Merge branch 'TheIncidentsHaveEyes' of github.com:splunk/security_content into TheIncidentsHaveEyes

detections/cloud/o365_added_service_principal.yml

@@ -1,17 +1,17 @@
 name: O365 Added Service Principal
 id: 1668812a-6047-11eb-ae93-0242ac130002
 version: 1
-date: '2021-01-26'
+date: '2022-02-03'
 author: Rod Soto, Splunk
 type: TTP
 datamodel: []
 description: This search detects the creation of a new Federation setting by alerting
   about an specific event related to its creation.
-search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service
   principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
   as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
   as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
-  signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `o365_added_service_principal_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -1,20 +1,20 @@
 name: O365 Bypass MFA via Trusted IP
 id: c783dd98-c703-4252-9e8a-f19d9f66949e
 version: 2
-date: '2021-07-19'
+date: '2022-02-03'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel: []
 description: This search detects newly added IP addresses/CIDR blocks to the list
   of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
   to use this technique so that they can bypass the MFA system.
-search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
+search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
   | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
   | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
   | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand
   ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
   |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old)
-  as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account
+  as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account
   status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `o365_bypass_mfa_via_trusted_ip_filter`'
 how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search

detections/cloud/o365_disable_mfa.yml

@@ -1,15 +1,15 @@
 name: O365 Disable MFA
 id: c783dd98-c703-4252-9e8a-f19d9f5c949e
 version: 1
-date: '2020-12-16'
+date: '2022-02-03'
 author: Rod Soto, Splunk
 type: TTP
 datamodel: []
 description: This search detects when multi factor authentication has been disabled,
   what entitiy performed the action and against what user
 search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats
-  count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation
-  user status signature dest ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
+  count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation UserId
+   ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `o365_disable_mfa_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity