Microsoft 365 Exchange Safe Link Policy Disabled

calendar May 22, 2024 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Initial Access  ·
Share on: linkedin copy

Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/11/18"
 3integration = ["o365"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend
11phishing protection to documents that contain hyperlinks, even after they have been delivered to a user.
12"""
13false_positives = [
14    """
15    Disabling safe links may be done by a system or network administrator. Verify that the configuration change was
16    expected. Exceptions can be added to this rule to filter expected behavior.
17    """,
18]
19from = "now-30m"
20index = ["filebeat-*", "logs-o365*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "Microsoft 365 Exchange Safe Link Policy Disabled"
24note = """## Setup
25
26The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
27references = [
28    "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safelinksrule?view=exchange-ps",
29    "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-safe-links?view=o365-worldwide",
30]
31risk_score = 47
32rule_id = "a989fa1b-9a11-4dd8-a3e9-f0de9c6eb5f2"
33severity = "medium"
34tags = [
35    "Domain: Cloud",
36    "Data Source: Microsoft 365",
37    "Use Case: Identity and Access Audit",
38    "Tactic: Initial Access",
39]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Disable-SafeLinksRule" and event.outcome:success
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1566"
52name = "Phishing"
53reference = "https://attack.mitre.org/techniques/T1566/"
54
55
56[rule.threat.tactic]
57id = "TA0001"
58name = "Initial Access"
59reference = "https://attack.mitre.org/tactics/TA0001/"

Setup

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

  • Disable-SafeLinksRule (ExchangePowerShell)

    Safe Links is a feature in Microsoft Defender for Office 365 that checks links in email messages to see if they lead to malicious web sites. When a user clicks a link in a message, the URL is temporarily rewritten and checked against a list of known, malicious web sites. Safe Links includes the URL trace reporting feature to help determine who has clicked through to a malicious web site. You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.


    Read More

  • Complete Safe Links overview for Microsoft Defender for Office 365 - Microsoft Defender for Office 365

    Learn about Safe Links protection in Defender for Office 365 to protect an organization from phishing and other attacks that use malicious URLs. Discover Teams Safe Links, and see graphics of Safe Links messages.


    Read More

Related rules

to-top