From 0db4e4e3d9ee59dc4423254baa490731800802f7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 5 Jul 2023 10:13:35 +0200 Subject: [PATCH 1/2] o365_fix --- .../o365_add_app_role_assignment_grant_user.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 0cf322f3ee..ab8c45eb5c 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -5,13 +5,15 @@ date: '2021-01-26' author: Rod Soto, Splunk status: production type: TTP -description: This search detects the creation of a new Federation setting by alerting - about an specific event related to its creation. +description: This search is designed to detect the creation of a new Federation setting by alerting on a specific event associated with its creation. + By monitoring for this event, the search can identify any instances where a Federation setting is being created within the system. + This can help in detecting and monitoring any unauthorized or suspicious changes to the Federation settings, + providing an additional layer of security for your environment. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app - role assignment grant to user." | stats count min(_time) as firstTime max(_time) - as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by - ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." + | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by UserId dest ResultStatus + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -56,7 +58,7 @@ tags: - Operation - Actor{}.ID - Actor{}.Type - - ActorIpAddress + - UserId - dest - ResultStatus risk_score: 18 From fcf20c818f22be9c02ec959be5ccb1bdf65a85e8 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Jul 2023 14:08:38 -0500 Subject: [PATCH 2/2] Update o365_add_app_role_assignment_grant_user.yml --- detections/cloud/o365_add_app_role_assignment_grant_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index ab8c45eb5c..b3e13ef1e3 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -1,7 +1,7 @@ name: O365 Add App Role Assignment Grant User id: b2c81cc6-6040-11eb-ae93-0242ac130002 version: 1 -date: '2021-01-26' +date: '2023-07-11' author: Rod Soto, Splunk status: production type: TTP