission" OR Operation="Add-MailboxFolderPermission" ) | eval isReadRole=if(match(AccessRights,"^(ReadItems|Author|NonEditingAuthor|Owner|PublishingAuthor|Reviewer)$"), "true", "false") | search isReadRole="true" - | rename UserId as user - | rename Operation as action + | rename UserId as user | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product Identity AccessRights + | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product Identity AccessRights | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_granted_filter`' diff --git a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml index 43d60f90fe..59112bafb7 100644 --- a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml +++ b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml @@ -18,9 +18,9 @@ description: The following analytic detects instances where the inbox folder of search: "`o365_management_activity` Operation=ModifyFolderPermissions Workload=Exchange object=Inbox Item.ParentFolder.MemberUpn=Everyone | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") | search isReadRole = \"true\" - | rename Operation as action, UserId as user + | rename UserId as user | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime by action, user, dest, vendor_account, vendor_product, object, MailboxOwnerUPN, Item.ParentFolder.MemberUpn, Item.ParentFolder.MemberRights + | stats count earliest(_time) as firstTime latest(_time) as lastTime by signature, user, dest, vendor_account, vendor_product, object, MailboxOwnerUPN, Item.ParentFolder.MemberUpn, Item.ParentFolder.MemberRights, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_inbox_folder_shared_with_all_users_filter`" diff --git a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml index 1944436f12..ad7a34b3b7 100644 --- a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml +++ b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml @@ -22,9 +22,8 @@ search: "`o365_management_activity` Operation=\"Update application.\" | spath input=json_data path=RequiredAppPermissions{}.EntitlementId output=EntitlementIds | eval match_found=mvfind(EntitlementIds, \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\") | where isnotnull(match_found) - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime max(_time) as lastTime values(EntitlementIds) as EntitlementIds by action, user, dest, vendor_account, vendor_product, object + | stats count earliest(_time) as firstTime max(_time) as lastTime values(EntitlementIds) as EntitlementIds by signature, user, dest, vendor_account, vendor_product, object, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_read_access_granted_to_application_filter`" diff --git a/detections/cloud/o365_multi_source_failed_authentications_spike.yml b/detections/cloud/o365_multi_source_failed_authentications_spike.yml index 3c3fd4bc95..013cdf603f 100644 --- a/detections/cloud/o365_multi_source_failed_authentications_spike.yml +++ b/detections/cloud/o365_multi_source_failed_authentications_spike.yml @@ -18,9 +18,8 @@ description: The following analytic identifies a spike in failed authentication search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126 | bucket span=5m _time | eval uniqueIPUserCombo = src_ip . "-" . user - | rename Operation as action | fillnull - | stats earliest(_time) as firstTime max(_time) as lastTime dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, values(user) as user, values(src_ip) as ips, values(user_agent) as user_agents values(action) as action values(src) as src values(dest) as dest by _time vendor_account vendor_product + | stats earliest(_time) as firstTime max(_time) as lastTime dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, values(user) as user, values(src_ip) as ips, values(user_agent) as user_agents values(signature) as signature values(src) as src values(dest) as dest by _time vendor_account vendor_product | where uniqueIpUserCombinations > 20 AND uniqueUsers > 20 AND uniqueIPs > 20 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml index a231372892..8109ffc7df 100644 --- a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml +++ b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml @@ -19,8 +19,7 @@ description: The following analytic identifies unusual authentication activity i exploitation. search: '`o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed) | bucket span=5m _time - | rename Operation as action - | stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(action) as action by _time user src vendor_account vendor_product dest + | stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(signature) as signature by _time user src vendor_account vendor_product dest | where failed_attempts > 5 and unique_user_agents > 5 and unique_app_ids > 2 | `o365_multiple_appids_and_useragents_authentication_spike_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml index d1c04ab8b1..b312524492 100644 --- a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml +++ b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml @@ -20,9 +20,8 @@ search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccesse | bucket span=10m _time | eval matchRegex=if(match(ClientInfoString,"^Client=WebServices;ExchangeWebServices"), 1, 0) | search (AppId="00000003-0000-0000-c000-000000000000" OR matchRegex=1) - | rename Operation as action | fillnull - | stats values(ClientIPAddress) as src dc(user) as unique_mailboxes values(user) as user by _time ClientAppId ClientInfoString vendor_account vendor_product dest action + | stats values(ClientIPAddress) as src dc(user) as unique_mailboxes values(user) as user by _time ClientAppId ClientInfoString vendor_account vendor_product dest signature | where unique_mailboxes > 5 | `o365_multiple_mailboxes_accessed_via_api_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml index fc336ac3ec..34d48156bd 100644 --- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml @@ -12,9 +12,8 @@ search: |- `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) | eval -time = _time | bin _time span=15m - | rename Operation as action | fillnull - | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time, action, dest, vendor_account, vendor_product + | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time, dest, vendor_account, vendor_product | where os_count >= 4 | eval src = ClientIP, user = UserId | `security_content_ctime(firstTime)` diff --git a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml index 0bb33432f2..2b978de6aa 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml @@ -21,9 +21,9 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Ad | eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"ServicePrincipal\" | eval displayName = object - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest action + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src + by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_multiple_service_principals_created_by_user.yml b/detections/cloud/o365_multiple_service_principals_created_by_user.yml index 430b28d883..32204c6542 100644 --- a/detections/cloud/o365_multiple_service_principals_created_by_user.yml +++ b/detections/cloud/o365_multiple_service_principals_created_by_user.yml @@ -21,7 +21,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Ad | eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"User\" | eval displayName = object - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest action + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src + by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml index c33107d2ca..394a7a7278 100644 --- a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml @@ -18,9 +18,8 @@ description: The following analytic identifies instances where more than 10 uniq their security measures. search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126 | bucket span=5m _time - | rename Operation as action | fillnull - | stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as user_agent values(dest) as dest by _time src vendor_account vendor_product action + | stats dc(user) as unique_accounts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as user_agent values(dest) as dest by _time src vendor_account vendor_product | where unique_accounts > 10 | `o365_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_new_email_forwarding_rule_created.yml b/detections/cloud/o365_new_email_forwarding_rule_created.yml index 09d9ac9b0f..e8f5e3cada 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_created.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_created.yml @@ -19,10 +19,9 @@ search: "`o365_management_activity` (Operation=New-InboxRule OR Operation=set-In | eval match2=mvfind('Parameters{}.Name', \"ForwardAsAttachmentTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectTo\") | where match1>= 0 OR match2>= 0 OR match3>= 0 - | eval ForwardTo=coalesce(ForwardTo, ForwardAsAttachmentTo, RedirectTo) - | rename command as action + | eval ForwardTo=coalesce(ForwardTo, ForwardAsAttachmentTo, RedirectTo) | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by action dest user src vendor_account vendor_product ForwardTo + | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_created_filter`" diff --git a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml index d752f9af9b..04170b75f8 100644 --- a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml +++ b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml @@ -26,9 +26,8 @@ search: "`o365_management_activity` Workload=Exchange Operation=UpdateInboxRules | eval ForwardTo=if(match(valueExtracted,\"^[^@]+@[^@]+\\\\.[^@]+$\"), valueExtracted, null) | dedup ForwardTo | where isnotnull(ForwardTo) - | rename Operation as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by action dest user src vendor_account vendor_product ForwardTo + | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_enabled_filter`" diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 14538d698e..f302f166cd 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -16,10 +16,9 @@ description: The following analytic identifies the addition of a new federated d data_source: - O365 search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" - | rename Operation as action | eval src="NA" | fillnull - | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent authentication_service action Workload src vendor_account vendor_product dest + | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent authentication_service signature Workload src vendor_account vendor_product dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' diff --git a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml index dc10e44ab3..65cfb7260a 100644 --- a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml +++ b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml @@ -21,9 +21,8 @@ search: "`o365_management_activity` Workload=Exchange Operation=\"New-TransportR | eval ForwardTo=coalesce(BlindCopyTo, CopyTo, RedirectMessageTo) | search ForwardTo!=\"\" | rename UserId as user - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, ForwardTo, vendor_account, vendor_product, dest, action + | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, ForwardTo, vendor_account, vendor_product, dest, signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_forwarding_mailflow_rule_created_filter`" diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml index fb25641ee6..ef74201b99 100644 --- a/detections/cloud/o365_new_mfa_method_registered.yml +++ b/detections/cloud/o365_new_mfa_method_registered.yml @@ -24,9 +24,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Up | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) | where count_new_method_type > count_old_method_type - | rename Operation as action | fillnull - | stats earliest(_time) as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue vendor_account vendor_product dest action src + | stats earliest(_time) as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue vendor_account vendor_product dest signature src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_mfa_method_registered_filter`" diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml index db5e078758..e36aafd7d8 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml @@ -17,9 +17,8 @@ description: The following analytic detects when emails are accessed in Office 3 data exfiltration, or further compromise of sensitive information. search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=* | regex ClientInfoString="^Client=WebServices;ExchangeWebServices" - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src by user ClientAppId OperationCount AppId vendor_account vendor_product dest action ClientInfoString + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src by user ClientAppId OperationCount AppId vendor_account vendor_product dest signature ClientInfoString | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_oauth_app_mailbox_access_via_ews_filter`' diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml index 9e80fd6a88..3c9624b3d0 100644 --- a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml +++ b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml @@ -15,9 +15,8 @@ description: The following analytic detects when emails are accessed in Office 3 attackers could exfiltrate sensitive information, compromise user accounts, and further infiltrate the organization's network. search: '`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* AppId=00000003-0000-0000-c000-000000000000 - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src by user ClientAppId OperationCount AppId vendor_account vendor_product dest action + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src by user ClientAppId OperationCount AppId vendor_account vendor_product dest signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_oauth_app_mailbox_access_via_graph_api_filter`' diff --git a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml index 5f4bc51217..84c35f4e88 100644 --- a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml +++ b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml @@ -20,9 +20,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Up | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent action vendor_account vendor_product dest + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent signature vendor_account vendor_product dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_graph_api_permission_assigned_filter`" diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 3d23771557..e2acc821e4 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -13,9 +13,8 @@ data_source: - Office 365 Universal Audit Log search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) - | rename Operation as action | fillnull - | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, action, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest + | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index 5d8bb35825..a88db27364 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -17,9 +17,8 @@ data_source: - Office 365 Universal Audit Log search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) - | rename Operation as action | fillnull - | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, action, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest + | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 4b4eacbbd8..40e83d72fa 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -17,9 +17,8 @@ description: The following analytic detects instances where a user has initiated data_source: - O365 search: '`o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" - | rename Operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId action Name user src vendor_account vendor_product dest + | stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Name user src vendor_account vendor_product dest signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`' @@ -45,7 +44,7 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: User $user$ has exported a PST file from the search using this operation- - $action$ with a severity of $Severity$ + $signature$ with a severity of $Severity$ risk_objects: - field: user type: user diff --git a/detections/cloud/o365_security_and_compliance_alert_triggered.yml b/detections/cloud/o365_security_and_compliance_alert_triggered.yml index 58374b6be1..d147e80b23 100644 --- a/detections/cloud/o365_security_and_compliance_alert_triggered.yml +++ b/detections/cloud/o365_security_and_compliance_alert_triggered.yml @@ -24,9 +24,8 @@ search: '`o365_management_activity` Workload=SecurityComplianceCenter Category=T | spath input=Data path=lon output=operation_name | spath input=Data path=an output=alert_name | spath input=Data path=sev output=severity - | rename operation as action | fillnull - | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, action, rule_id, alert_description, alert_name, severity, dest, src, vendor_account, vendor_product + | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, rule_id, alert_description, alert_name, severity, dest, src, vendor_account, vendor_product, signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_security_and_compliance_alert_triggered_filter`' diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml index 2467738cb8..f7ff2c9d10 100644 --- a/detections/cloud/o365_service_principal_new_client_credentials.yml +++ b/detections/cloud/o365_service_principal_new_client_credentials.yml @@ -16,9 +16,8 @@ description: The following analytic detects the addition of new credentials for data_source: - O365 search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Update application*Certificates and secrets management " - | rename Operation as action | fillnull - | stats earliest(_time) as firstTime latest(_time) as lastTime by user ModifiedProperties{}.NewValue object ObjectId dest action src vendor_account vendor_product + | stats earliest(_time) as firstTime latest(_time) as lastTime by user ModifiedProperties{}.NewValue object ObjectId dest signature src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_service_principal_new_client_credentials_filter`' diff --git a/detections/cloud/o365_service_principal_privilege_escalation.yml b/detections/cloud/o365_service_principal_privilege_escalation.yml index 35b70b2a49..a5a4322609 100644 --- a/detections/cloud/o365_service_principal_privilege_escalation.yml +++ b/detections/cloud/o365_service_principal_privilege_escalation.yml @@ -16,9 +16,8 @@ search: >- | spath input=appRole path=NewValue output=appRole | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal | where servicePrincipal=targetServicePrincipal - | rename Operation as action | fillnull - | stats earliest(_time) as firstTime latest(_time) as lastTime by action servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId user dest src vendor_account vendor_product + | stats earliest(_time) as firstTime latest(_time) as lastTime by servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId user dest src vendor_account vendor_product signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_service_principal_privilege_escalation_filter` diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 1279ef4c4c..f47fa5ff8a 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -15,7 +15,6 @@ data_source: - Office 365 Universal Audit Log search: "`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged \"ModifiedProperties{}.Name\"=AllowDomainList | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',\"\\.\\.\\.\",\"\"),\",\"), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',\"\\.\\.\\.\",\"\"),\",\") - | rename Operation as action | fillnull | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index 904987902f..ac0de7eae3 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -13,8 +13,8 @@ description: The following analytic identifies when a malicious file is detected data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Operation=FileMalwareDetected - | rename Operation as action, UserId as user, Id as signature_id - | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by signature_id, user, action, dest, src, vendor_account, vendor_product + | rename UserId as user, Id as signature_id + | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by signature_id, user, dest, src, vendor_account, vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_malware_detection_filter`' diff --git a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml index 0df1b7a792..2b359ed608 100644 --- a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml +++ b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml @@ -20,9 +20,8 @@ search: "`o365_management_activity` Operation=\"Consent to application.\" | rex field=new_field \"ConsentType: (?[^\\,]+)\" | rex field=new_field \"Scope: (?[^\\,]+)\" | search ConsentType = \"AllPrincipals\" - | rename Operation as action | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by action, user, object, ObjectId, ConsentType, Scope, dest, vendor_account, vendor_product + | stats count min(_time) as firstTime max(_time) as lastTime by user, object, ObjectId, ConsentType, Scope, dest, vendor_account, vendor_product, signature, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_tenant_wide_admin_consent_granted_filter`" diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index 0c619c0b66..3aa7820f71 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -14,10 +14,9 @@ description: The following analytic identifies when a malicious file is detected data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection - | rename Operation as action | eval dest="NA" | eval src="NA" - | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId, action, dest, src, vendor_account, vendor_product + | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId, signature, dest, src, vendor_account, vendor_product | rename Id as signature_id, UserId as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml index adc93bc23e..4e35136596 100644 --- a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml @@ -21,9 +21,8 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Co | eval reason =mvindex('ModifiedProperties{}.NewValue', 5) | search reason = \"Risky application detected\" | rex field=permissions \"Scope: (?[^,]+)\" - | rename Operation as action | fillnull - | stats max(_time) as lastTime by action, user, reason, object, Scope, dest, src, vendor_account, vendor_product + | stats max(_time) as lastTime by user, reason, object, Scope, dest, src, vendor_account, vendor_product, signature | `security_content_ctime(lastTime)` | `o365_user_consent_blocked_for_risky_application_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest diff --git a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml index c39c7a3140..dadc3f3a9d 100644 --- a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml +++ b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml @@ -16,9 +16,11 @@ description: The following analytic identifies instances where a user has denied or unfamiliar applications. If confirmed malicious, it suggests an attempt by a potentially harmful application to gain unauthorized access, which was proactively blocked by the user. -search: '`o365_graph` status.errorCode=65004 | rename userPrincipalName as user | - rename ipAddress as src_ip | stats max(_time) as lastTime by user src_ip appDisplayName - status.failureReason | `security_content_ctime(lastTime)` | `o365_user_consent_denied_for_oauth_application_filter`' +search: '`o365_graph` status.errorCode=65004 + | rename userPrincipalName as user + | rename ipAddress as src_ip + | stats max(_time) as lastTime by user src_ip appDisplayName status.failureReason dest vendor_account vendor_product + | `security_content_ctime(lastTime)` | `o365_user_consent_denied_for_oauth_application_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 events. known_false_positives: OAuth applications that require mail permissions may be legitimate, diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index c6ac1cb7f8..559fa63a3d 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -13,10 +13,9 @@ description: The following analytic detects when the Microsoft Zero-hour Automat data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*" - | fromjson Data - | rename Operation as action + | fromjson Data | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,action,Name,dest,src,vendor_account,vendor_product + | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,signature,Name,dest,src,vendor_account,vendor_product | rename Name as signature, AlertId as signature_id, trc as user | eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";") | `security_content_ctime(firstTime)` From 841518254714ffde80b22d6e6691a693e3b0de93 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 18 Mar 2025 08:08:43 +0100 Subject: [PATCH 07/29] improvements --- detections/cloud/o365_cross_tenant_access_change.yml | 2 +- detections/cloud/o365_email_security_feature_changed.yml | 2 +- .../cloud/o365_service_principal_privilege_escalation.yml | 2 +- .../o365_threat_intelligence_suspicious_file_detected.yml | 2 +- .../cloud/o365_user_consent_denied_for_oauth_application.yml | 4 ++-- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml index aafe4636ea..94d4591586 100644 --- a/detections/cloud/o365_cross_tenant_access_change.yml +++ b/detections/cloud/o365_cross_tenant_access_change.yml @@ -18,7 +18,7 @@ search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN ( | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"\ ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by sigature dest user src vendor_account vendor_product signature signature_id + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`" diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index c81ed93ced..0579615286 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -15,7 +15,7 @@ data_source: search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") | rename Id as object_id, UserId as user, Operation as signature, ObjectId as object | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product signature object_id object + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature object_id object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_security_feature_changed_filter`' diff --git a/detections/cloud/o365_service_principal_privilege_escalation.yml b/detections/cloud/o365_service_principal_privilege_escalation.yml index a5a4322609..459f5c9522 100644 --- a/detections/cloud/o365_service_principal_privilege_escalation.yml +++ b/detections/cloud/o365_service_principal_privilege_escalation.yml @@ -12,7 +12,7 @@ search: >- `o365_management_activity` Operation="Add app role assignment to service principal." "Actor{}.ID"=ServicePrincipal ResultStatus=Success | spath path=ModifiedProperties{} output=targetResources | eval src="NA" - | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id user dest src vendor_account vendor_product + | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id user dest src vendor_account vendor_product signature | spath input=appRole path=NewValue output=appRole | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal | where servicePrincipal=targetServicePrincipal diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index 3aa7820f71..efc8c5ab60 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -16,7 +16,7 @@ data_source: search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection | eval dest="NA" | eval src="NA" - | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId, signature, dest, src, vendor_account, vendor_product + | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId, dest, src, vendor_account, vendor_product | rename Id as signature_id, UserId as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml index dadc3f3a9d..084d3600a1 100644 --- a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml +++ b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml @@ -19,8 +19,8 @@ description: The following analytic identifies instances where a user has denied search: '`o365_graph` status.errorCode=65004 | rename userPrincipalName as user | rename ipAddress as src_ip - | stats max(_time) as lastTime by user src_ip appDisplayName status.failureReason dest vendor_account vendor_product - | `security_content_ctime(lastTime)` | `o365_user_consent_denied_for_oauth_application_filter`' + | stats min(_time) as firstTime max(_time) as lastTime by user src_ip appDisplayName status.failureReason + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_user_consent_denied_for_oauth_application_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 events. known_false_positives: OAuth applications that require mail permissions may be legitimate, From 33461bfe7ce0a161863fd5d79fa758dd904a5595 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Tue, 18 Mar 2025 08:13:17 +0100 Subject: [PATCH 08/29] improvements --- .../high_number_of_login_failures_from_a_single_source.yml | 2 +- detections/cloud/o365_email_transport_rule_changed.yml | 2 +- .../cloud/o365_user_consent_denied_for_oauth_application.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml index aa8606aae6..86b213d85a 100644 --- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -1,6 +1,6 @@ name: High Number of Login Failures from a single source id: 7f398cfb-918d-41f4-8db8-2e2474e02222 -version: 6 +version: 7 date: '2025-02-10' author: Bhavin Patel, Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/o365_email_transport_rule_changed.yml b/detections/cloud/o365_email_transport_rule_changed.yml index 915be8f702..0ed0b44614 100644 --- a/detections/cloud/o365_email_transport_rule_changed.yml +++ b/detections/cloud/o365_email_transport_rule_changed.yml @@ -1,6 +1,6 @@ name: O365 Email Transport Rule Changed id: 11ebb7c2-46bd-41c9-81e1-d0b4b34583a2 -version: 1 +version: 2 date: '2025-01-15' author: Steven Dick status: production diff --git a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml index 084d3600a1..9ff38e49ca 100644 --- a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml +++ b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml @@ -1,6 +1,6 @@ name: O365 User Consent Denied for OAuth Application id: 2d8679ef-b075-46be-8059-c25116cb1072 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production From e38e2834131834e3abc7e39047eab8128a1f3a55 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 Mar 2025 10:19:14 -0600 Subject: [PATCH 09/29] Add new detection for process injection into commonly abused processes Replacing #3389 --- ...injection_into_commonly_abused_process.yml | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 detections/endpoint/windows_process_injection_into_commonly_abused_process.yml diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml new file mode 100644 index 0000000000..8be1ce2cfa --- /dev/null +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml @@ -0,0 +1,79 @@ +name: Windows Process Injection into Commonly Abused Process +id: b8340d0f-ba48-4391-bea7-9e793x5aae32 +version: 7 +date: '2025-03-19' +author: 0xC0FFEEEE, Github Community +type: Anomaly +status: production +data_source: +- Sysmon EventID 10 +description: The following analytic detects process injection into executables that are commonly abused using + Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) + to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program + Files. This behavior is often associated with the SliverC2 framework by BishopFox. + Monitoring this activity is crucial as it may indicate an initial payload attempting + to execute malicious code. If confirmed malicious, this could + allow attackers to execute arbitrary code, potentially leading to privilege escalation + or persistent access within the environment. +search: '`sysmon` EventCode=10 TargetImage IN ("*\\notepad.exe", "*\\wordpad.exe", "*\\calc.exe", "*\\mspaint.exe", "*\\lsass.exe", "*\\svchost.exe", "*\\backgroundtaskhost.exe", "*\\dllhost.exe", "*\\regsvr32.exe", "*\\searchprotocolhost.exe", "*\\werfault.exe", "*\\wuauclt.exe", "*\\spoolsv.exe", "*\\chrome.exe", "*\\edge.exe", "*\\firefox.exe") NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*", "*\\Program Files (x86)\\*")) GrantedAccess IN ("0x40","0x1fffff", "0x1f3fff") + | stats values(user) as user, min(_time) as firstTime, max(_time) as lastTime, count by dest SourceImage TargetImage GrantedAccess CallTrace + | eval CallTrace=split(CallTrace, "|") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime lastTime dest user SourceImage TargetImage GrantedAccess CallTrace count + | `windows_process_injection_into_commonly_abused_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present based on SourceImage paths, particularly those with a legitimate reason for accessing lsass.exe or regsvr32.exe. + If removing the paths is important, realize svchost and many native binaries inject + into processes consistently. Restrict or tune as needed. +references: +- https://dominicbreuker.com/post/learning_sliver_c2_08_implant_basics/ +- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors +- https://redcanary.com/threat-detection-report/techniques/process-injection/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $SourceImage$ injecting into $TargetImage$ was identified + on endpoint $dest$. + risk_objects: + - field: dest + type: system + score: 32 + threat_objects: + - field: SourceImage + type: process + - field: TargetImage + type: process +tags: + analytic_story: + - BishopFox Sliver Adversary Emulation Framework + asset_type: Endpoint + mitre_attack_id: + - T1055.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file From feb0f44dadbde35675cd746d90ed91789f1af432 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 Mar 2025 10:25:30 -0600 Subject: [PATCH 10/29] updates --- ...windows_process_injection_into_commonly_abused_process.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml index 8be1ce2cfa..2afba0b8c5 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml @@ -1,6 +1,6 @@ name: Windows Process Injection into Commonly Abused Process -id: b8340d0f-ba48-4391-bea7-9e793x5aae32 -version: 7 +id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 +version: 1 date: '2025-03-19' author: 0xC0FFEEEE, Github Community type: Anomaly From 912238a4a41630eaa4d73884ebab6ed483c42bca Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 21 Mar 2025 11:54:03 -0700 Subject: [PATCH 11/29] move to prodcution after testing --- ..._defense_security_alerts_by_application_name.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index 4df84aed86..60f7925abc 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -3,7 +3,7 @@ id: 105e4a69-ec55-49fc-be1f-902467435ea8 version: 1 date: '2025-02-14' author: Bhavin Patel, Splunk -status: experimental +status: production type: Anomaly description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity. data_source: @@ -43,8 +43,12 @@ references: - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html drilldown_searches: -- name: View risk events for the last 7 days for - "$application_id$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$application_id$" ) starthoursago=168 | stats count min(_time) +- name: View the detection results for - "$app_name$" + search: '%original_detection_search% | search app_name = "$app_name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$app_name$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$app_name$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -67,9 +71,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint +manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json source: cisco_ai_defense sourcetype: cisco:ai:defense \ No newline at end of file From 20f1307ddf8cec6877ae8274d075059a12c9ac9f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 21 Mar 2025 11:54:35 -0700 Subject: [PATCH 12/29] updating date --- .../cisco_ai_defense_security_alerts_by_application_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index 60f7925abc..df73fb4226 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -1,7 +1,7 @@ name: Cisco AI Defense Security Alerts by Application Name id: 105e4a69-ec55-49fc-be1f-902467435ea8 -version: 1 -date: '2025-02-14' +version: 2 +date: '2025-03-21' author: Bhavin Patel, Splunk status: production type: Anomaly From 30135a6a154c6328678db590a6937a1da0895711 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 21 Mar 2025 11:56:19 -0700 Subject: [PATCH 13/29] dd udpate --- ...sco_ai_defense_security_alerts_by_application_name.