LoFP / administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. filter as needed.

Techniques

• T1562
• T1562.001
• T1562.008

Sample rules

O365 Email Security Feature Changed

• source: splunk
• technicques:
  • T1562
  • T1562.008
  • T1562.001

Description

The following analytic identifies when specific O365 advanced security settings are altered within the Office 365 tenant. If an attacker successfully disables O365 security settings, they can operate within the tenant with reduced risk of detection. This can lead to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail.

Detection logic

`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*") 
| stats values(ObjectId) as object, min(_time) as firstTime, max(_time) as lastTime, count  by Id, UserId, Operation 
| rename Id as object_id, UserId as user, Operation as signature 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_email_security_feature_changed_filter`