m365 | Detection.FYI

Disabling Multi Factor Authentication

Sep 18, 2023 · attack.persistence attack.t1556 ·

Share on:

Detects disabling of Multi Factor Authentication.

New Federated Domain Added

Sep 18, 2023 · attack.persistence attack.t1136.003 ·

Share on:

Detects the addition of a new Federated Domain.

New Federated Domain Added - Exchange

Sep 18, 2023 · attack.persistence attack.t1136.003 ·

Share on:

Detects the addition of a new Federated Domain.

PST Export Alert Using eDiscovery Alert

Nov 18, 2022 · attack.collection attack.t1114 ·

Share on:

Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content

PST Export Alert Using New-ComplianceSearchAction

Nov 18, 2022 · attack.collection attack.t1114 ·

Share on:

Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.

Activity from Suspicious IP Addresses

Oct 25, 2022 · attack.command_and_control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.

Activity Performed by Terminated User

Oct 25, 2022 · attack.impact ·

Share on:

Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.

Microsoft 365 - Impossible Travel Activity

Oct 25, 2022 · attack.initial_access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Activity from Anonymous IP Addresses

Oct 9, 2022 · attack.command_and_control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Activity from Infrequent Country

Oct 9, 2022 · attack.command_and_control attack.t1573 ·

Share on:

Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.

Data Exfiltration to Unsanctioned Apps

Oct 9, 2022 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Logon from a Risky IP Address

Oct 9, 2022 · attack.initial_access attack.t1078 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Microsoft 365 - Potential Ransomware Activity

Oct 9, 2022 · attack.impact attack.t1486 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Microsoft 365 - Unusual Volume of File Deletion

Oct 9, 2022 · attack.impact attack.t1485 ·

Share on:

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Microsoft 365 - User Restricted from Sending Email

Oct 9, 2022 · attack.initial_access attack.t1199 ·

Share on:

Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

Suspicious Inbox Forwarding

Oct 9, 2022 · attack.exfiltration attack.t1020 ·

Share on:

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

Suspicious OAuth App File Download Activities

Oct 9, 2022 · attack.exfiltration ·

Share on:

Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.