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index df73fb4226..9408a25a76 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -43,12 +43,12 @@ references: - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html drilldown_searches: -- name: View the detection results for - "$app_name$" - search: '%original_detection_search% | search app_name = "$app_name$"' +- name: View the detection results for - "$application_name$" + search: '%original_detection_search% | search application_name = "$application_name$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$app_name$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$app_name$") starthoursago=168 | stats count min(_time) +- name: View risk events for the last 7 days for - "$application_name$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$application_name$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" From cacaa8ac075f974d4ed320838388215260269951 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 21 Mar 2025 11:58:12 -0700 Subject: [PATCH 14/29] yaml update --- .../cisco_ai_defense_security_alerts_by_application_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index 9408a25a76..99d73f13f8 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -71,7 +71,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint -manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. tests: - name: True Positive Test attack_data: From e6b1c4d102cb58c5bcf74244e132a97102e135f5 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 24 Mar 2025 13:43:51 -0600 Subject: [PATCH 15/29] The Haag Has Landed: VanHelsing's Revenge Added VanHelsing Ransomware analytic story and associated it with relevant detections. Updated 7 existing detections to include VanHelsing Ransomware in their analytic stories: - detect_renamed_psexec.yml - detect_psexec_with_accepteula_flag.yml - executable_file_written_in_administrative_smb_share.yml - deleting_shadow_copies.yml - delete_shadowcopy_with_powershell.yml - detect_copy_of_shadowcopy_with_script_block_logging.yml - resize_shadowstorage_volume.yml - Updated ransomware extensions The story provides comprehensive coverage of this new ransomware-as-a-service threat, focusing on its key TTPs including shadow copy deletion, process hollowing, and encryption behaviors. --- .../endpoint/common_ransomware_extensions.yml | 4 ++-- .../delete_shadowcopy_with_powershell.yml | 5 ++-- .../endpoint/deleting_shadow_copies.yml | 5 ++-- ...f_shadowcopy_with_script_block_logging.yml | 5 ++-- .../detect_psexec_with_accepteula_flag.yml | 5 ++-- detections/endpoint/detect_renamed_psexec.yml | 5 ++-- ...le_written_in_administrative_smb_share.yml | 5 ++-- .../endpoint/resize_shadowstorage_volume.yml | 5 ++-- lookups/ransomware_extensions_lookup.csv | 4 +++- stories/vanhelsing_ransomware.yml | 24 +++++++++++++++++++ 10 files changed, 50 insertions(+), 17 deletions(-) create mode 100644 stories/vanhelsing_ransomware.yml diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 079d11de57..14195a6871 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,7 +1,7 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: '12' -date: '2025-03-03' +version: '13' +date: '2025-03-25' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production type: TTP diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 5b45b2d365..9e9208a89a 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -1,7 +1,7 @@ name: Delete ShadowCopy With PowerShell id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-03-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,6 +57,7 @@ tags: - Ransomware - Revil Ransomware - DarkGate Malware + - VanHelsing Ransomware asset_type: Endpoint mitre_attack_id: - T1490 diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index ed825e84fd..10f73b29f8 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -1,7 +1,7 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e -version: '11' -date: '2025-03-03' +version: '12' +date: '2025-03-25' author: David Dorsey, Splunk status: production type: TTP @@ -81,6 +81,7 @@ tags: - Windows Log Manipulation - Compromised Windows Host - Clop Ransomware + - VanHelsing Ransomware asset_type: Endpoint mitre_attack_id: - T1490 diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index 5ba7b43a6d..0cf2e7f6aa 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -1,7 +1,7 @@ name: Detect Copy of ShadowCopy with Script Block Logging id: 9251299c-ea5b-11eb-a8de-acde48001122 -version: 6 -date: '2025-02-10' +version: 7 +date: '2025-03-25' author: Michael Haag, Splunk status: production type: TTP @@ -56,6 +56,7 @@ rba: tags: analytic_story: - Credential Dumping + - VanHelsing Ransomware asset_type: Endpoint cve: - CVE-2021-36934 diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index f1974ad052..3fa6cd793e 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -1,7 +1,7 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 -version: 10 -date: '2025-02-10' +version: 11 +date: '2025-03-25' author: Bhavin Patel, Splunk status: production type: TTP @@ -81,6 +81,7 @@ tags: - BlackByte Ransomware - DarkGate Malware - Rhysida Ransomware + - VanHelsing Ransomware asset_type: Endpoint mitre_attack_id: - T1021.002 diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 9e1fbafe91..a812fd298b 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: '12' -date: '2025-02-24' +version: '13' +date: '2025-03-25' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting @@ -51,6 +51,7 @@ tags: - Rhysida Ransomware - Earth Estries - SamSam Ransomware + - VanHelsing Ransomware asset_type: Endpoint mitre_attack_id: - T1569.002 diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 17986ee585..6ca58b898b 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -1,7 +1,7 @@ name: Executable File Written in Administrative SMB Share id: f63c34fe-a435-11eb-935a-acde48001122 -version: 8 -date: '2025-02-10' +version: 9 +date: '2025-03-25' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -66,6 +66,7 @@ tags: - Compromised Windows Host - Hermetic Wiper - Trickbot + - VanHelsing Ransomware asset_type: Endpoint mitre_attack_id: - T1021.002 diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 9f1d18a373..56fa0680a6 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -1,7 +1,7 @@ name: Resize ShadowStorage volume id: bc760ca6-8336-11eb-bcbb-acde48001122 -version: 5 -date: '2024-12-10' +version: 6 +date: '2025-03-25' author: Teoderick Contreras status: production type: TTP @@ -73,6 +73,7 @@ tags: - Compromised Windows Host - Clop Ransomware - BlackByte Ransomware + - VanHelsing Ransomware asset_type: Endpoint mitre_attack_id: - T1490 diff --git a/lookups/ransomware_extensions_lookup.csv b/lookups/ransomware_extensions_lookup.csv index c6cb398475..6dfb767f49 100644 --- a/lookups/ransomware_extensions_lookup.csv +++ b/lookups/ransomware_extensions_lookup.csv @@ -301,4 +301,6 @@ Extensions,Name *.reddot,RedDot *.MEDUSA,Medusa *.rhysida,Rhysida -*.basta, BlackBasta \ No newline at end of file +*.basta, BlackBasta +*.vanhelsing,Vanhelsing +*.vanlocker,Vanhelsing \ No newline at end of file diff --git a/stories/vanhelsing_ransomware.yml b/stories/vanhelsing_ransomware.yml new file mode 100644 index 0000000000..8d4feb05c8 --- /dev/null +++ b/stories/vanhelsing_ransomware.yml @@ -0,0 +1,24 @@ +name: VanHelsing Ransomware +id: 6de5e506-b846-4184-90f6-feb0b84418ab +version: 1 +status: production +date: '2025-03-24' +author: Michael Haag, Splunk +description: VanHelsing is a rapidly growing ransomware-as-a-service (RaaS) program launched in March 2025. The ransomware targets Windows systems with additional variants for Linux, BSD, ARM, and ESXi systems. It uses various techniques including shadow copy deletion, process hollowing, and command-line arguments to control encryption behavior. Files are encrypted with the .vanhelsing extension, and a ransom note (README.txt) is dropped in each folder. + +narrative: VanHelsingRaaS emerged as a new ransomware threat in March 2025, quickly gaining traction in the cybercrime landscape. The RaaS program allows affiliates to join with a $5,000 deposit, offering them 80% of the ransom payments while operators retain 20%. The ransomware demonstrates sophisticated capabilities through its multi-stage attack process. + The initial access and execution phase typically involves lateral movement using PsExec, with the ransomware supporting multiple command-line arguments for customized execution. To maintain control over its operation, it creates a mutex "Global\VanHelsing" to prevent multiple instances from running simultaneously. + For defense evasion, the ransomware employs several sophisticated techniques. It attempts to delete shadow copies using various methods to prevent system recovery, includes stealth options like --Silent and --no-logs to minimize detection, and utilizes process hollowing techniques to evade security controls. + The ransomware's impact on target systems is extensive. It encrypts files with the .vanhelsing extension and drops a ransom note named README.txt in each folder it processes. The malware changes the desktop background to a custom image (vhlocker.png) and targets both local and network drives. During encryption, files are processed in chunks of approximately 1MB to optimize performance. + For communication and payment, VanHelsing utilizes onion domains for ransom negotiation and TOX for secure communication with victims. The operators demand payment in Bitcoin, with known ransom demands reaching approximately $500,000. Notably, the ransomware specifically avoids targeting CIS (Commonwealth of Independent States) countries, a common practice among Russian cybercrime groups. Within just two weeks of its launch, VanHelsing had already claimed multiple victims, demonstrating its rapid adoption and effectiveness as a ransomware threat. +references: + - https://research.checkpoint.com/2025/vanhelsing-new-raas-in-town/ +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: [] From 5bb6ac53b369d159e24241096431ea151e37efba Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 24 Mar 2025 14:41:21 -0700 Subject: [PATCH 16/29] Empty commit From 87eeec65a645c1ffb8d7c0fce0a3595cecf8b5da Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 25 Mar 2025 11:21:38 -0700 Subject: [PATCH 17/29] updating dates and verrsion --- detections/cloud/o365_dlp_rule_triggered.yml | 30 +++++++++---------- ...email_access_by_security_administrator.yml | 19 +++++------- ...mail_reported_by_admin_found_malicious.yml | 24 +++++++-------- ...email_reported_by_user_found_malicious.yml | 29 +++++++----------- .../o365_email_security_feature_changed.yml | 20 ++++++------- .../o365_email_suspicious_behavior_alert.yml | 22 +++++++------- .../cloud/o365_safe_links_detection.yml | 21 ++++++------- ...repoint_allowed_domains_policy_changed.yml | 30 ++++++++++--------- .../o365_sharepoint_malware_detection.yml | 17 +++++------ ...ntelligence_suspicious_email_delivered.yml | 23 +++++++------- ..._intelligence_suspicious_file_detected.yml | 22 +++++++------- .../cloud/o365_zap_activity_detection.yml | 24 +++++++-------- 12 files changed, 129 insertions(+), 152 deletions(-) diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index a649675c52..b415c3f906 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -1,7 +1,7 @@ name: O365 DLP Rule Triggered id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871 -version: 5 -date: '2024-11-14' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: Anomaly @@ -9,21 +9,20 @@ description: The following analytic detects when Microsoft Office 365 Data Loss (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should - be evaluated thoroughly to determine what, if any, security relevance the underlying + be evaluated thoroughly to de termine what, if any, security relevance the underlying DLP events contain. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Operation=DLPRuleMatch - | eval recipient = 'ExchangeMetaData.To{}', - signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' - , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', - result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',\"\ - Message Body\"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_dlp_rule_triggered_filter` " +search: '`o365_management_activity` Operation=DLPRuleMatch | eval recipient = ''ExchangeMetaData.To{}'', + signature_id = ''ExchangeMetaData.UniqueID'', signature = ''PolicyDetails{}.Rules{}.RuleName'' + , src_user = UserId, reason =''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName'', + result=''PolicyDetails{}.Rules{}.Actions{}'', file_name=case(NOT match(''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'',"Message + Body"),''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'') + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(signature) + as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS + subject values(Workload) as app values(result) as result by action dest user src + vendor_account vendor_product src_user recipient signature_id reason | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_dlp_rule_triggered_filter` ' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions. @@ -67,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index 3734d422af..6217ac1cf1 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -1,7 +1,7 @@ name: O365 Email Access By Security Administrator id: c6998a30-fef4-4e89-97ac-3bb0123719b4 -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -11,13 +11,11 @@ description: The following analytic identifies when a user with sufficient acces this premium feature to enumerate or exfiltrate sensitive data. