Sample rules
O365 OAuth App Mailbox Access via EWS
- source: splunk
- technicques:
- T1114.002
Description
The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. It leverages the ClientInfoString field to identify EWS interactions and aggregates metrics such as access counts, timing, and client IP addresses, categorized by user, ClientAppId, OperationCount, and AppId. Monitoring OAuth applications accessing emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confirmed malicious, this activity could lead to unauthorized email access, data exfiltration, or further compromise of sensitive information.
Detection logic
`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=*
| regex ClientInfoString="^Client=WebServices;ExchangeWebServices"
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src_ip by user ClientAppId OperationCount AppId ClientInfoString
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_oauth_app_mailbox_access_via_ews_filter`
O365 OAuth App Mailbox Access via Graph API
- source: splunk
- technicques:
- T1114.002
Description
The following analytic detects when emails are accessed in Office 365 Exchange via the Microsoft Graph API using the client ID ‘00000003-0000-0000-c000-000000000000’. It leverages the ‘MailItemsAccessed’ operation within the Exchange workload, focusing on OAuth-authenticated applications. This activity is significant as unauthorized access to emails can lead to data breaches and information theft. If confirmed malicious, attackers could exfiltrate sensitive information, compromise user accounts, and further infiltrate the organization’s network.
Detection logic
`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* AppId=00000003-0000-0000-c000-000000000000
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) by user ClientAppId OperationCount AppId
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_oauth_app_mailbox_access_via_graph_api_filter`