From eb43251183530e6a73e9ec6d4c70c2f783de3147 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 3 Feb 2022 15:26:19 -0800 Subject: [PATCH] spl update --- detections/cloud/o365_added_service_principal.yml | 6 +++--- detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 6 +++--- detections/cloud/o365_disable_mfa.yml | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 6bcfb6259b..08efdec24d 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,17 +1,17 @@ name: O365 Added Service Principal id: 1668812a-6047-11eb-ae93-0242ac130002 version: 1 -date: '2021-01-26' +date: '2022-02-03' author: Rod Soto, Splunk type: TTP datamodel: [] description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. -search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress - signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 4a9a8ef9ea..aaee2fa67e 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -1,20 +1,20 @@ name: O365 Bypass MFA via Trusted IP id: c783dd98-c703-4252-9e8a-f19d9f66949e version: 2 -date: '2021-07-19' +date: '2022-02-03' author: Bhavin Patel, Splunk type: TTP datamodel: [] description: This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. -search: '`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy +search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) - as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account + as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`' how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index b80ab26505..20da9c851d 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -1,15 +1,15 @@ name: O365 Disable MFA id: c783dd98-c703-4252-9e8a-f19d9f5c949e version: 1 -date: '2020-12-16' +date: '2022-02-03' author: Rod Soto, Splunk type: TTP datamodel: [] description: This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats - count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation - user status signature dest ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation UserId + ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_disable_mfa_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity