Merge branch 'rodo365' into TR-320-suspicious-rights-delegation

detections/cloud/o365_disable_mfa.yml

@@ -0,0 +1,21 @@
+author: "Rod Soto, Splunk"
+date: "2020-12-16"
+description: "This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user"
+how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity"
+id: c783dd98-c703-4252-9e8a-f19d9f5c949e
+known_false_positives: "Unless it is a special case, it is uncommon to disable MFA or Strong Authentication"
+name: O365 Disable MFA
+references:
+  - https://attack.mitre.org/techniques/T1556/
+search: "`o365_management_activity` Workload=AzureActiveDirectory | spath Operation | search Operation=Disable Strong Authentication. | table UserType Operation user status signature dest ResultStatus | `o365_disable_mfa_filter`"
+tags:
+  analytics_story:
+  - Office 365 Detections
+  asset_type: "Office 365"
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1556
+  security_domain: threat
+type: ESCU
+version: 1

detections/cloud/o365_excessive_authentication_failures_alert.yml

@@ -0,0 +1,21 @@
+author: "Rod Soto, Splunk"
+date: "2020-12-16"
+description: "This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes"
+how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity"
+id: d441364c-349c-453b-b55f-12eccab67cf9
+known_false_positives: "The threshold for alert is above 10 attempts and this should reduce the number of false positives."
+name: O365 Excessive Authentication Failures Alert
+references:
+  - https://attack.mitre.org/techniques/T1110/
+search: "`o365_management_activity` Workload=AzureActiveDirectory | UserAuthenticationMethod=* status=Failed | table UserType user UserAuthenticationMethod UserAgent user_type status src_ip signature RequestType ResultStatus LogonError | stats count by user,status |where count > 10| `o365_excessive_authentication_failures_alert_filter`"
+tags:
+  analytics_story:
+  - Office 365 Detections
+  asset_type: "Office 365"
+  kill_chain_phases:
+  - Not Applicable
+  mitre_attack_id:
+  - T1110
+  security_domain: threat
+type: ESCU
+version: 1

detections/cloud/o365_pst_export_alert.yml

@@ -0,0 +1,21 @@
+author: "Rod Soto, Splunk"
+date: "2020-12-16"
+description: "This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content"
+how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity"
+id: 5f694cc4-a678-4a60-9410-bffca1b647dc
+known_false_positives: "PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored."
+name: O365 PST export alert
+references:
+  - https://attack.mitre.org/techniques/T1114/
+search: "`o365_management_activity` Category=ThreatManagement Name=eDiscovery search started or exported | table Source Severity AlertEntityId Operation Name | `o365_pst_export_alert_filter`"
+tags:
+  analytics_story:
+  - Office 365 Detections
+  asset_type: "Office 365"
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1114
+  security_domain: threat
+type: ESCU
+version: 1