Skip to content

Commit f0857d6

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3292 from nterl0k/nterl0k-t1114-sus-o365-email-actions
Nterl0k - T1114 Suspect 0365 Email Actions
2 parents 44c8147 + 6c5b296 commit f0857d6

9 files changed

+626
-0
lines changed

‎data_sources/office_365_reporting_message_trace.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Office 365 Reporting Message Trace
2+
id: b637788e-fcf0-44fa-86ea-cab81193f939
3+
version: 1
4+
date: '2025-02-28'
5+
author: Steven Dick
6+
description: Data source object for Office 365 Reporting Message Trace
7+
source: o365
8+
sourcetype: o365:reporting:messagetrace
9+
separator: Organization
10+
supported_TA:
11+
- name: Splunk Microsoft Office 365 Add-on
12+
url: https://splunkbase.splunk.com/app/4055
13+
version: 4.8.0
14+
fields:
15+
- FromIP
16+
- Index
17+
- MessageId
18+
- MessageTraceId
19+
- Organization
20+
- Received
21+
- RecipientAddress
22+
- SenderAddress
23+
- Size
24+
- Status
25+
- Subject
26+
- ToIP
27+
- _bkt
28+
- _cd
29+
- _eventtype_color
30+
- _indextime
31+
- _raw
32+
- _serial
33+
- _si
34+
- _sourcetype
35+
- _subsecond
36+
- _time
37+
- action
38+
- date_hour
39+
- date_mday
40+
- date_minute
41+
- date_month
42+
- date_second
43+
- date_wday
44+
- date_year
45+
- date_zone
46+
- dest
47+
- eventtype
48+
- host
49+
- index
50+
- internal_message_id
51+
- linecount
52+
- message_id
53+
- punct
54+
- recipient
55+
- recipient_count
56+
- recipient_domain
57+
- size
58+
- source
59+
- sourcetype
60+
- splunk_server
61+
- splunk_server_group
62+
- src
63+
- src_user
64+
- src_user_domain
65+
- status_code
66+
- subject
67+
- tag
68+
- tag::action
69+
- tag::eventtype
70+
- timeendpos
71+
- timestartpos
72+
- vendor_product
73+
example_log: '{"Organization": "attackrange.onmicrosoft.com", "MessageId": "<BY5PR08MB62304A5BB7F9EE555B4CEA26DC1C2@BY5PR08MB6230.namprd08.prod.outlook.com>", "Received": "2025-01-16T21:06:46.832439", "SenderAddress": "victim_2@attack_range.lan", "RecipientAddress": "[email protected]", "Subject": "Accounts and Passwords", "Status": "Delivered", "ToIP": "2607:f8b0:400e:c0d::1a", "FromIP": "189.135.168.197", "Size": 33584, "MessageTraceId": "3567c8ef-cc17-4a3f-d166-08dd3161e4fc", "Index": 3035}'