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess - | rename InternetMessageId as signature_id, UserId as src_user - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product src_user signature_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_email_access_by_security_administrator_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess + | rename InternetMessageId as signature_id, UserId as src_user | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by signature dest user src + vendor_account vendor_product src_user signature_id | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_email_access_by_security_administrator_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license. @@ -66,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index 890b073552..e83d8cd89f 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -1,7 +1,7 @@ name: O365 Email Reported By Admin Found Malicious id: 94396c3e-7728-422a-9956-e4b77b53dbdf -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -12,14 +12,12 @@ description: The following analytic detects when an email manually submitted to that returns a Phish or Malware verdict upon submission. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission - | search RescanVerdict IN (Phish,Malware) - | rename Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id dest_user src_user Subject SubmissionContent - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_email_reported_by_admin_found_malicious_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission + | search RescanVerdict IN (Phish,Malware) | rename Id as signature_id, SenderIP + as src, Recipients{} as dest_user, P1Sender as src_user | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product + signature signature_id dest_user src_user Subject SubmissionContent | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_email_reported_by_admin_found_malicious_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: Administrators that submit known phishing training exercises. @@ -40,8 +38,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: O365 security admin $user$ manually reported a suspicious email - from $src_user$ + message: O365 security admin $user$ manually reported a suspicious email from $src_user$ risk_objects: - field: src_user type: user @@ -68,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index c907f6c149..91d01bf2a6 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -1,7 +1,7 @@ name: O365 Email Reported By User Found Malicious id: 7698b945-238e-4bb9-b172-81f5ca1685a1 -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -13,20 +13,14 @@ description: The following analytic detects when an email submitted to Microsoft data_source: - Office 365 Universal Audit Log search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated - Name="Email reported by user as*" - | fromjson Data - | rename _raw AS temp etps AS _raw - | extract pairdelim=";" kvdelim=":" - | rename _raw AS etps temp AS _raw - | search RescanVerdict IN (Phish,Malware) - | rex field=tsd "\<(?.+)\>" - | eval src_user = case(isnull(src_user),tsd,true(),src_user) - | rename Name as signature, AlertId as signature_id, AlertEntityId as user, tsd as sender, ms as subject - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id src_user sender subject - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_email_reported_by_user_found_malicious_filter`' + Name="Email reported by user as*" | fromjson Data | rename _raw AS temp etps AS + _raw | extract pairdelim=";" kvdelim=":" | rename _raw AS etps temp AS _raw | search + RescanVerdict IN (Phish,Malware) | rex field=tsd "\<(?.+)\>" | eval src_user + = case(isnull(src_user),tsd,true(),src_user) | rename Name as signature, AlertId + as signature_id, AlertEntityId as user, tsd as sender, ms as subject | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account + vendor_product signature signature_id src_user sender subject | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_email_reported_by_user_found_malicious_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy/allow the usage of the Microsoft Office Report A Message function. @@ -75,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index 0579615286..cae21b79ab 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -1,7 +1,7 @@ name: O365 Email Security Feature Changed id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -12,13 +12,12 @@ description: The following analytic identifies when specific O365 advanced secur compromise, or other malicious activities without leaving a detailed audit trail. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") - | rename Id as object_id, UserId as user, Operation as signature, ObjectId as object - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature object_id object - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_email_security_feature_changed_filter`' +search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") + Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") | rename + Id as object_id, UserId as user, Operation as signature, ObjectId as object | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account + vendor_product signature object_id object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_email_security_feature_changed_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators might alter features for troubleshooting, performance @@ -63,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index 9a3ab59202..bc09714a4a 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -1,7 +1,7 @@ name: O365 Email Suspicious Behavior Alert id: 85c7555a-05af-4322-81aa-76b4ddf52baa -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -13,14 +13,13 @@ description: The following analytic identifies when one of O365 the built-in sec functions. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded") - | fromjson Data - | rename Name as signature, AlertId as signature_id, ObjectId as user - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_email_suspicious_behavior_alert_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated + Name IN ("Suspicious email sending patterns detected","User restricted from sending + email","Suspicious Email Forwarding Activity","Email sending limit exceeded") | + fromjson Data | rename Name as signature, AlertId as signature_id, ObjectId as user + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_email_suspicious_behavior_alert_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The alerts must be enabled in the o365 security portal. @@ -65,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml index f525db519d..338d17b504 100644 --- a/detections/cloud/o365_safe_links_detection.yml +++ b/detections/cloud/o365_safe_links_detection.yml @@ -1,7 +1,7 @@ name: O365 Safe Links Detection id: 711d9e8c-2cb0-45cf-8813-5f191ecb9b26 -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -10,14 +10,12 @@ description: The following analytic detects when any Microsoft Safe Links alerti or otherwise malicious link within the Microsoft Office ecosystem. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated - | fromjson Data - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(ObjectId) as url values(od) as desc by AlertId, trc, Name, ot, dest, vendor_account, vendor_product, src - | rename Name as signature, AlertId as signature_id, trc as user, ot as action - | eval action = CASE(action == "Allowed", "allowed", action=="BlockPageOverride", "allowed", true(),"blocked") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated + | fromjson Data | fillnull | stats count min(_time) as firstTime max(_time) as lastTime + values(ObjectId) as url values(od) as desc by AlertId, trc, Name, ot, dest, vendor_account, + vendor_product, src | rename Name as signature, AlertId as signature_id, trc as + user, ot as action | eval action = CASE(action == "Allowed", "allowed", action=="BlockPageOverride", + "allowed", true(),"blocked") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_safe_links_detection_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The Safe Links capability must be configured @@ -62,7 +60,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index f47fa5ff8a..7b2e53b44d 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -1,7 +1,7 @@ name: O365 SharePoint Allowed Domains Policy Changed id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c -version: 6 -date: '2024-11-14' +version: 7 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -13,16 +13,19 @@ description: The following analytic identifies when the allowed domain settings access. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged \"ModifiedProperties{}.Name\"=AllowDomainList - | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',\"\\.\\.\\.\",\"\"),\",\"), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',\"\\.\\.\\.\",\"\"),\",\") - | fillnull - | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product - | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) - | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) - | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\",isnotnull(diff_remove),\"deleted\") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_sharepoint_allowed_domains_policy_changed_filter`" +search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged + "ModifiedProperties{}.Name"=AllowDomainList | eval signature_id = CorrelationId, + signature=Operation, src = ClientIP, user = UserId, object_name=''ModifiedProperties{}.Name'', + object_attrs_new = split(replace(''ModifiedProperties{}.NewValue'',"\.\.\.",""),","), + object_attrs_old = split(replace(''ModifiedProperties{}.OldValue'',"\.\.\.",""),",") + | fillnull | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) + as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) + as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product + | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) + | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) + | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed + ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_allowed_domains_policy_changed_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Business approved changes by known administrators. @@ -63,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index ac0de7eae3..a0ef574dce 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -1,7 +1,7 @@ name: O365 SharePoint Malware Detection id: 583c5de3-7709-44cb-abfc-0e828d301b59 -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -12,11 +12,11 @@ description: The following analytic identifies when a malicious file is detected Office 365 capabilities further enhance these detection and response functions. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Operation=FileMalwareDetected - | rename UserId as user, Id as signature_id - | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by signature_id, user, dest, src, vendor_account, vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '`o365_management_activity` Operation=FileMalwareDetected | rename UserId + as user, Id as signature_id | stats values(Workload) as category, values(SourceFileName) + as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, + min(_time) as firstTime, max(_time) as lastTime by signature_id, user, dest, src, + vendor_account, vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_malware_detection_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml index 970ca20772..bfd7c30f3e 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -1,7 +1,7 @@ name: O365 Threat Intelligence Suspicious Email Delivered id: 605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2 -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: Anomaly @@ -13,12 +13,16 @@ description: The following analytic identifies when a suspicious email is detect Safe Attachment and Safe Links further enhance these detection and response functions. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound - | rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action - | stats values(SenderIp) as src, values(Subject) as subject, values(user) as user, values(action) as action, values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) as lastTime, count by src_user,sender,dest,vendor_account,vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_threat_intelligence_suspicious_email_delivered_filter`' +search: '`o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData + DeliveryAction!