diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index e48b35f375..9b4d1e6d12 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Password and Payroll Compromise Behavior id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96 -version: 7 +version: 8 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: TTP -description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete") @@ -32,8 +34,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_password_and_payroll_compromise_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -48,7 +52,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ finding: @@ -86,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index 5362379aa3..51c0ec9f30 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Receive and Hard Delete Takeover Behavior id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions") @@ -31,8 +33,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_receive_and_hard_delete_takeover_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Possible new user/account onboarding processes. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Possible new user/account onboarding processes. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -47,7 +51,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ intermediate_findings: @@ -87,3 +91,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index 5fc9037fee..174bf25eb1 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -1,21 +1,24 @@ name: O365 Email Send and Hard Delete Exfiltration Behavior id: dd7798cf-c4f5-4114-ad0f-beacd9a33708 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. +description: |- + The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. + This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, max=0 [ | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) @@ -26,14 +29,16 @@ search: |- | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user | where opcount > 1 AND firstTime < lastTime ] - | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient,Organization - | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1) + | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient + | eval externalRecipient = if(mvindex(split(lower(recipient),"@"),1)==mvindex(split(lower(user),"@"),1),0,1) | where externalRecipient = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_and_hard_delete_exfiltration_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -90,3 +95,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 3842d035ee..1616e1a270 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -1,20 +1,24 @@ name: O365 Email Send Attachments Excessive Volume id: 70a050a2-8537-488a-a628-b60a9558d96a -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. +description: |- + The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. + Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. + Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. data_source: - Office 365 Universal Audit Log search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, _time max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf") @@ -27,14 +31,16 @@ search: |- | eval file_name = mvjoin(file_name,"||") ] | eval file_name = split(file_name,"||") - | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId + | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,InternetMessageId | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient)) | search recipient = * | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_attachments_excessive_volume_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -84,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/macros/o365_messagetrace.yml b/macros/o365_messagetrace.yml index 390f011741..2b530a58f2 100644 --- a/macros/o365_messagetrace.yml +++ b/macros/o365_messagetrace.yml @@ -1,8 +1,8 @@ name: o365_messagetrace id: 1ead5eb3-85e8-40fb-9eb4-6936843f08d6 -version: 1 +version: 2 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Splunk Threat Research Team description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace") +definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace","o365:graph:messagetrace")