Sample rules
O365 New Federated Domain Added
- source: splunk
- technicques:
- T1136.003
- T1136
Description
The following analytic identifies the addition of a new federated domain in an organization’s Office 365 environment. This behavior is detected by analyzing the Office 365 management activity logs using the Splunk query o365_management_activity, specifically filtering for the Workload=Exchange and Operation=“Add-FederatedDomain” parameters. The addition of a new federated domain can be a significant security concern, as it might indicate unauthorized changes or potential compromises within the Office 365 setup. Attackers, upon gaining sufficient privileges, could add a federated domain to establish a backdoor, bypass security measures, or exfiltrate data. Such unauthorized changes can lead to data breaches, unauthorized access to sensitive data, and potential compromise of organizational infrastructure. When this analytic is triggered, immediate steps should include reviewing the details of the added federated domain, such as the organization name, originating server, user ID, and user key. Concurrent processes or other indicators of compromise should also be investigated to pinpoint the source of the potential breach.
Detection logic
`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*"
| stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent authentication_service action Workload Operation
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_new_federated_domain_added_filter`
New Federated Domain Added - Exchange
- source: sigma
- technicques:
- t1136
- t1136.003
Description
Detects the addition of a new Federated Domain.
Detection logic
condition: selection
selection:
eventName: Add-FederatedDomain
eventSource: Exchange
status: success
New Federated Domain Added
- source: sigma
- technicques:
- t1136
- t1136.003
Description
Detects the addition of a new Federated Domain.
Detection logic
condition: all of selection_*
selection_domain:
Operation|contains: domain
selection_operation:
Operation|contains:
- add
- new