Techniques
Sample rules
O365 Email Reported By Admin Found Malicious
- source: splunk
- technicques:
- T1566.001
- T1566.002
Description
The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
Detection logic
`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission
| search RescanVerdict IN (Phish,Malware)
| rename Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
BY dest user src
vendor_account vendor_product signature
signature_id dest_user src_user
Subject SubmissionContent
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_email_reported_by_admin_found_malicious_filter`