=Blocked Directionality=InBound | rename P2Sender as src_user, P1Sender + as sender, Recipients{} as user, DeliveryAction as action | stats values(SenderIp) + as src, values(Subject) as subject, values(user) as user, values(action) as action, + values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, + values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) + as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) + as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) + as lastTime, count by src_user,sender,dest,vendor_account,vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_threat_intelligence_suspicious_email_delivered_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. @@ -69,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index efc8c5ab60..54881fa33b 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -1,7 +1,7 @@ name: O365 Threat Intelligence Suspicious File Detected id: 00958c7b-35db-4e7a-ad13-31550a7a7c64 -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: TTP @@ -13,14 +13,13 @@ description: The following analytic identifies when a malicious file is detected Safe Attachment and Safe Links further enhance these detection and response functions. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection - | eval dest="NA" - | eval src="NA" - | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId, dest, src, vendor_account, vendor_product - | rename Id as signature_id, UserId as user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_threat_intelligence_suspicious_file_detected_filter`' +search: '`o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection + | eval dest="NA" | eval src="NA" | stats values(DetectionMethod) as category values(FileData.FileName) + as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as + file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, + max(_time) as lastTime by Id, UserId, dest, src, vendor_account, vendor_product + | rename Id as signature_id, UserId as user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_threat_intelligence_suspicious_file_detected_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers. @@ -68,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index 559fa63a3d..27fb92f433 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -1,7 +1,7 @@ name: O365 ZAP Activity Detection id: 4df275fd-a0e5-4246-8b92-d3201edaef7a -version: 5 -date: '2025-02-10' +version: 6 +date: 2025/03/25 author: Steven Dick status: production type: Anomaly @@ -12,15 +12,14 @@ description: The following analytic detects when the Microsoft Zero-hour Automat a window in which the user may fall victim to the malicious content. data_source: - Office 365 Universal Audit Log -search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*" - | fromjson Data - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by AlertId,trc,signature,Name,dest,src,vendor_account,vendor_product - | rename Name as signature, AlertId as signature_id, trc as user - | eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_zap_activity_detection_filter`' +search: '`o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated + Name="*messages containing malicious*" | fromjson Data | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as + file_name values(ms) as subject values(ttr) as result values(tsd) as src_user by + AlertId,trc,signature,Name,dest,src,vendor_account,vendor_product | rename Name + as signature, AlertId as signature_id, trc as user | eval action = CASE(match(result,"Success"), + "blocked", true(),"allowed"), url = split(url,";") | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_zap_activity_detection_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Some features of Zero-hour purge are only offered within E3/E5 license level tenants, events may not be available otherwise. @@ -70,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log sourcetype: o365:management:activity source: o365 From 63380103e5b0c1c67df663b35108bf325c6d722f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 25 Mar 2025 12:07:17 -0700 Subject: [PATCH 18/29] udpate date format --- detections/cloud/o365_dlp_rule_triggered.yml | 2 +- .../cloud/o365_email_access_by_security_administrator.yml | 2 +- .../cloud/o365_email_reported_by_admin_found_malicious.yml | 2 +- .../cloud/o365_email_reported_by_user_found_malicious.yml | 2 +- detections/cloud/o365_email_security_feature_changed.yml | 2 +- detections/cloud/o365_email_suspicious_behavior_alert.yml | 2 +- detections/cloud/o365_safe_links_detection.yml | 2 +- .../cloud/o365_sharepoint_allowed_domains_policy_changed.yml | 2 +- detections/cloud/o365_sharepoint_malware_detection.yml | 2 +- .../o365_threat_intelligence_suspicious_email_delivered.yml | 2 +- .../cloud/o365_threat_intelligence_suspicious_file_detected.yml | 2 +- detections/cloud/o365_zap_activity_detection.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index b415c3f906..9a467c3e8a 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -1,7 +1,7 @@ name: O365 DLP Rule Triggered id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: Anomaly diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml index 6217ac1cf1..90eaaf8a92 100644 --- a/detections/cloud/o365_email_access_by_security_administrator.yml +++ b/detections/cloud/o365_email_access_by_security_administrator.yml @@ -1,7 +1,7 @@ name: O365 Email Access By Security Administrator id: c6998a30-fef4-4e89-97ac-3bb0123719b4 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml index e83d8cd89f..bdc52427d8 100644 --- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml @@ -1,7 +1,7 @@ name: O365 Email Reported By Admin Found Malicious id: 94396c3e-7728-422a-9956-e4b77b53dbdf version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml index 91d01bf2a6..4ee61718c7 100644 --- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml +++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml @@ -1,7 +1,7 @@ name: O365 Email Reported By User Found Malicious id: 7698b945-238e-4bb9-b172-81f5ca1685a1 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml index cae21b79ab..f5348676c3 100644 --- a/detections/cloud/o365_email_security_feature_changed.yml +++ b/detections/cloud/o365_email_security_feature_changed.yml @@ -1,7 +1,7 @@ name: O365 Email Security Feature Changed id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml index bc09714a4a..d7dae2daba 100644 --- a/detections/cloud/o365_email_suspicious_behavior_alert.yml +++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml @@ -1,7 +1,7 @@ name: O365 Email Suspicious Behavior Alert id: 85c7555a-05af-4322-81aa-76b4ddf52baa version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml index 338d17b504..628d5fbd71 100644 --- a/detections/cloud/o365_safe_links_detection.yml +++ b/detections/cloud/o365_safe_links_detection.yml @@ -1,7 +1,7 @@ name: O365 Safe Links Detection id: 711d9e8c-2cb0-45cf-8813-5f191ecb9b26 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index 7b2e53b44d..b2b4c92a4c 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -1,7 +1,7 @@ name: O365 SharePoint Allowed Domains Policy Changed id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c version: 7 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml index a0ef574dce..68e1cc5575 100644 --- a/detections/cloud/o365_sharepoint_malware_detection.yml +++ b/detections/cloud/o365_sharepoint_malware_detection.yml @@ -1,7 +1,7 @@ name: O365 SharePoint Malware Detection id: 583c5de3-7709-44cb-abfc-0e828d301b59 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml index bfd7c30f3e..acf7b120b3 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml @@ -1,7 +1,7 @@ name: O365 Threat Intelligence Suspicious Email Delivered id: 605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: Anomaly diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml index 54881fa33b..26b3a91554 100644 --- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml +++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml @@ -1,7 +1,7 @@ name: O365 Threat Intelligence Suspicious File Detected id: 00958c7b-35db-4e7a-ad13-31550a7a7c64 version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: TTP diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml index 27fb92f433..7bbdaec115 100644 --- a/detections/cloud/o365_zap_activity_detection.yml +++ b/detections/cloud/o365_zap_activity_detection.yml @@ -1,7 +1,7 @@ name: O365 ZAP Activity Detection id: 4df275fd-a0e5-4246-8b92-d3201edaef7a version: 6 -date: 2025/03/25 +date: '2025-03-25' author: Steven Dick status: production type: Anomaly From f491d2a5128ef177e210c568217c075068348c4c Mon Sep 17 00:00:00 2001 From: ljstella Date: Wed, 26 Mar 2025 11:01:05 -0500 Subject: [PATCH 19/29] Removing default match from lookups --- lookups/3cx_ioc_domains.yml | 1 - lookups/__mlspl_unusual_commandline_detection.yml | 1 - lookups/advanced_audit_policy_guids.yml | 1 - lookups/applockereventcodes.yml | 1 - lookups/asr_rules.yml | 1 - lookups/attacker_tools.yml | 1 - lookups/brandmonitoring_lookup.yml | 1 - lookups/browser_app_list.yml | 1 - lookups/char_conversion_matrix.yml | 1 - lookups/cloud_instances_enough_data.yml | 1 - lookups/decommissioned_buckets.yml | 1 - lookups/deprecation_info.yml | 1 - lookups/discovered_dns_records.yml | 1 - lookups/hijacklibs.yml | 1 - lookups/hijacklibs_loaded.yml | 1 - lookups/is_net_windows_file.yml | 1 - lookups/is_nirsoft_software.yml | 1 - lookups/is_windows_system_file.yml | 1 - lookups/linux_tool_discovery_process.yml | 1 - lookups/local_file_inclusion_paths.yml | 1 - lookups/lolbas_file_path.yml | 1 - lookups/loldrivers.yml | 1 - lookups/lookup_rare_process_allow_list_default.yml | 1 - lookups/lookup_rare_process_allow_list_local.yml | 1 - lookups/privileged_azure_ad_roles.yml | 1 - lookups/ransomware_extensions_lookup.yml | 1 - lookups/ransomware_notes_lookup.yml | 1 - lookups/remote_access_software.yml | 1 - lookups/security_services_lookup.yml | 1 - lookups/suspicious_writes_lookup.yml | 1 - lookups/windows_protocol_handlers.yml | 1 - lookups/windows_suspicious_services.yml | 3 +-- lookups/windows_suspicious_tasks.yml | 1 - 33 files changed, 1 insertion(+), 34 deletions(-) diff --git a/lookups/3cx_ioc_domains.yml b/lookups/3cx_ioc_domains.yml index 3b82b2cb5f..2107a08252 100644 --- a/lookups/3cx_ioc_domains.yml +++ b/lookups/3cx_ioc_domains.yml @@ -5,7 +5,6 @@ id: 65c25399-4081-4ef1-b791-86f497d3380d author: Splunk Threat Research Team lookup_type: csv description: A list of domains from the 3CX supply chain attack. -default_match: false match_type: - WILDCARD(domain) min_matches: 1 diff --git a/lookups/__mlspl_unusual_commandline_detection.yml b/lookups/__mlspl_unusual_commandline_detection.yml index b61270c65f..74558efe01 100644 --- a/lookups/__mlspl_unusual_commandline_detection.yml +++ b/lookups/__mlspl_unusual_commandline_detection.yml @@ -7,4 +7,3 @@ lookup_type: mlmodel description: An MLTK model for detecting malicious commandlines case_sensitive_match: false min_matches: 1 -default_match: false diff --git a/lookups/advanced_audit_policy_guids.yml b/lookups/advanced_audit_policy_guids.yml index fab6f56b80..9b5295a51b 100644 --- a/lookups/advanced_audit_policy_guids.yml +++ b/lookups/advanced_audit_policy_guids.yml @@ -5,7 +5,6 @@ id: e2581a3a-1254-4b93-ae8f-ccde22362f0c author: Splunk Threat Research Team lookup_type: csv description: List of GUIDs associated with Windows advanced audit policies -default_match: false match_type: - WILDCARD(GUID) min_matches: 1 diff --git a/lookups/applockereventcodes.yml b/lookups/applockereventcodes.yml index 10b797958e..e16dbb04d3 100644 --- a/lookups/applockereventcodes.yml +++ b/lookups/applockereventcodes.yml @@ -5,7 +5,6 @@ id: 2fd8cc84-f4c8-4ab6-bd57-596f714a315f author: Splunk Threat Research Team lookup_type: csv description: A csv of the ID and rule name for AppLocker event codes. -default_match: false match_type: - WILDCARD(AppLocker_Event_Code) min_matches: 1 diff --git a/lookups/asr_rules.yml b/lookups/asr_rules.yml index ad1a4603d7..70ccb5b72c 100644 --- a/lookups/asr_rules.yml +++ b/lookups/asr_rules.yml @@ -5,7 +5,6 @@ id: 3886d687-ae77-4a61-99eb-e745083e391e author: Splunk Threat Research Team lookup_type: csv description: A csv of the ID and rule name for ASR, Microsoft Attack Surface Reduction rules. -default_match: false match_type: - WILDCARD(ASR_Rule) min_matches: 1 diff --git a/lookups/attacker_tools.yml