Techniques
Sample rules
O365 New Forwarding Mailflow Rule Created
- source: splunk
- technicques:
- T1114
Description
The following analytic monitors for the creation of new mail flow rules in Office 365 that could potentially redirect or copy emails to unauthorized or external addresses. This analytic works by querying the Office 365 Management Activity logs for any operation tagged as “New-TransportRule”. It specifically looks for parameters indicative of mail forwarding actions, such as “BlindCopyTo”, “CopyTo”, and “RedirectMessageTo”. If any of these parameters are present, indicating that a forwarding rule has been set up, the detection then captures the details of this rule, including the user ID responsible for the creation, the name of the rule, the forwarding target, and the timestamps of the rule’s creation and last modification.
Detection logic
`o365_management_activity` Workload=Exchange Operation="New-TransportRule"
| eval match1=mvfind('Parameters{}.Name', "BlindCopyTo")
| eval match2=mvfind('Parameters{}.Name', "CopyTo")
| eval match3=mvfind('Parameters{}.Name', "RedirectMessageTo")
| where match1>= 0 OR match2>= 0 OR match3>=0
| eval ForwardTo=coalesce(BlindCopyTo, CopyTo, RedirectMessageTo)
| search ForwardTo!=""
| rename UserId as user
| stats count earliest(_time) as firstTime latest(_time) as lastTime by Operation, user, Name, ForwardTo
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_new_forwarding_mailflow_rule_created_filter`