From d9f0ee461a907261037ddda117490163a40a3e9a Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 16 Dec 2020 13:49:57 -0500 Subject: [PATCH 1/4] o365rodetections --- detections/cloud/o365_pst_export_alert.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 detections/cloud/o365_pst_export_alert.yml diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml new file mode 100644 index 0000000000..f131fc09f4 --- /dev/null +++ b/detections/cloud/o365_pst_export_alert.yml @@ -0,0 +1,21 @@ +author: "Rod Soto, Splunk" +date: "2020-12-16" +description: "This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content" +how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity" +id: 5f694cc4-a678-4a60-9410-bffca1b647dc +known_false_positives: "PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored." +name: O365 PST export alert +references: + - https://attack.mitre.org/techniques/T1114/ +search: "`o365_management_activity` Category=ThreatManagement Name=eDiscovery search started or exported | table Source Severity AlertEntityId Operation Name | `o365_pst_export_alert_filter`" +tags: + analytics_story: + - Office 365 Detections + asset_type: "Office 365" + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1114 + security_domain: threat +type: ESCU +version: 1 From 8b1b7bd5a67ac86d7b5d68ccf692e6bc0ad6094d Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 16 Dec 2020 14:16:20 -0500 Subject: [PATCH 2/4] fixandnewdisablemfa --- detections/cloud/o365_disable_mfa.yml | 21 +++++++++++++++++++++ detections/cloud/o365_pst_export_alert.yml | 2 +- 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/o365_disable_mfa.yml diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml new file mode 100644 index 0000000000..f7c560546b --- /dev/null +++ b/detections/cloud/o365_disable_mfa.yml @@ -0,0 +1,21 @@ +author: "Rod Soto, Splunk" +date: "2020-12-16" +description: "This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user" +how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity" +id: c783dd98-c703-4252-9e8a-f19d9f5c949e +known_false_positives: "PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored." +name: O365 Disable MFA +references: + - https://attack.mitre.org/techniques/T1556/ +search: "sourcetype=o365:management:activity Workload=AzureActiveDirectory | spath Operation | search Operation=Disable Strong Authentication. | table UserType Operation user status signature dest ResultStatus | `o365_disable_mfa_filter`" +tags: + analytics_story: + - Office 365 Detections + asset_type: "Office 365" + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1556 + security_domain: threat +type: ESCU +version: 1 diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index f131fc09f4..ed73f9558a 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -7,7 +7,7 @@ known_false_positives: "PST export can be done for legitimate purposes but due t name: O365 PST export alert references: - https://attack.mitre.org/techniques/T1114/ -search: "`o365_management_activity` Category=ThreatManagement Name=eDiscovery search started or exported | table Source Severity AlertEntityId Operation Name | `o365_pst_export_alert_filter`" +search: "sourcetype=o365:management:activity Category=ThreatManagement Name=eDiscovery search started or exported | table Source Severity AlertEntityId Operation Name | `o365_pst_export_alert_filter`" tags: analytics_story: - Office 365 Detections From 6c47a0d56e9756a18f5db39abc76ed5dd96b9d15 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 16 Dec 2020 14:28:48 -0500 Subject: [PATCH 3/4] excessiveauthfailures --- ...xcessive_authentication_failures_alert.yml | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 detections/cloud/o365_excessive_authentication_failures_alert.yml diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml new file mode 100644 index 0000000000..121727e140 --- /dev/null +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -0,0 +1,21 @@ +author: "Rod Soto, Splunk" +date: "2020-12-16" +description: "This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes" +how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity" +id: d441364c-349c-453b-b55f-12eccab67cf9 +known_false_positives: "The threshold for alert is above 10 attempts and this should reduce the number of false positives." +name: O365 Excessive Authentication Failures Alert +references: + - https://attack.mitre.org/techniques/T1110/ +search: "sourcetype=o365:management:activity Workload=AzureActiveDirectory | UserAuthenticationMethod=* status=Failed | table UserType user UserAuthenticationMethod UserAgent user_type status src_ip signature RequestType ResultStatus LogonError | stats count by user,status |where count > 10| `o365_excessive_authentication_failures_alert_filter`" +tags: + analytics_story: + - Office 365 Detections + asset_type: "Office 365" + kill_chain_phases: + - Not Applicable + mitre_attack_id: + - T1110 + security_domain: threat +type: ESCU +version: 1 From 018d1bd766f1588cd969383686a06f02bd093e19 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 16 Dec 2020 14:32:10 -0500 Subject: [PATCH 4/4] addedmacros --- detections/cloud/o365_disable_mfa.yml | 4 ++-- .../cloud/o365_excessive_authentication_failures_alert.yml | 2 +- detections/cloud/o365_pst_export_alert.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index f7c560546b..0a5a28dee0 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -3,11 +3,11 @@ date: "2020-12-16" description: "This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user" how_to_implement: "You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity" id: c783dd98-c703-4252-9e8a-f19d9f5c949e -known_false_positives: "PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored." +known_false_positives: "Unless it is a special case, it is uncommon to disable MFA or Strong Authentication" name: O365 Disable MFA references: - https://attack.mitre.org/techniques/T1556/ -search: "sourcetype=o365:management:activity Workload=AzureActiveDirectory | spath Operation | search Operation=Disable Strong Authentication. | table UserType Operation user status signature dest ResultStatus | `o365_disable_mfa_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory | spath Operation | search Operation=Disable Strong Authentication. | table UserType Operation user status signature dest ResultStatus | `o365_disable_mfa_filter`" tags: analytics_story: - Office 365 Detections diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 121727e140..80876acdc4 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -7,7 +7,7 @@ known_false_positives: "The threshold for alert is above 10 attempts and this sh name: O365 Excessive Authentication Failures Alert references: - https://attack.mitre.org/techniques/T1110/ -search: "sourcetype=o365:management:activity Workload=AzureActiveDirectory | UserAuthenticationMethod=* status=Failed | table UserType user UserAuthenticationMethod UserAgent user_type status src_ip signature RequestType ResultStatus LogonError | stats count by user,status |where count > 10| `o365_excessive_authentication_failures_alert_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory | UserAuthenticationMethod=* status=Failed | table UserType user UserAuthenticationMethod UserAgent user_type status src_ip signature RequestType ResultStatus LogonError | stats count by user,status |where count > 10| `o365_excessive_authentication_failures_alert_filter`" tags: analytics_story: - Office 365 Detections diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index ed73f9558a..f131fc09f4 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -7,7 +7,7 @@ known_false_positives: "PST export can be done for legitimate purposes but due t name: O365 PST export alert references: - https://attack.mitre.org/techniques/T1114/ -search: "sourcetype=o365:management:activity Category=ThreatManagement Name=eDiscovery search started or exported | table Source Severity AlertEntityId Operation Name | `o365_pst_export_alert_filter`" +search: "`o365_management_activity` Category=ThreatManagement Name=eDiscovery search started or exported | table Source Severity AlertEntityId Operation Name | `o365_pst_export_alert_filter`" tags: analytics_story: - Office 365 Detections