From 11d2cdebc8e3e473acac68df1db4a21ae8e740a3 Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Wed, 23 Sep 2026 14:04:57 -0500 Subject: [PATCH] T1114 o365_suspect_email_actions: add Graph message trace fixture Splunk Add-on for Microsoft Office 365 6.x collects message trace via Microsoft Graph and emits sourcetype o365:graph:messagetrace with camelCase fields. Add the same four suspect messages in that shape so the ESCU message trace detections can be tested against both sourcetypes. Also correct the manifest sourcetype for the legacy message trace file. Co-Authored-By: Claude Fable 5.1 --- .../o365_graph_messagetrace_suspect_events.log | 3 +++ .../o365_suspect_email_actions.yml | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log new file mode 100644 index 000000000..3c68dc606 --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2d0a6bbfdb7d44cc4b9fafc369c108e339a6c10f31de0b4261584abf99de84ee +size 1716 diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml index 391323b4f..a1b70957f 100644 --- a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml +++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml @@ -9,7 +9,11 @@ mitre_technique: datasets: - name: o365_messagetrace_suspect_events path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events.log - sourcetype: o365:management:activity + sourcetype: o365:reporting:messagetrace + source: o365 +- name: o365_graph_messagetrace_suspect_events + path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + sourcetype: o365:graph:messagetrace source: o365 - name: o365_exchange_suspect_events path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log