Update o365_sharepoint_suspicious_search_behavior.yml

Author: nterl0k

detections/cloud/o365_sharepoint_suspicious_search_behavior.yml

@@ -10,7 +10,7 @@ data_source:
 - Office 365 Universal Audit Log
 search: '`o365_management_activity` Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search*
 | where NOT (match(SearchQueryText, "\*") OR match(SearchQueryText,"(\*)"))
-| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='EventData', command = SearchQueryText, -time = _time 
+| eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=EventData, command = SearchQueryText, -time = _time 
 | bin _time span=1hr
 | stats values(object_name) as object_name values(command) as command, values(src) as src, dc(command) as count, min(-time) as firstTime, max(-time) as lastTime by user,signature,_time
 | where count > 20 OR match(command, "(?i)password|credential|passwd|shadow|active directory|account|username|network|computer|access|MFA|bank|deposit|payroll|EFT|Electonic Funds|routing")