From 6370f62c03b0d4bba3ead1f6f3df6c82823add52 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Mon, 6 Jan 2025 13:55:15 -0500 Subject: [PATCH 1/9] Initial upload --- ...ve_os_vendors_authenticating_from_user.yml | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml new file mode 100644 index 0000000000..def11169b1 --- /dev/null +++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml @@ -0,0 +1,62 @@ +name: O365 Excessive OS Vendors Authenticating From User +id: 3451e58a-9457-4985-a600-b616b0cbfda1 +version: 1 +date: '2024-12-19' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection. +data_source: +- Office 365 Universal Audit Log +search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) +| eval -time = _time +| bin _time span=15m +| stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time +| where os_count >= 4 +| eval src = ClientIP, user = UserId +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `o365_excessive_os_vendors_authenticating_from_user_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. +known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. +references: +- https://attack.mitre.org/techniques/T1110 +- https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/ +- https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/ +- https://github.com/dafthack/MFASweep/tree/master +tags: + analytic_story: + - Office 365 Account Takeover + asset_type: O365 Tenant + confidence: 75 + impact: 80 + message: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$. + mitre_attack_id: + - T1110 + observable: + - name: src + type: IP Address + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Operation + - ClientIP + - UserId + - OS + risk_score: 60 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log + source: o365 + sourcetype: o365:management:activity \ No newline at end of file From 07ec40165362a6113dcefecda346867bbcd1eb4f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 7 Jan 2025 16:02:16 -0500 Subject: [PATCH 2/9] Update o365_excessive_os_vendors_authenticating_from_user.yml Adding drilldowns --- ...essive_os_vendors_authenticating_from_user.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml index def11169b1..7a019c456c 100644 --- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml @@ -24,6 +24,19 @@ references: - https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/ - https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/ - https://github.com/dafthack/MFASweep/tree/master +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate logons from $user$ + search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) $user|s$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ tags: analytic_story: - Office 365 Account Takeover @@ -59,4 +72,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log source: o365 - sourcetype: o365:management:activity \ No newline at end of file + sourcetype: o365:management:activity From 56f36dbbc72b76a152a8ceaa2525755a1bca6fd4 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 08:21:49 -0500 Subject: [PATCH 3/9] Update o365_excessive_os_vendors_authenticating_from_user.yml --- .../o365_excessive_os_vendors_authenticating_from_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml index 7a019c456c..84e665b071 100644 --- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml @@ -26,7 +26,7 @@ references: - https://github.com/dafthack/MFASweep/tree/master drilldown_searches: - name: View the detection results for - "$user$" - search: '%original_detection_search% | search user = "$user$" + search: '%original_detection_search% | search user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" From 51ba4b9394d840c784dd7725c87d4bb388c90375 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 8 Jan 2025 08:26:05 -0500 Subject: [PATCH 4/9] Update o365_excessive_os_vendors_authenticating_from_user.yml --- .../o365_excessive_os_vendors_authenticating_from_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml index 84e665b071..9304e68215 100644 --- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml @@ -72,4 +72,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events.log source: o365 - sourcetype: o365:management:activity + sourcetype: o365:management:activity From d9e118313457eb7a735bb5b4b8cf06c77d2b1d09 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 14 Jan 2025 11:14:32 -0800 Subject: [PATCH 5/9] minor update --- .../o365_excessive_os_vendors_authenticating_from_user.