b/lookups/attacker_tools.yml index 58f8dcd904..19fa30b2f3 100644 --- a/lookups/attacker_tools.yml +++ b/lookups/attacker_tools.yml @@ -5,7 +5,6 @@ id: 72620fe1-26cb-4cee-a6ee-8c6127056d81 author: Splunk Threat Research Team lookup_type: csv description: A list of tools used by attackers -default_match: false match_type: - WILDCARD(attacker_tool_names) min_matches: 1 diff --git a/lookups/brandmonitoring_lookup.yml b/lookups/brandmonitoring_lookup.yml index 39a7f8e701..2dfd034137 100644 --- a/lookups/brandmonitoring_lookup.yml +++ b/lookups/brandmonitoring_lookup.yml @@ -4,7 +4,6 @@ version: 2 id: 6fff763a-d654-42dc-8e56-92c8e255ac55 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A file that contains look-a-like domains for brands that you want to monitor match_type: diff --git a/lookups/browser_app_list.yml b/lookups/browser_app_list.yml index 5fe50536ba..21d9a57ead 100644 --- a/lookups/browser_app_list.yml +++ b/lookups/browser_app_list.yml @@ -4,7 +4,6 @@ version: 2 id: a80ccd19-e46f-4a12-9ad7-e653ad646347 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A list of known browser application being targeted for credential extraction. match_type: - WILDCARD(browser_process_name) diff --git a/lookups/char_conversion_matrix.yml b/lookups/char_conversion_matrix.yml index c75b0c8542..aef5f62e76 100644 --- a/lookups/char_conversion_matrix.yml +++ b/lookups/char_conversion_matrix.yml @@ -5,7 +5,6 @@ id: 0177cf7b-8cf9-412a-9919-d1919b8d59dc author: Splunk Threat Research Team lookup_type: csv description: A simple conversion matrix for converting to and from UTF8/16 base64/hex/decimal encoding. Created mosty from https://community.splunk.com/t5/Splunk-Search/base64-decoding-in-search/m-p/27572#M177741, with small modifications for UTF16LE parsing for powershell encoding. -default_match: false match_type: - WILDCARD(data) min_matches: 1 diff --git a/lookups/cloud_instances_enough_data.yml b/lookups/cloud_instances_enough_data.yml index 68dd5d4249..384d8b1bf6 100644 --- a/lookups/cloud_instances_enough_data.yml +++ b/lookups/cloud_instances_enough_data.yml @@ -4,7 +4,6 @@ version: 2 id: 2aabac97-9782-4156-9dfd-7c1fb7aab2a6 author: Splunk Threat Research Team lookup_type: kvstore -default_match: false description: A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches fields: - _key diff --git a/lookups/decommissioned_buckets.yml b/lookups/decommissioned_buckets.yml index 78354e2500..db70d5d42c 100644 --- a/lookups/decommissioned_buckets.yml +++ b/lookups/decommissioned_buckets.yml @@ -4,7 +4,6 @@ version: 1 id: b3a95eff-87cf-40f3-b6e0-5b1a11eed68f author: Bhavin Patel lookup_type: kvstore -default_match: false description: A lookup table of decommissioned S3 buckets created by baseline - Baseline of Open S3 Bucket Decommissioning. This lookup table is used by detections searches to trigger alerts when decommissioned buckets are detected. min_matches: 1 fields: diff --git a/lookups/deprecation_info.yml b/lookups/deprecation_info.yml index dab74f8b34..e39c95d51c 100644 --- a/lookups/deprecation_info.yml +++ b/lookups/deprecation_info.yml @@ -4,6 +4,5 @@ version: 1 id: d83dad4f-7bce-4979-bf07-a88c610da5f6 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A lookup file for deprecation information min_matches: 1 diff --git a/lookups/discovered_dns_records.yml b/lookups/discovered_dns_records.yml index bc014779db..878fd1c525 100644 --- a/lookups/discovered_dns_records.yml +++ b/lookups/discovered_dns_records.yml @@ -4,6 +4,5 @@ version: 2 id: ebf80033-0cc1-4256-a1cb-730ccbda36af author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records min_matches: 1 diff --git a/lookups/hijacklibs.yml b/lookups/hijacklibs.yml index 39678bdb26..35278498c7 100644 --- a/lookups/hijacklibs.yml +++ b/lookups/hijacklibs.yml @@ -5,7 +5,6 @@ id: 00990d97-e923-4ae7-9fa0-b5033a8b0164 author: Splunk Threat Research Team lookup_type: csv description: A list of potentially abused libraries in Windows -default_match: false match_type: - WILDCARD(library) min_matches: 1 diff --git a/lookups/hijacklibs_loaded.yml b/lookups/hijacklibs_loaded.yml index 444a0c3d04..9b74470ce5 100644 --- a/lookups/hijacklibs_loaded.yml +++ b/lookups/hijacklibs_loaded.yml @@ -5,7 +5,6 @@ id: 0a58a703-3a7a-4b27-a82b-f5a61acd3f1a author: Splunk Threat Research Team lookup_type: csv description: A list of potentially abused libraries in Windows -default_match: false match_type: - WILDCARD(library) - WILDCARD(excludes) diff --git a/lookups/is_net_windows_file.yml b/lookups/is_net_windows_file.yml index 4a805b52e6..e6c1f72dc5 100644 --- a/lookups/is_net_windows_file.yml +++ b/lookups/is_net_windows_file.yml @@ -4,7 +4,6 @@ version: 2 id: 891cfb79-06cd-455d-9cf8-b4d4de2bff25 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline. min_matches: 1 case_sensitive_match: false \ No newline at end of file diff --git a/lookups/is_nirsoft_software.yml b/lookups/is_nirsoft_software.yml index 64210f6035..12337fbbca 100644 --- a/lookups/is_nirsoft_software.yml +++ b/lookups/is_nirsoft_software.yml @@ -4,7 +4,6 @@ version: 2 id: 28966a08-55e4-4ccb-a20d-dc4cc154b09c author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A subset of utilities provided by NirSoft that may be used by adversaries. min_matches: 1 case_sensitive_match: false \ No newline at end of file diff --git a/lookups/is_windows_system_file.yml b/lookups/is_windows_system_file.yml index 59b4d90c5d..14303d0a39 100644 --- a/lookups/is_windows_system_file.yml +++ b/lookups/is_windows_system_file.yml @@ -4,7 +4,6 @@ version: 2 id: ce238622-4d8f-41a4-a747-5d0adab9c854 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10. min_matches: 1 case_sensitive_match: false \ No newline at end of file diff --git a/lookups/linux_tool_discovery_process.yml b/lookups/linux_tool_discovery_process.yml index 3ca56a079f..75bc54c288 100644 --- a/lookups/linux_tool_discovery_process.yml +++ b/lookups/linux_tool_discovery_process.yml @@ -5,7 +5,6 @@ id: f0d8b1c8-4ca0-4765-858a-ab0dea68c399 author: Splunk Threat Research Team lookup_type: csv description: A list of suspicious bash commonly used by attackers via scripts -default_match: false match_type: - WILDCARD(process) min_matches: 1 diff --git a/lookups/local_file_inclusion_paths.yml b/lookups/local_file_inclusion_paths.yml index 15638c2135..0342bfd491 100644 --- a/lookups/local_file_inclusion_paths.yml +++ b/lookups/local_file_inclusion_paths.yml @@ -5,7 +5,6 @@ id: 10efe0a8-ec54-4f86-8d11-677a7ac65d64 author: Splunk Threat Research Team lookup_type: csv description: A list of interesting files in a local file inclusion attack -default_match: false match_type: - WILDCARD(local_file_inclusion_paths) min_matches: 1 diff --git a/lookups/lolbas_file_path.yml b/lookups/lolbas_file_path.yml index 73ecc09722..8cd678cfa6 100644 --- a/lookups/lolbas_file_path.yml +++ b/lookups/lolbas_file_path.yml @@ -5,7 +5,6 @@ id: b88d9c91-33c6-408a-8ef0-00806932f8c5 author: Splunk Threat Research Team lookup_type: csv description: A list of LOLBAS and their file path used in determining if a script or binary is valid on windows, Updated for 2024 from lolbas project. -default_match: false match_type: - WILDCARD(lolbas_file_name) - WILDCARD(lolbas_file_path) diff --git a/lookups/loldrivers.yml b/lookups/loldrivers.yml index 412e1a069a..c8f78dfbd0 100644 --- a/lookups/loldrivers.yml +++ b/lookups/loldrivers.yml @@ -5,7 +5,6 @@ id: a4c71880-bb4a-4e2c-9b44-be70cf181fb3 author: Splunk Threat Research Team lookup_type: csv description: A list of known vulnerable drivers -default_match: false match_type: - WILDCARD(driver_name) min_matches: 1 diff --git a/lookups/lookup_rare_process_allow_list_default.yml b/lookups/lookup_rare_process_allow_list_default.yml index 1474969aa6..5603f2135a 100644 --- a/lookups/lookup_rare_process_allow_list_default.yml +++ b/lookups/lookup_rare_process_allow_list_default.yml @@ -5,7 +5,6 @@ id: fc0c452e-47b1-4931-ba41-de5b7c6ed92b author: Splunk Threat Research Team lookup_type: csv case_sensitive_match: false -default_match: false description: A list of rare processes that are legitimate that is provided by Splunk match_type: - WILDCARD(process) diff --git a/lookups/lookup_rare_process_allow_list_local.yml b/lookups/lookup_rare_process_allow_list_local.yml index 16b9681815..cf4f3c4c7b 100644 --- a/lookups/lookup_rare_process_allow_list_local.yml +++ b/lookups/lookup_rare_process_allow_list_local.yml @@ -5,7 +5,6 @@ id: 7aec9c17-69b8-4a0b-8f8d-d3ea9b0e2adb author: Splunk Threat Research Team lookup_type: csv case_sensitive_match: false -default_match: false description: A list of rare processes that are legitimate provided by the end user match_type: - WILDCARD(process) diff --git a/lookups/privileged_azure_ad_roles.yml b/lookups/privileged_azure_ad_roles.yml index 0e38bee0db..3d2d5ab7d5 100644 --- a/lookups/privileged_azure_ad_roles.yml +++ b/lookups/privileged_azure_ad_roles.yml @@ -5,7 +5,6 @@ id: 4dbf0357-b5fc-4be2-9058-804d6a60b126 author: Splunk Threat Research Team lookup_type: csv description: A list of privileged Azure Active Directory roles, includes updates for 2024 and template IDs. -default_match: false match_type: - WILDCARD(azureadrole) - WILDCARD(azuretemplateid) diff --git a/lookups/ransomware_extensions_lookup.yml b/lookups/ransomware_extensions_lookup.yml index f094df6158..6eb5f6be2c 100644 --- a/lookups/ransomware_extensions_lookup.yml +++ b/lookups/ransomware_extensions_lookup.yml @@ -4,7 +4,6 @@ version: 2 id: eaf9e6bb-55fa-4bab-89a5-b0229638c526 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A list of file extensions that are associated with ransomware match_type: - WILDCARD(Extensions) diff --git a/lookups/ransomware_notes_lookup.yml b/lookups/ransomware_notes_lookup.yml index 21ec31a3bf..fd3a741f5e 100644 --- a/lookups/ransomware_notes_lookup.yml +++ b/lookups/ransomware_notes_lookup.yml @@ -4,7 +4,6 @@ version: 3 id: 93d9fb06-035e-496c-91d5-7a79543ce1e1 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A list of file names that are ransomware note files match_type: - WILDCARD(ransomware_notes) diff --git a/lookups/remote_access_software.yml b/lookups/remote_access_software.yml index 0819c7ffad..ad4f0abcb8 100644 --- a/lookups/remote_access_software.yml +++ b/lookups/remote_access_software.yml @@ -5,7 +5,6 @@ id: f3b92ff9-667c-481f-b29d-458e10d48508 author: Splunk Threat Research Team lookup_type: csv description: A list of Remote Access Software -default_match: false match_type: - WILDCARD(remote_utility) - WILDCARD(remote_domain) diff --git a/lookups/security_services_lookup.yml b/lookups/security_services_lookup.yml index 96069235ee..e2acc725b9 100644 --- a/lookups/security_services_lookup.yml +++ b/lookups/security_services_lookup.yml @@ -4,7 +4,6 @@ version: 4 id: c9038bad-c77b-4caa-9df2-09dc4454ac77 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A list of services that deal with security, such as Antivirus, Endpoint Detection and Response, etc. match_type: - WILDCARD(service) diff --git a/lookups/suspicious_writes_lookup.yml b/lookups/suspicious_writes_lookup.yml index f8a13e65fe..c9407a56f3 100644 --- a/lookups/suspicious_writes_lookup.yml +++ b/lookups/suspicious_writes_lookup.yml @@ -4,7 +4,6 @@ version: 2 id: 4a189c42-84d1-49b6-817e-7bc59318f960 author: Splunk Threat Research Team lookup_type: csv -default_match: false description: A list of suspicious file names match_type: - WILDCARD(file) diff --git a/lookups/windows_protocol_handlers.yml b/lookups/windows_protocol_handlers.yml index cbefef155a..756f988916 100644 --- a/lookups/windows_protocol_handlers.yml +++ b/lookups/windows_protocol_handlers.yml @@ -5,7 +5,6 @@ id: d7a6399f-9f59-4d16-a637-3353e6d4e3d1 author: Splunk Threat Research Team lookup_type: csv description: A list of Windows Protocol Handlers -default_match: false match_type: - WILDCARD(handler) min_matches: 1 diff --git a/lookups/windows_suspicious_services.yml b/lookups/windows_suspicious_services.yml index cf85cbbf98..7717773be0 100644 --- a/lookups/windows_suspicious_services.yml +++ b/lookups/windows_suspicious_services.yml @@ -5,10 +5,9 @@ id: 8c214005-2b4e-49c8-bba6-747005f11296 author: Steven Dick lookup_type: csv description: A list of suspicious Windows Service names and locations -default_match: false match_type: - WILDCARD(service_name) - WILDCARD(service_path) min_matches: 1 max_matches: 1 -case_sensitive_match: false \ No newline at end of file +case_sensitive_match: false diff --git a/lookups/windows_suspicious_tasks.yml b/lookups/windows_suspicious_tasks.yml index 68cc6d0fee..9de81d1077 100644 --- a/lookups/windows_suspicious_tasks.yml +++ b/lookups/windows_suspicious_tasks.yml @@ -5,7 +5,6 @@ id: 928cba69-be80-4601-9b0d-3ec81f714338 author: Steven Dick lookup_type: csv description: A list of suspicious Windows Scheduled Task names and locations -default_match: false match_type: - WILDCARD(task_name) - WILDCARD(task_command) From 60e4f3881cb450b2b8b2acef4824c7008b75eb01 Mon Sep 17 00:00:00 2001 From: ljstella Date: Wed, 26 Mar 2025 13:03:42 -0500 Subject: [PATCH 20/29] Adding default match back to lookups where used --- lookups/browser_app_list.yml | 1 + lookups/hijacklibs_loaded.yml | 1 + lookups/lolbas_file_path.