[metadata]
creation_date = "2020/11/30"
maturity = "production"
updated_date = "2020/12/15"

[rule]
author = ["Elastic"]
description = """
Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than
those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may
abuse this behavior to establish persistence in an environment.
"""
false_positives = [
    """
    Custom applications may be allowed by a system or network administrator. Verify that the configuration change was
    expected. Exceptions can be added to this rule to filter expected behavior.
    """,
]
from = "now-30m"
index = ["filebeat-*", "logs-o365*"]
language = "kuery"
license = "Elastic License"
name = "Microsoft 365 Teams Custom Application Interaction Allowed"
note = "The Microsoft 365 Fleet integration or Filebeat module must be enabled to use this rule."
references = ["https://docs.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/apps-upload"]
risk_score = 47
rule_id = "bbd1a775-8267-41fa-9232-20e5582596ac"
severity = "medium"
tags = ["Elastic", "Cloud", "Microsoft 365", "Continuous Monitoring", "SecOps", "Configuration Audit"]
type = "query"

query = '''
event.dataset:o365.audit and event.provider:MicrosoftTeams and
event.category:web and event.action:TeamsTenantSettingChanged and
o365.audit.Name:"Allow sideloading and interaction of custom apps" and
o365.audit.NewValue:True and event.outcome:success
'''