‎detections/cloud/o365_email_hard_delete_excessive_volume.yml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: O365 Email Hard Delete Excessive Volume
2+
id: c7fe0949-348a-41ce-8f17-a09a7fe5fd7d
3+
version: 1
4+
date: '2025-01-20'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to permanently purge a large amount of items from the mailbox. Threat actors may attempt to remove evidence of their activity by purging items from the compromised mailbox. --- Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Workload=Exchange (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions"))
13+
| eval user = lower(UserId), sender = lower(CASE(isnotnull(SendAsUserSmtp),SendAsUserSmtp,isnotnull(SendOnBehalfOfUserSmtp),SendOnBehalfOfUserSmtp,true(),MailboxOwnerUPN)), subject = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),'Item.Subject',Operation IN ("SoftDelete","HardDelete"),'AffectedItems{}.Subject')), -time = _time,file_name = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),split('Item.Attachments',"; "),Operation IN ("SoftDelete","HardDelete"),split('AffectedItems{}.Attachments',"; ")), file_size = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),round(tonumber('Item.SizeInBytes')/1024/1024,2),true(),round(tonumber(replace(file_name, "(.+)\s\((\d+)(b\)$)", "\2"))/1024/1024,2))
14+
| bin _time span=1hr
15+
| stats values(sender) as sender, values(ClientIPAddress) as src, values(ClientInfoString) as http_user_agent, values(Operation) as signature, latest(file_name) as file_name, sum(file_size) as file_size, values(Folder.Path) as file_path, min(-time) as firstTime, max(-time) as lastTime, dc(subject) as count by _time,user
16+
| where count > 50 OR file_size > 10
17+
| `security_content_ctime(firstTime)`
18+
| `security_content_ctime(lastTime)`
19+
| `o365_email_hard_delete_excessive_volume_filter`
20+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
21+
known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
22+
references:
23+
- https://attack.mitre.org/techniques/T1114/
24+
- https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
25+
- https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
26+
drilldown_searches:
27+
- name: View the detection results for - "$user$"
28+
search: '%original_detection_search% | search user = "$user$"'
29+
earliest_offset: $info_min_time$
30+
latest_offset: $info_max_time$
31+
- name: View risk events for the last 7 days for - "$user$"
32+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: Investigate Email for $user$
36+
search: '`o365_management_activity` Workload=Exchange (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) AND UserId = "$user$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
rba:
40+
message: The user $user$ deleted an excessing number of emails [$count$] within a short timeframe
41+
risk_objects:
42+
- field: user
43+
type: user
44+
score: 25
45+
threat_objects:
46+
- field: src
47+
type: ip_address
48+
tags:
49+
analytic_story:
50+
- Office 365 Account Takeover
51+
- Suspicious Emails
52+
- Data Destruction
53+
asset_type: O365 Tenant
54+
mitre_attack_id:
55+
- T1070.008
56+
- T1485
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
security_domain: threat
62+
tests:
63+
- name: True Positive Test
64+
attack_data:
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
66+
source: o365
67+
sourcetype: o365:management:activity

‎detections/cloud/o365_email_new_inbox_rule_created.yml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: O365 Email New Inbox Rule Created
2+
id: 449f525a-7b42-47be-96a7-d9724e336c19
3+
version: 1
4+
date: '2025-01-20'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies the creation of new email inbox rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters that may indicate mail forwarding, removal, or obfuscation. Inbox rule creation is a typical end-user activity however attackers also leverage this technique for multiple reasons.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
search: |-
12+
`o365_management_activity` Workload=Exchange AND (Operation=New-InboxRule OR Operation=Set-InboxRule) Parameters{}.Name IN (SoftDeleteMessage,DeleteMessage,ForwardTo,ForwardAsAttachmentTo,RedirectTo,MoveToFolder,CopyToFolder)
13+
| eval file_path = mvappend(MoveToFolder,CopyToFolder), recipient=mvappend(ForwardTo, ForwardAsAttachmentTo, RedirectTo), user = lower(UserId), signature = Operation, src = if(match(ClientIP, "^\["), ltrim(mvindex(split(ClientIP, "]:"), 0), "["), mvindex(split(ClientIP,":"),0)), desc = Name, action = 'Parameters{}.Name'
14+
15+
| stats values(action) as action, values(src) as src, values(recipient) as recipient, values(file_path) as file_path, count, min(_time) as firstTime, max(_time) as lastTime by user, signature, desc
16+
| `security_content_ctime(firstTime)`
17+
| `security_content_ctime(lastTime)`
18+
| `o365_email_new_inbox_rule_created_filter`
19+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
20+
known_false_positives: Users may create email rules for legitimate purposes. Filter as needed.
21+
references:
22+
- https://attack.mitre.org/techniques/T1114/
23+
- https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
24+
- https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
25+
drilldown_searches:
26+
- name: View the detection results for - "$user$"
27+
search: '%original_detection_search% | search user = "$user$"'
28+
earliest_offset: $info_min_time$
29+
latest_offset: $info_max_time$
30+
- name: View risk events for the last 7 days for - "$user$"
31+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: Investigate Inbox Rules for $user$
35+
search: '`o365_management_activity` Workload=Exchange AND (Operation=New-InboxRule OR Operation=Set-InboxRule) AND UserId = "$user$"'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: A new email inbox rule was created for $user$
40+
risk_objects:
41+
- field: user
42+
type: user
43+
score: 10
44+
threat_objects:
45+
- field: desc
46+
type: signature
47+
tags:
48+
analytic_story:
49+
- Office 365 Collection Techniques
50+
asset_type: O365 Tenant
51+
mitre_attack_id:
52+
- T1114.003
53+
- T1564.008
54+
product:
55+
- Splunk Enterprise
56+
- Splunk Enterprise Security
57+
- Splunk Cloud
58+
security_domain: audit
59+
tests:
60+
- name: True Positive Test
61+
attack_data:
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
63+
source: o365
64+
sourcetype: o365:management:activity