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/lookups/browser_app_list.yml b/lookups/browser_app_list.yml index 21d9a57ead..850f4b38c1 100644 --- a/lookups/browser_app_list.yml +++ b/lookups/browser_app_list.yml @@ -5,6 +5,7 @@ id: a80ccd19-e46f-4a12-9ad7-e653ad646347 author: Splunk Threat Research Team lookup_type: csv description: A list of known browser application being targeted for credential extraction. +default_match: false match_type: - WILDCARD(browser_process_name) - WILDCARD(browser_object_path) diff --git a/lookups/hijacklibs_loaded.yml b/lookups/hijacklibs_loaded.yml index 9b74470ce5..444a0c3d04 100644 --- a/lookups/hijacklibs_loaded.yml +++ b/lookups/hijacklibs_loaded.yml @@ -5,6 +5,7 @@ id: 0a58a703-3a7a-4b27-a82b-f5a61acd3f1a author: Splunk Threat Research Team lookup_type: csv description: A list of potentially abused libraries in Windows +default_match: false match_type: - WILDCARD(library) - WILDCARD(excludes) diff --git a/lookups/lolbas_file_path.yml b/lookups/lolbas_file_path.yml index 8cd678cfa6..73ecc09722 100644 --- a/lookups/lolbas_file_path.yml +++ b/lookups/lolbas_file_path.yml @@ -5,6 +5,7 @@ id: b88d9c91-33c6-408a-8ef0-00806932f8c5 author: Splunk Threat Research Team lookup_type: csv description: A list of LOLBAS and their file path used in determining if a script or binary is valid on windows, Updated for 2024 from lolbas project. +default_match: false match_type: - WILDCARD(lolbas_file_name) - WILDCARD(lolbas_file_path) From 76ef391ac3a9ea1332bd7b7bf55afd34e2f6dbdd Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 26 Mar 2025 12:04:02 -0700 Subject: [PATCH 21/29] updating title to full name --- contentctl.yml | 4 ++-- ...lunk_cim.yml => splunk_common_information_model_(cim).yml} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename data_sources/{splunk_cim.yml => splunk_common_information_model_(cim).yml} (75%) diff --git a/contentctl.yml b/contentctl.yml index ed79d50b12..7ae22d3000 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -30,11 +30,11 @@ splunk_api_username: null post_test_behavior: pause_on_failure apps: - uid: 1621 - title: Splunk_SA_CIM + title: Splunk Common Information Model (CIM) appid: Splunk_SA_CIM version: 6.0.3 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-cim_603.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-(cim)_603.tgz - uid: 6553 title: Splunk Add-on for Okta Identity Cloud appid: Splunk_TA_okta_identity_cloud diff --git a/data_sources/splunk_cim.yml b/data_sources/splunk_common_information_model_(cim).yml similarity index 75% rename from data_sources/splunk_cim.yml rename to data_sources/splunk_common_information_model_(cim).yml index 86b235753f..6c2f2a3896 100644 --- a/data_sources/splunk_cim.yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -1,4 +1,4 @@ -name: Splunk CIM +name: Splunk Common Information Model (CIM) id: d3dd8270-7e1c-4bcd-8f3a-e5ec4a0e740a version: 1 date: '2025-01-14' @@ -7,6 +7,6 @@ description: Data source object for Splunk CIM source: not_applicable sourcetype: not_applicable supported_TA: -- name: Splunk_SA_CIM +- name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 version: 6.0.3 From 377efcc0b0d5f0fbb5dddd849018373a72bd5bc9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 26 Mar 2025 12:39:02 -0700 Subject: [PATCH 22/29] updating name --- ...dows_process_injection_into_commonly_abused_processes.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_process_injection_into_commonly_abused_process.yml => windows_process_injection_into_commonly_abused_processes.yml} (96%) diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml similarity index 96% rename from detections/endpoint/windows_process_injection_into_commonly_abused_process.yml rename to detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index 2afba0b8c5..0ad328b2e2 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_process.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -1,4 +1,4 @@ -name: Windows Process Injection into Commonly Abused Process +name: Windows Process Injection into Commonly Abused Processes id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 version: 1 date: '2025-03-19' @@ -21,7 +21,7 @@ search: '`sysmon` EventCode=10 TargetImage IN ("*\\notepad.exe", "*\\wordpad.exe | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime dest user SourceImage TargetImage GrantedAccess CallTrace count - | `windows_process_injection_into_commonly_abused_process_filter`' + | `windows_process_injection_into_commonly_abused_processes_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From 17b1fd44c75899b9c8e6d7d2716d9b3c7b1dae8c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 26 Mar 2025 14:08:52 -0700 Subject: [PATCH 23/29] Update living_off_the_land_detection.yml attack_data We did not catch this previously because it is a correlation search, so the links are not checked. I found this manually. --- detections/endpoint/living_off_the_land_detection.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/living_off_the_land_detection.yml b/detections/endpoint/living_off_the_land_detection.yml index 40894b9d82..bf4462407d 100644 --- a/detections/endpoint/living_off_the_land_detection.yml +++ b/detections/endpoint/living_off_the_land_detection.yml @@ -1,7 +1,7 @@ name: Living Off The Land Detection id: 1be30d80-3a39-4df9-9102-64a467b24abc -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-03-26' author: Michael Haag, Splunk status: production type: Correlation @@ -70,6 +70,6 @@ tests: - name: True Positive Test attack_data: - data: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log + https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log source: lotl sourcetype: stash From cdd70a10aafe1fa716407d4f23c2f355f6eb6527 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 27 Mar 2025 13:32:37 -0700 Subject: [PATCH 24/29] test with local data --- .../cisco_ai_defense_security_alerts_by_application_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index 99d73f13f8..42fbd810f5 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -36,7 +36,7 @@ search: |- severity="low", 25 ) | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name - |`cisco_ai_defense_security_alerts_by_application_name_filter`' + | `cisco_ai_defense_security_alerts_by_application_name_filter` how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype. known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. references: @@ -71,7 +71,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + # manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. tests: - name: True Positive Test attack_data: From 5000fe16cb0724b0afd24dcc631e0e74386fef94 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 27 Mar 2025 13:41:17 -0700 Subject: [PATCH 25/29] reverrt ctl --- contentctl.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 7ae22d3000..ed79d50b12 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -30,11 +30,11 @@ splunk_api_username: null post_test_behavior: pause_on_failure apps: - uid: 1621 - title: Splunk Common Information Model (CIM) + title: Splunk_SA_CIM appid: Splunk_SA_CIM version: 6.0.3 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-(cim)_603.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-common-information-model-cim_603.tgz - uid: 6553 title: Splunk Add-on for Okta Identity Cloud appid: Splunk_TA_okta_identity_cloud From c009a27c129180492c734770adc4ee8619c43f28 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 27 Mar 2025 14:01:20 -0700 Subject: [PATCH 26/29] add back manual_test --- .../cisco_ai_defense_security_alerts_by_application_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index 42fbd810f5..c48bd01701 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -71,7 +71,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - # manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. tests: - name: True Positive Test attack_data: From b3be9906ebd9f5aa879b181f858f6120633b46a1 Mon Sep 17 00:00:00 2001 From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Date: Fri, 28 Mar 2025 06:58:23 +0000 Subject: [PATCH 27/29] Updated TAs --- data_sources/linux_secure.yml | 2 +- data_sources/splunk_stream_http.yml | 2 +- data_sources/splunk_stream_ip.yml | 2 +- data_sources/splunk_stream_tcp.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 7e6390b41b..d95c19d51b 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 9.2.0 + version: 10.0.0 fields: - _time - action diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index f099678d49..19849b96db 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -16,7 +16,7 @@ sourcetype: stream:http supported_TA: - name: Splunk Stream url: https://splunkbase.splunk.com/app/1809 - version: 8.1.3 + version: 8.1.5 fields: - _time - bytes diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index ec1c7a15fb..e50533f942 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -16,7 +16,7 @@ sourcetype: stream:ip supported_TA: - name: Splunk Stream url: https://splunkbase.splunk.com/app/1809 - version: 8.1.3 + version: 8.1.5 fields: - _time - action diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index f9de165e7c..3e22bd1ac6 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -16,4 +16,4 @@ sourcetype: stream:tcp supported_TA: - name: Splunk Stream url: https://splunkbase.splunk.com/app/1809 - version: 8.1.3 + version: 8.1.5 From 4cf5b74a65f2ce6e89a5e4876e246ceeaa5d5c79 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 28 Mar 2025 09:48:48 -0700 Subject: [PATCH 28/29] Update vanhelsing_ransomware.yml --- stories/vanhelsing_ransomware.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/stories/vanhelsing_ransomware.yml b/stories/vanhelsing_ransomware.yml index 8d4feb05c8..4a0089ab30 100644 --- a/stories/vanhelsing_ransomware.yml +++ b/stories/vanhelsing_ransomware.yml @@ -5,7 +5,6 @@ status: production date: '2025-03-24' author: Michael Haag, Splunk description: VanHelsing is a rapidly growing ransomware-as-a-service (RaaS) program launched in March 2025. The ransomware targets Windows systems with additional variants for Linux, BSD, ARM, and ESXi systems. It uses various techniques including shadow copy deletion, process hollowing, and command-line arguments to control encryption behavior. Files are encrypted with the .vanhelsing extension, and a ransom note (README.txt) is dropped in each folder. - narrative: VanHelsingRaaS emerged as a new ransomware threat in March 2025, quickly gaining traction in the cybercrime landscape. The RaaS program allows affiliates to join with a $5,000 deposit, offering them 80% of the ransom payments while operators retain 20%. The ransomware demonstrates sophisticated capabilities through its multi-stage attack process. The initial access and execution phase typically involves lateral movement using PsExec, with the ransomware supporting multiple command-line arguments for customized execution. To maintain control over its operation, it creates a mutex "Global\VanHelsing" to prevent multiple instances from running simultaneously. For defense evasion, the ransomware employs several sophisticated techniques. It attempts to delete shadow copies using various methods to prevent system recovery, includes stealth options like --Silent and --no-logs to minimize detection, and utilizes process hollowing techniques to evade security controls. @@ -21,4 +20,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud usecase: Advanced Threat Detection - cve: [] From 26c1b2eb305db7b607f7a19291ea33315780f01c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 28 Mar 2025 09:51:59 -0700 Subject: [PATCH 29/29] Update linux_secure.yml --- data_sources/linux_secure.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index d95c19d51b..7e6390b41b 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.0.0 + version: 9.2.0 fields: - _time - action