LoFP / a non malicious user is unaware of the proper process

Techniques

• t1078
• t1078.004

Sample rules

Guest User Invited By Non Approved Inviters

• source: sigma
• technicques:
  • t1078
  • t1078.004

Description

Detects when a user that doesn’t have permissions to invite a guest user attempts to invite one.

Detection logic

condition: selection
selection:
  Status: failure
  properties.message: Invite external user