ID | Technique | Tactic |
---|---|---|
T1567 | Exfiltration Over Web Service | Exfiltration |
T1114 | Email Collection | Collection |
T1114.002 | Remote Email Collection | Collection |
Detection: O365 Email Access By Security Administrator
Description
The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
Search
1`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
2| stats values(Workload) as category, values(MailboxId) as user, values(Operation) as signature, count, min(_time) as firstTime, max(_time) as lastTime by InternetMessageId, UserId
3| rename InternetMessageId as signature_id, UserId as src_user
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| `o365_email_access_by_security_administrator_filter`
Data Source
No data sources specified for this detection.
Macros Used
Name | Value |
---|---|
o365_management_activity | sourcetype=o365:management:activity |
o365_email_access_by_security_administrator_filter | search * |
o365_email_access_by_security_administrator_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license.
Known False Positives
Legitamate access by security administators for incident response measures.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A security administrator $src_user$ accessed email messages for $user$ | 25 | 50 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | o365 |
o365:management:activity |
Integration | ✅ Passing | Dataset | o365 |
o365:management:activity |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2