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml index 9304e68215..27ded0924f 100644 --- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml @@ -7,7 +7,7 @@ status: production type: TTP description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection. data_source: -- Office 365 Universal Audit Log +- O365 search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) | eval -time = _time | bin _time span=15m @@ -50,7 +50,7 @@ tags: - name: src type: IP Address role: - - Victim + - Attacker - name: user type: User role: From 7186803473073829c1e15cff96a75b2bd08b9bc6 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 15 Jan 2025 14:00:39 -0500 Subject: [PATCH 6/9] Update o365_excessive_os_vendors_authenticating_from_user.yml --- .../o365_excessive_os_vendors_authenticating_from_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml index 27ded0924f..bb764c8325 100644 --- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml @@ -34,7 +34,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate logons from $user$ - search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) $user|s$' + search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: From db9a69ddb0695922849094a524caf1ea626c736b Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 15 Jan 2025 14:14:09 -0500 Subject: [PATCH 7/9] Update and rename o365_excessive_os_vendors_authenticating_from_user.yml to o365_multiple_os_vendors_authenticating_from_user.yml rename to align with existing similar detections --- ...> o365_multiple_os_vendors_authenticating_from_user.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename detections/cloud/{o365_excessive_os_vendors_authenticating_from_user.yml => o365_multiple_os_vendors_authenticating_from_user.yml} (94%) diff --git a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml similarity index 94% rename from detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml rename to detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml index bb764c8325..8fe646c285 100644 --- a/detections/cloud/o365_excessive_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml @@ -1,4 +1,4 @@ -name: O365 Excessive OS Vendors Authenticating From User +name: O365 Multiple OS Vendors Authenticating From User id: 3451e58a-9457-4985-a600-b616b0cbfda1 version: 1 date: '2024-12-19' @@ -16,7 +16,7 @@ search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) | eval src = ClientIP, user = UserId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `o365_excessive_os_vendors_authenticating_from_user_filter`' +| `o365_multiple_os_vendors_authenticating_from_user_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. references: @@ -54,7 +54,7 @@ tags: - name: user type: User role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security From 0d3b963a4d6391dd853bfe899c28862bd8ce097a Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 15 Jan 2025 14:17:36 -0500 Subject: [PATCH 8/9] Update o365_multiple_os_vendors_authenticating_from_user.yml --- .../cloud/o365_multiple_os_vendors_authenticating_from_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml index 8fe646c285..ec077a0854 100644 --- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml @@ -54,7 +54,7 @@ tags: - name: user type: User role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security From fab070785ce463ca572bd4153757d046d44830e9 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Sun, 2 Feb 2025 12:43:45 -0500 Subject: [PATCH 9/9] Update o365_multiple_os_vendors_authenticating_from_user.yml update to new yaml spec / update search yaml for better readability / remove single quote in SPL issues --- ...le_os_vendors_authenticating_from_user.yml | 49 ++++++++----------- 1 file changed, 20 insertions(+), 29 deletions(-) diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml index ec077a0854..743aca09e9 100644 --- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml +++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml @@ -7,16 +7,17 @@ status: production type: TTP description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection. data_source: -- O365 -search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) -| eval -time = _time -| bin _time span=15m -| stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time -| where os_count >= 4 -| eval src = ClientIP, user = UserId -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `o365_multiple_os_vendors_authenticating_from_user_filter`' +- Office 365 Universal Audit Log +search: |- + `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) + | eval -time = _time + | bin _time span=15m + | stats values(Operation) as signature, values(ErrorNumber) as signature_id, values(OS) as os_name, dc(OS) as os_count, count, min(-time) as firstTime, max(-time) as lastTime by ClientIP, UserId, _time + | where os_count >= 4 + | eval src = ClientIP, user = UserId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_multiple_os_vendors_authenticating_from_user_filter` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique OS) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment. known_false_positives: IP or users where the usage of multiple Operating systems is expected, filter accordingly. references: @@ -37,35 +38,25 @@ drilldown_searches: search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$. + risk_objects: + - field: user + type: user + score: 60 + threat_objects: + - field: src + type: ip_address tags: analytic_story: - Office 365 Account Takeover asset_type: O365 Tenant - confidence: 75 - impact: 80 - message: The user account $user$ authenticated with $os_count$ unique operating system types over a short period from $src$. mitre_attack_id: - T1110 - observable: - - name: src - type: IP Address - role: - - Attacker - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Operation - - ClientIP - - UserId - - OS - risk_score: 60 security_domain: threat tests: - name: True Positive Test