Update

2021-08-23 22:19:41 +00:00
parent 754158bfd2
commit 53482b7e9c
7 changed files with 5 additions and 30 deletions
@@ -20,4 +20,4 @@ falsepositives:
    - Unknown
 level: medium
 tags:
-    - attack.impact
+    - attack.impact
@@ -21,4 +21,4 @@ falsepositives:
 level: medium
 tags:
    - attack.command_and_control
-    - attack.t1573
+    - attack.t1573
@@ -21,4 +21,4 @@ falsepositives:
 level: medium
 tags:
    - attack.command_and_control
-    - attack.t1573
+    - attack.t1573
@@ -1,24 +0,0 @@
-title: Microsoft 365 - Activity from anonymous IP addresses
-id: d8b0a4fe-07a8-41be-bd39-b14afa025d95
-status: experimental
-description: Detects when a Microsoft Cloud App Security reported 
-author: Austin Songer @austinsonger
-date: 2021/08/23
-references:
-    - https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
-    - https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
-logsource:
-    category: 
-    service: m365
-detection:
-    selection:
-        eventSource: SecurityComplianceCenter
-        eventName: "Activity from anonymous IP addresses"
-        status: success
-    condition: selection
-falsepositives:
-    - 
-level: medium
-tags:
-    - attack.initial_access
-    - 
@@ -21,4 +21,4 @@ falsepositives:
 level: medium
 tags:
    - attack.command_and_control
-    - attack.t1573
+    - attack.t1573
@@ -21,4 +21,4 @@ falsepositives:
 level: low
 tags:
    - attack.exfiltration
-    - attack.t1020
+    - attack.t1020
@@ -21,4 +21,3 @@ falsepositives:
 level: medium
 tags:
    - attack.exfiltration
-