From 8399851a992340f2dcabd87d101ff713d412baf3 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 18 May 2021 12:57:23 +0200 Subject: [PATCH 1/5] add data exfil story to detections --- detections/cloud/o365_pst_export_alert.yml | 1 + detections/cloud/o365_suspicious_admin_email_forwarding.yml | 1 + detections/cloud/o365_suspicious_user_email_forwarding.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index fc9e0b611f..1f260b8963 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -21,6 +21,7 @@ references: tags: analytic_story: - Office 365 Detections + - Data Exfiltration asset_type: Office 365 automated_detection_testing: passed dataset: diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index ff1d16a23d..9a5d5b3ea6 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -19,6 +19,7 @@ references: [] tags: analytic_story: - Office 365 Detections + - Data Exfiltration asset_type: Office 365 automated_detection_testing: passed cis20: diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 8ee80587ff..698a76fd93 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -19,6 +19,7 @@ references: [] tags: analytic_story: - Office 365 Detections + - Data Exfiltration asset_type: Office 365 automated_detection_testing: passed cis20: From f91afa267513ae103bd42253ed754b84bbc653a5 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 18 May 2021 13:01:29 +0200 Subject: [PATCH 2/5] add data exfil story to detections --- .../o365_suspicious_user_email_forwarding.test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/cloud/o365_suspicious_user_email_forwarding.test.yml diff --git a/tests/cloud/o365_suspicious_user_email_forwarding.test.yml b/tests/cloud/o365_suspicious_user_email_forwarding.test.yml new file mode 100644 index 0000000000..523580ad04 --- /dev/null +++ b/tests/cloud/o365_suspicious_user_email_forwarding.test.yml @@ -0,0 +1,12 @@ +name: O365 Suspicious User Email Forwarding Unit Test +tests: +- name: O365 Suspicious User Email Forwarding + file: cloud/o365_suspicious_user_email_forwarding.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_email_forwarding_rule.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json + sourcetype: 'o365:management:activity' + source: 'o365' From 346d9bc97b833b10448a188a40ee0af8a13da179 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 18 May 2021 11:21:33 +0000 Subject: [PATCH 3/5] Added detection testing service results inO365 Suspicious User Email Forwarding From d5dcf4d81829a9ec0d4893f1409a318eefd488a9 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 18 May 2021 11:22:01 +0000 Subject: [PATCH 4/5] Added detection testing service results inO365 Suspicious Admin Email Forwarding From 70e8d690388c4e395e9ce64293513d3806b7531b Mon Sep 17 00:00:00 2001 From: root Date: Tue, 18 May 2021 11:22:19 +0000 Subject: [PATCH 5/5] Added detection testing service results inO365 PST export alert