Skip to content

Commit aa21a51

Browse files
terrancedejesustradebot-elastic
terrancedejesus
authored and
tradebot-elastic
committed
[Rule Tuning] M365 Portal Logins (Impossible & Atypical) (#5031)
* [Rule Tuning] M365 Portal Logins (Impossible & Atypical) Fixes #5009 * updated new terms value * fixed unit test failures * Update rules/integrations/o365/initial_access_microsoft_365_portal_login_from_rare_location.toml Co-authored-by: Samirbous <[email protected]> * Update rules/integrations/o365/initial_access_microsoft_365_impossible_travel_portal_logins.toml Co-authored-by: Samirbous <[email protected]> * adjusted rule name and file names * fixed field mispelling * fixed investigation guide --------- Co-authored-by: Samirbous <[email protected]> (cherry picked from commit d9151c3)
1 parent 9831713 commit aa21a51

4 files changed

+267
-207
lines changed

‎rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
[metadata]
2+
creation_date = "2024/09/04"
3+
integration = ["o365"]
4+
maturity = "production"
5+
updated_date = "2025/08/26"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Detects successful Microsoft 365 portal logins from rare locations. Rare locations are defined as locations that are not
11+
commonly associated with the user's account. This behavior may indicate an adversary attempting to access a Microsoft
12+
365 account from an unusual location or behind a VPN.
13+
"""
14+
false_positives = [
15+
"""
16+
False positives may occur when users are using a VPN or when users are traveling to different locations"
17+
""",
18+
"""
19+
Mobile access may also result in false positives, as users may log in from various locations while on the go.
20+
""",
21+
]
22+
from = "now-15m"
23+
index = ["filebeat-*", "logs-o365.audit-*"]
24+
language = "kuery"
25+
license = "Elastic License v2"
26+
name = "M365 Portal Login (Atypical Travel)"
27+
note = """## Triage and analysis
28+
29+
### Investigating M365 Portal Login (Atypical Travel)
30+
31+
Microsoft 365 is a cloud-based suite offering productivity tools accessible from anywhere, making it crucial for business operations. Adversaries may exploit this by logging in from uncommon locations, potentially using VPNs to mask their origin. The detection rule identifies successful logins from atypical locations, flagging potential unauthorized access attempts by analyzing login events and user location patterns.
32+
33+
### Possible investigation steps
34+
35+
- Review the user associated with these sign-ins to determine if the login attempt was legitimate or if further investigation is needed.
36+
- Analyze the geographic locations of the logins to identify any patterns or anomalies that may indicate malicious activity.
37+
- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
38+
- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
39+
- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
40+
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns.
41+
42+
### False positive analysis
43+
44+
- Users traveling or using VPNs may trigger this alert. Verify with the user if they were traveling or using a VPN at the time of the login attempt.
45+
- Mobile access may also result in false positives, as users may log in from various locations while on the go.
46+
47+
### Response and remediation
48+
49+
- Investigate the login attempt further by checking for any additional context or related events that may provide insight into the user's behavior.
50+
- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
51+
- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
52+
- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
53+
"""
54+
references = ["https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-"]
55+
risk_score = 47
56+
rule_id = "32d3ad0e-6add-11ef-8c7b-f661ea17fbcc"
57+
severity = "medium"
58+
tags = [
59+
"Domain: Cloud",
60+
"Domain: SaaS",
61+
"Data Source: Microsoft 365",
62+
"Data Source: Microsoft 365 Audit Logs",
63+
"Use Case: Threat Detection",
64+
"Use Case: Identity and Access Audit",
65+
"Tactic: Initial Access",
66+
"Resources: Investigation Guide",
67+
]
68+
timestamp_override = "event.ingested"
69+
type = "new_terms"
70+
71+
query = '''
72+
event.dataset:o365.audit and
73+
event.provider:AzureActiveDirectory and
74+
event.action:UserLoggedIn and
75+
event.outcome:success and
76+
o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
77+
o365.audit.UserId:(* and not "Not Available") and
78+
source.geo.region_iso_code:* and
79+
o365.audit.Target.ID:(
80+
00000006-0000-0ff1-ce00-000000000000 or
81+
4765445b-32c6-49b0-83e6-1d93765276ca
82+
) and not o365.audit.ApplicationId:(
83+
29d9ed98-a469-4536-ade2-f981bc1d605e or
84+
38aa3b87-a06d-4817-b275-7a316988d93b or
85+
a809996b-059e-42e2-9866-db24b99a9782
86+
) and not o365.audit.ExtendedProperties.RequestType:(
87+
"Cmsi:Cmsi" or
88+
"Consent:Set" or
89+
"Login:reprocess" or
90+
"Login:resume" or
91+
"MessagePrompt:MessagePrompt" or
92+
"SAS:EndAuth"
93+
)
94+
'''
95+
96+
97+
[[rule.threat]]
98+
framework = "MITRE ATT&CK"
99+
[[rule.threat.technique]]
100+
id = "T1078"
101+
name = "Valid Accounts"
102+
reference = "https://attack.mitre.org/techniques/T1078/"
103+
[[rule.threat.technique.subtechnique]]
104+
id = "T1078.004"
105+
name = "Cloud Accounts"
106+
reference = "https://attack.mitre.org/techniques/T1078/004/"
107+
108+
109+
110+
[rule.threat.tactic]
111+
id = "TA0001"
112+
name = "Initial Access"
113+
reference = "https://attack.mitre.org/tactics/TA0001/"
114+
115+
[rule.investigation_fields]
116+
field_names = [
117+
"@timestamp",
118+
"organization.id",
119+
"o365.audit.UserId",
120+
"o365.audit.ActorIpAddress",
121+
"o365.audit.ApplicationId",
122+
"o365.audit.ExtendedProperties.RequestType",
123+
"o365.audit.Target.ID",
124+
"source.geo.region_iso_code",
125+
]
126+
127+
[rule.new_terms]
128+
field = "new_terms_fields"
129+
value = ["o365.audit.UserId", "source.geo.region_iso_code"]
130+
[[rule.new_terms.history_window_start]]
131+
field = "history_window_start"
132+
value = "now-14d"
133+
134+

