Techniques
Sample rules
O365 Mail Permissioned Application Consent Granted by User
- source: splunk
- technicques:
- T1528
Description
The following analytic identifies instances where a user grants consent to an application requesting mail-related permissions within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to application permissions and user consent actions. This activity is significant as it can indicate potential security risks, such as data exfiltration or spear phishing, if malicious applications gain access. If confirmed malicious, this could lead to unauthorized data access, email forwarding, or sending malicious emails from the compromised account. Validating the legitimacy of the application and consent context is crucial to prevent data breaches.
Detection logic
`o365_management_activity` Workload=AzureActiveDirectory Operation="Consent to application." ResultStatus=Success
| eval admin_consent =mvindex('ModifiedProperties{}.NewValue', 0)
| search admin_consent=False
| eval permissions =mvindex('ModifiedProperties{}.NewValue', 4)
| rex field=permissions "Scope: (?<Scope>[^,]+)"
| makemv delim=" " Scope
| search Scope IN ("Mail.Read", "Mail.ReadBasic", "Mail.ReadWrite", "Mail.Read.Shared", "Mail.ReadWrite.Shared", "Mail.Send", "Mail.Send.Shared")
| stats max(_time) as lastTime values(Scope) by Operation, user, object, ObjectId
| `security_content_ctime(lastTime)`
| `o365_mail_permissioned_application_consent_granted_by_user_filter`
O365 User Consent Denied for OAuth Application
- source: splunk
- technicques:
- T1528
Description
The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Office 365 environment. This detection leverages O365 audit logs, focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, it captures instances where users have actively rejected permission requests. This activity is significant as it may indicate users spotting potentially suspicious or unfamiliar applications. If confirmed malicious, it suggests an attempt by a potentially harmful application to gain unauthorized access, which was proactively blocked by the user.
Detection logic
`o365_graph` status.errorCode=65004
| rename userPrincipalName as user
| rename ipAddress as src_ip
| stats max(_time) as lastTime by user src_ip appDisplayName status.failureReason
| `security_content_ctime(lastTime)`
| `o365_user_consent_denied_for_oauth_application_filter`