ID | Technique | Tactic |
---|---|---|
T1185 | Browser Session Hijacking | Collection |
Detection: O365 Concurrent Sessions From Different Ips
Description
The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
Search
1`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn
2| stats min(_time) as firstTime max(_time) as lastTime values(src_ip) as ips values(user_agent) as user_agents by Operation, user, SessionId
3| where mvcount(ips) > 1
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| `o365_concurrent_sessions_from_different_ips_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
O365 UserLoggedIn | N/A | 'o365:management:activity' |
'o365' |
N/A |
Macros Used
Name | Value |
---|---|
o365_management_activity | sourcetype=o365:management:activity |
o365_concurrent_sessions_from_different_ips_filter | search * |
o365_concurrent_sessions_from_different_ips_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
Known False Positives
Unknown
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user$ has logged in with the same session id from more than one unique IP address | 42 | 70 | 60 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | o365 |
o365:management:activity |
Integration | ✅ Passing | Dataset | o365 |
o365:management:activity |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3