Techniques
Sample rules
O365 Email Reported By Admin Found Malicious
- source: splunk
- technicques:
- T1566
- T1566.001
- T1566.002
Description
The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
Detection logic
`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission
| search RescanVerdict IN (Phish,Malware)
| stats values(Subject) as subject, values(RescanVerdict) as result, values(SenderIP) as src, values(P2Sender) as sender, values(P1Sender) as src_user, values(Recipients{}) as user, count min(_time) as firstTime, max(_time) as lastTime, by Id,Operation,UserId
| rename Name as signature, Id as signature_id, UserId as o365_adminuser
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_email_reported_by_admin_found_malicious_filter`