Create microsoft365_unusual_volume_of_file_deletion.yml

2021-08-19 23:00:23 -05:00
parent 9a83836070
commit 99fbd4ef44
1 changed files with 24 additions and 0 deletions
@@ -0,0 +1,24 @@
+title: Microsoft 365 - Unusual Volume of File Deletion
+id: 78a34b67-3c39-4886-8fb4-61c46dc18ecd
+status: experimental
+description: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
+author: austinsonger
+date: 2021/08/19
+references:
+    - https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
+    - https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
+logsource:
+    category: ThreatManagement
+    service: Office365
+detection:
+    selection:
+        eventSource: SecurityComplianceCenter
+        eventName: "Unusual volume of file deletion"
+        status: success
+    condition: selection
+falsepositives:
+    - 
+level: medium
+tags:
+    - attack.impact
+    - attack.t1485