Microsoft 365 Exchange Safe Link Policy Disabled

 1[metadata]
 2creation_date = "2020/11/18"
 3integration = ["o365"]
 4maturity = "production"
 5min_stack_comments = "Breaking change at 8.8.0 for Microsoft 365 Integration."
 6min_stack_version = "8.8.0"
 7updated_date = "2024/04/02"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend
13phishing protection to documents that contain hyperlinks, even after they have been delivered to a user.
14"""
15false_positives = [
16    """
17    Disabling safe links may be done by a system or network administrator. Verify that the configuration change was
18    expected. Exceptions can be added to this rule to filter expected behavior.
19    """,
20]
21from = "now-30m"
22index = ["filebeat-*", "logs-o365*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Microsoft 365 Exchange Safe Link Policy Disabled"
26note = """## Setup
27
28The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = [
30    "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-safelinksrule?view=exchange-ps",
31    "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-safe-links?view=o365-worldwide",
32]
33risk_score = 47
34rule_id = "a989fa1b-9a11-4dd8-a3e9-f0de9c6eb5f2"
35severity = "medium"
36tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Identity and Access Audit", "Tactic: Initial Access"]
37timestamp_override = "event.ingested"
38type = "query"
39
40query = '''
41event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Disable-SafeLinksRule" and event.outcome:success
42'''
43
44
45[[rule.threat]]
46framework = "MITRE ATT&CK"
47[[rule.threat.technique]]
48id = "T1566"
49name = "Phishing"
50reference = "https://attack.mitre.org/techniques/T1566/"
51
52
53[rule.threat.tactic]
54id = "TA0001"
55name = "Initial Access"
56reference = "https://attack.mitre.org/tactics/TA0001/"

References

• Disable-SafeLinksRule (ExchangePowerShell)

  

  Safe Links is a feature in Microsoft Defender for Office 365 that checks links in email messages to see if they lead to malicious web sites. When a user clicks a link in a message, the URL is temporarily rewritten and checked against a list of known, malicious web sites. Safe Links includes the URL trace reporting feature to help determine who has clicked through to a malicious web site. You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.

  
  Read More

• Complete Safe Links overview for Microsoft Defender for Office 365 - Microsoft Defender for Office 365

  

  Learn about Safe Links protection in Defender for Office 365 to protect an organization from phishing and other attacks that use malicious URLs. Discover Teams Safe Links, and see graphics of Safe Links messages.

  
  Read More

Related rules

• Attempts to Brute Force a Microsoft 365 User Account
• Microsoft 365 Exchange Anti-Phish Policy Deletion
• Microsoft 365 Exchange Anti-Phish Rule Modification
• Microsoft 365 Exchange Management Group Role Assignment
• Microsoft 365 Global Administrator Role Assigned