mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
60 lines
1.8 KiB
YAML
60 lines
1.8 KiB
YAML
name: O365 PST export alert
|
|
id: 5f694cc4-a678-4a60-9410-bffca1b647dc
|
|
version: 1
|
|
date: '2020-12-16'
|
|
author: Rod Soto, Splunk
|
|
type: TTP
|
|
datamodel: []
|
|
description: This search detects when a user has performed an Ediscovery search or
|
|
exported a PST file from the search. This PST file usually has sensitive information
|
|
including email body content
|
|
search: '`o365_management_activity` Category=ThreatManagement Name="eDiscovery search
|
|
started or exported" | stats count earliest(_time) as firstTime latest(_time) as
|
|
lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)`
|
|
|`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`'
|
|
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
|
|
works with o365:management:activity
|
|
known_false_positives: PST export can be done for legitimate purposes but due to the
|
|
sensitive nature of its content it must be monitored.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1114/
|
|
tags:
|
|
analytic_story:
|
|
- Office 365 Detections
|
|
- Data Exfiltration
|
|
asset_type: Office 365
|
|
confidence: 60
|
|
context:
|
|
- Source:Cloud Data
|
|
- Scope:External
|
|
- Outcome:Allowed
|
|
- Stage:Exfiltration
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file.json
|
|
impact: 80
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: User $Source$ has exported a PST file from the search using this operation-
|
|
$Operation$ with a severity of $Severity$
|
|
mitre_attack_id:
|
|
- T1114
|
|
observable:
|
|
- name: Source
|
|
type: User
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Category
|
|
- Name
|
|
- Source
|
|
- Severity
|
|
- AlertEntityId
|
|
- Operation
|
|
risk_score: 48
|
|
security_domain: threat
|