‎rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
[metadata]
2+
creation_date = "2024/09/04"
3+
integration = ["o365"]
4+
maturity = "production"
5+
updated_date = "2025/08/26"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined
11+
as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a
12+
Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from
13+
a different location.
14+
"""
15+
false_positives = [
16+
"""
17+
False positives may occur when users are using a VPN or when users are traveling to different locations for
18+
legitimate purposes.
19+
""",
20+
]
21+
from = "now-15m"
22+
index = ["filebeat-*", "logs-o365.audit-*"]
23+
language = "kuery"
24+
license = "Elastic License v2"
25+
name = "M365 Portal Login (Impossible Travel)"
26+
note = """## Triage and analysis
27+
28+
### Investigating M365 Portal Login (Impossible Travel)
29+
30+
Microsoft 365's cloud-based services enable global access, but this can be exploited by adversaries logging in from disparate locations within short intervals, indicating potential account compromise. The detection rule identifies such anomalies by analyzing login events for rapid geographic shifts, flagging suspicious activity that may suggest unauthorized access attempts.
31+
32+
### Possible investigation steps
33+
34+
- Review the user associated with these sign-ins to determine if the login attempt was legitimate or if further investigation is needed.
35+
- Analyze the geographic locations of the logins to identify any patterns or anomalies that may indicate malicious activity.
36+
- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
37+
- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
38+
- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
39+
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns.
40+
41+
### False positive analysis
42+
43+
- Users traveling or using VPNs may trigger this alert. Verify with the user if they were traveling or using a VPN at the time of the login attempt.
44+
- Mobile access may also result in false positives, as users may log in from various locations while on the go.
45+
46+
### Response and remediation
47+
48+
- Investigate the login attempt further by checking for any additional context or related events that may provide insight into the user's behavior.
49+
- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
50+
- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
51+
- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
52+
"""
53+
references = ["https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-"]
54+
risk_score = 47
55+
rule_id = "3896d4c0-6ad1-11ef-8c7b-f661ea17fbcc"
56+
severity = "medium"
57+
tags = [
58+
"Domain: Cloud",
59+
"Domain: SaaS",
60+
"Data Source: Microsoft 365",
61+
"Data Source: Microsoft 365 Audit Logs",
62+
"Use Case: Threat Detection",
63+
"Use Case: Identity and Access Audit",
64+
"Tactic: Initial Access",
65+
"Resources: Investigation Guide",
66+
]
67+
timestamp_override = "event.ingested"
68+
type = "threshold"
69+
70+
query = '''
71+
event.dataset:o365.audit and
72+
event.provider:AzureActiveDirectory and
73+
event.action:UserLoggedIn and
74+
event.outcome:success and
75+
o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
76+
o365.audit.UserId:(* and not "Not Available") and
77+
source.geo.country_name:* and
78+
o365.audit.Target.ID:(
79+
00000006-0000-0ff1-ce00-000000000000 or
80+
4765445b-32c6-49b0-83e6-1d93765276ca
81+
) and not o365.audit.ApplicationId:(
82+
29d9ed98-a469-4536-ade2-f981bc1d605e or
83+
38aa3b87-a06d-4817-b275-7a316988d93b or
84+
a809996b-059e-42e2-9866-db24b99a9782
85+
) and not o365.audit.ExtendedProperties.RequestType:(
86+
"Cmsi:Cmsi" or
87+
"Consent:Set" or
88+
"Login:reprocess" or
89+
"Login:resume" or
90+
"MessagePrompt:MessagePrompt" or
91+
"SAS:EndAuth"
92+
)
93+
'''
94+
95+
96+
[[rule.threat]]
97+
framework = "MITRE ATT&CK"
98+
[[rule.threat.technique]]
99+
id = "T1078"
100+
name = "Valid Accounts"
101+
reference = "https://attack.mitre.org/techniques/T1078/"
102+
[[rule.threat.technique.subtechnique]]
103+
id = "T1078.004"
104+
name = "Cloud Accounts"
105+
reference = "https://attack.mitre.org/techniques/T1078/004/"
106+
107+
108+
109+
[rule.threat.tactic]
110+
id = "TA0001"
111+
name = "Initial Access"
112+
reference = "https://attack.mitre.org/tactics/TA0001/"
113+
114+
[rule.investigation_fields]
115+
field_names = [
116+
"@timestamp",
117+
"organization.id",
118+
"o365.audit.UserId",
119+
"o365.audit.ActorIpAddress",
120+
"o365.audit.ApplicationId",
121+
"o365.audit.ExtendedProperties.RequestType",
122+
"o365.audit.Target.ID",
123+
"source.geo.country_name",
124+
]
125+
126+
[rule.threshold]
127+
field = ["o365.audit.UserId"]
128+
value = 1
129+
[[rule.threshold.cardinality]]
130+
field = "source.geo.country_name"
131+
value = 2
132+
133+

‎rules/integrations/o365/initial_access_microsoft_365_impossible_travel_portal_logins.toml‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

0 commit comments

Comments
 (0)