|
| 1 | +name: O365 Email Transport Rule Changed |
| 2 | +id: 11ebb7c2-46bd-41c9-81e1-d0b4b34583a2 |
| 3 | +version: 1 |
| 4 | +date: '2025-01-15' |
| 5 | +author: Steven Dick |
| 6 | +status: production |
| 7 | +type: Anomaly |
| 8 | +description: The following analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions, this activity could indicate an attacker hiding or exfiltrated data. |
| 9 | +data_source: |
| 10 | +- Office 365 Universal Audit Log |
| 11 | +search: |- |
| 12 | + `o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*TransportRule" |
| 13 | + | eval object_name = case('Parameters{}.Name'=="Name",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Name$")),true(),ObjectId), object_id = case('Parameters{}.Name'=="Identity",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Identity$")),true(),Id) |
| 14 | + | stats values(object_name) as object_name, min(_time) as firstTime, max(_time) as lastTime, count by object_id, UserId, Operation |
| 15 | + | rename UserId as user, Operation as signature |
| 16 | + | `security_content_ctime(firstTime)` |
| 17 | + | `security_content_ctime(lastTime)` |
| 18 | + | `o365_email_transport_rule_changed_filter` |
| 19 | +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. |
| 20 | +known_false_positives: Legitimate administrative changes for business needs. |
| 21 | +references: |
| 22 | +- https://attack.mitre.org/techniques/T1114/003/ |
| 23 | +- https://cardinalops.com/blog/cardinalops-contributes-new-mitre-attck-techniques-related-to-abuse-of-mail-transport-rules/ |
| 24 | +- https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-OAuth-applications-used-to-compromise-email-servers-and-spread-spam/ |
| 25 | +drilldown_searches: |
| 26 | +- name: View the detection results for - "$user$" |
| 27 | + search: '%original_detection_search% | search user = "$user$"' |
| 28 | + earliest_offset: $info_min_time$ |
| 29 | + latest_offset: $info_max_time$ |
| 30 | +- name: View risk events for the last 7 days for - "$user$" |
| 31 | + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' |
| 32 | + earliest_offset: $info_min_time$ |
| 33 | + latest_offset: $info_max_time$ |
| 34 | +- name: Investigate changes by $user$ |
| 35 | + search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*Transport*" UserId=$user$' |
| 36 | + earliest_offset: $info_min_time$ |
| 37 | + latest_offset: $info_max_time$ |
| 38 | +rba: |
| 39 | + message: The user [$user$] altered the exchange transport rule id [$object_name$] |
| 40 | + risk_objects: |
| 41 | + - field: user |
| 42 | + type: user |
| 43 | + score: 25 |
| 44 | + threat_objects: |
| 45 | + - field: object_id |
| 46 | + type: signature |
| 47 | + - field: object_name |
| 48 | + type: signature |
| 49 | +tags: |
| 50 | + analytic_story: |
| 51 | + - Data Exfiltration |
| 52 | + - Office 365 Account Takeover |
| 53 | + asset_type: O365 Tenant |
| 54 | + mitre_attack_id: |
| 55 | + - T1114.003 |
| 56 | + - T1564.008 |
| 57 | + product: |
| 58 | + - Splunk Enterprise |
| 59 | + - Splunk Enterprise Security |
| 60 | + - Splunk Cloud |
| 61 | + security_domain: threat |
| 62 | +tests: |
| 63 | +- name: True Positive Test |
| 64 | + attack_data: |
| 65 | + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/transport_rule_change/transport_rule_change.log |
| 66 | + source: o365 |
| 67 | + sourcetype: o365:management:activity |
0 commit comments