‎detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: O365 Email Password and Payroll Compromise Behavior
2+
id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96
3+
version: 1
4+
date: '2025-01-20'
5+
author: Steven Dick
6+
status: production
7+
type: TTP
8+
description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
9+
data_source:
10+
- Office 365 Universal Audit Log
11+
- Office 365 Reporting Message Trace
12+
search: |-
13+
`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
14+
| eval mailtime = _time
15+
| bin _time span=4hr
16+
| eval user = lower(RecipientAddress)
17+
| eval InternetMessageId = lower(MessageId)
18+
| join InternetMessageId, user max=0
19+
[
20+
| search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete")
21+
| spath path=AffectedItems{} output=AffectedItemSplit
22+
| fields _time,ClientIP,ClientInfoString,UserId,Operation,ResultStatus,MailboxOwnerUPN,AffectedItemSplit
23+
| mvexpand AffectedItemSplit | spath input=AffectedItemSplit
24+
| search Subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
25+
| eval deltime = _time
26+
| bin _time span=4hr
27+
| eval InternetMessageId = lower(InternetMessageId), user = lower(UserId)
28+
]
29+
| stats values(ClientInfoString) as http_user_agent, values(ClientIP) as src, values(Subject) as subject, dc(Subject) as subject_count, values(Operation) as action, values(ResultStatus) as result, count, min(mailtime) as firstTime, max(deltime) as lastTime by user,_time
30+
| search subject IN ("*banking*","*direct deposit*","*pay-to*") AND subject IN ("*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
31+
| `security_content_ctime(firstTime)`
32+
| `security_content_ctime(lastTime)`
33+
| `o365_email_password_and_payroll_compromise_behavior_filter`
34+
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
35+
known_false_positives: Unknown, unlikely.
36+
references:
37+
- https://attack.mitre.org/techniques/T1114/
38+
- https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
39+
- https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
40+
drilldown_searches:
41+
- name: View the detection results for - "$user$"
42+
search: '%original_detection_search% | search user = "$user$"'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
- name: View risk events for the last 7 days for - "$user$"
46+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
- name: Investigate Email for $user$
50+
search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"'
51+
earliest_offset: $info_min_time$
52+
latest_offset: $info_max_time$
53+
rba:
54+
message: The user $user$ received and deleted password and payroll change emails within a short timeframe
55+
risk_objects:
56+
- field: user
57+
type: user
58+
score: 90
59+
threat_objects:
60+
- field: src
61+
type: ip_address
62+
tags:
63+
analytic_story:
64+
- Office 365 Account Takeover
65+
- Office 365 Collection Techniques
66+
- Suspicious Emails
67+
- Data Destruction
68+
asset_type: O365 Tenant
69+
mitre_attack_id:
70+
- T1070.008
71+
- T1485
72+
- T1114.001
73+
product:
74+
- Splunk Enterprise
75+
- Splunk Enterprise Security
76+
- Splunk Cloud
77+
security_domain: threat
78+
tests:
79+
- name: True Positive Test
80+
attack_data:
81+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
82+
source: o365
83+
sourcetype: o365:management:activity
84+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events.log
85+
source: o365_messagetrace
86+
sourcetype: o365:reporting:messagetrace

0 commit comments

Comments
 (0)