Microsoft 365 Teams Guest Access Enabled

Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/11/20"
 3integration = ["o365"]
 4maturity = "production"
 5updated_date = "2025/01/15"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization
11to access teams and channels. An adversary may enable guest access to maintain persistence in an environment.
12"""
13false_positives = [
14    """
15    Teams guest access may be enabled by a system or network administrator. Verify that the configuration change was
16    expected. Exceptions can be added to this rule to filter expected behavior.
17    """,
18]
19from = "now-30m"
20index = ["filebeat-*", "logs-o365*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "Microsoft 365 Teams Guest Access Enabled"
24note = """## Triage and analysis
25
26> **Disclaimer**:
27> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
28
29### Investigating Microsoft 365 Teams Guest Access Enabled
30
31Microsoft Teams allows organizations to collaborate with external users through guest access, facilitating communication and teamwork. However, adversaries can exploit this feature to gain persistent access to sensitive environments by enabling guest access without authorization. The detection rule monitors audit logs for specific configurations that indicate guest access has been enabled, helping identify unauthorized changes and potential security breaches.
32
33### Possible investigation steps
34
35- Review the audit logs to confirm the event.action "Set-CsTeamsClientConfiguration" was successfully executed with the parameter o365.audit.Parameters.AllowGuestUser set to True.
36- Identify the user account responsible for enabling guest access by examining the event logs for the user ID or account name associated with the action.
37- Check the user's activity history to determine if there are any other suspicious actions or patterns, such as changes to other configurations or unusual login times.
38- Investigate the context of the change by reviewing any related communications or requests that might justify enabling guest access, ensuring it aligns with organizational policies.
39- Assess the potential impact by identifying which teams and channels now have guest access enabled and evaluate the sensitivity of the information accessible to external users.
40- Contact the user or their manager to verify if the change was authorized and necessary, and document their response for future reference.
41
42### False positive analysis
43
44- Legitimate collaboration with external partners may trigger alerts when guest access is enabled for business purposes. To manage this, create exceptions for known and approved external domains or specific projects that require guest access.
45- Routine administrative actions by IT staff to enable guest access for specific teams or channels can be mistaken for unauthorized changes. Implement a process to log and approve such changes internally, and exclude these from triggering alerts.
46- Automated scripts or third-party applications that configure Teams settings, including guest access, might cause false positives. Identify and whitelist these scripts or applications to prevent unnecessary alerts.
47- Changes made during scheduled maintenance windows can be misinterpreted as unauthorized. Define and exclude these time periods from monitoring to reduce false positives.
48
49### Response and remediation
50
51- Immediately disable guest access in Microsoft Teams by updating the Teams client configuration to prevent unauthorized external access.
52- Conduct a thorough review of recent audit logs to identify any unauthorized changes or suspicious activities related to guest access settings.
53- Notify the security team and relevant stakeholders about the potential breach to ensure awareness and initiate further investigation.
54- Revoke any unauthorized guest accounts that have been added to Teams to eliminate potential persistence mechanisms.
55- Implement additional monitoring on Teams configurations to detect any future unauthorized changes to guest access settings.
56- Escalate the incident to the organization's incident response team for a comprehensive investigation and to determine if further containment actions are necessary.
57- Review and update access control policies to ensure that enabling guest access requires appropriate authorization and oversight.
58
59## Setup
60
61The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
62references = [
63    "https://docs.microsoft.com/en-us/powershell/module/skype/get-csteamsclientconfiguration?view=skype-ps",
64]
65risk_score = 47
66rule_id = "5e552599-ddec-4e14-bad1-28aa42404388"
67severity = "medium"
68tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Persistence", "Resources: Investigation Guide"]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73event.dataset:o365.audit and event.provider:(SkypeForBusiness or MicrosoftTeams) and
74event.category:web and event.action:"Set-CsTeamsClientConfiguration" and
75o365.audit.Parameters.AllowGuestUser:True and event.outcome:success
76'''
77
78
79[[rule.threat]]
80framework = "MITRE ATT&CK"
81[[rule.threat.technique]]
82id = "T1098"
83name = "Account Manipulation"
84reference = "https://attack.mitre.org/techniques/T1098/"
85
86
87[rule.threat.tactic]
88id = "TA0003"
89name = "Persistence"
90reference = "https://attack.mitre.org/tactics/TA0003/"

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Microsoft 365 Teams Guest Access Enabled

Microsoft Teams allows organizations to collaborate with external users through guest access, facilitating communication and teamwork. However, adversaries can exploit this feature to gain persistent access to sensitive environments by enabling guest access without authorization. The detection rule monitors audit logs for specific configurations that indicate guest access has been enabled, helping identify unauthorized changes and potential security breaches.

Possible investigation steps

  • Review the audit logs to confirm the event.action "Set-CsTeamsClientConfiguration" was successfully executed with the parameter o365.audit.Parameters.AllowGuestUser set to True.
  • Identify the user account responsible for enabling guest access by examining the event logs for the user ID or account name associated with the action.
  • Check the user's activity history to determine if there are any other suspicious actions or patterns, such as changes to other configurations or unusual login times.
  • Investigate the context of the change by reviewing any related communications or requests that might justify enabling guest access, ensuring it aligns with organizational policies.
  • Assess the potential impact by identifying which teams and channels now have guest access enabled and evaluate the sensitivity of the information accessible to external users.
  • Contact the user or their manager to verify if the change was authorized and necessary, and document their response for future reference.

False positive analysis

  • Legitimate collaboration with external partners may trigger alerts when guest access is enabled for business purposes. To manage this, create exceptions for known and approved external domains or specific projects that require guest access.
  • Routine administrative actions by IT staff to enable guest access for specific teams or channels can be mistaken for unauthorized changes. Implement a process to log and approve such changes internally, and exclude these from triggering alerts.
  • Automated scripts or third-party applications that configure Teams settings, including guest access, might cause false positives. Identify and whitelist these scripts or applications to prevent unnecessary alerts.
  • Changes made during scheduled maintenance windows can be misinterpreted as unauthorized. Define and exclude these time periods from monitoring to reduce false positives.

Response and remediation

  • Immediately disable guest access in Microsoft Teams by updating the Teams client configuration to prevent unauthorized external access.
  • Conduct a thorough review of recent audit logs to identify any unauthorized changes or suspicious activities related to guest access settings.
  • Notify the security team and relevant stakeholders about the potential breach to ensure awareness and initiate further investigation.
  • Revoke any unauthorized guest accounts that have been added to Teams to eliminate potential persistence mechanisms.
  • Implement additional monitoring on Teams configurations to detect any future unauthorized changes to guest access settings.
  • Escalate the incident to the organization's incident response team for a comprehensive investigation and to determine if further containment actions are necessary.
  • Review and update access control policies to ensure that enabling guest access requires appropriate authorization and oversight.

Setup

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top