From 3303a4e255e680244fa547119034d9c14a0f1b16 Mon Sep 17 00:00:00 2001 From: Austin Songer Date: Fri, 15 Oct 2021 14:01:50 -0500 Subject: [PATCH] [New Rule] Microsoft 365 - Mass download by a single user (#1348) * Create impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml Co-authored-by: Jonhnathan * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update impact_microsoft_365_mass_download_by_a_single_user.toml * Update rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml Co-authored-by: Jonhnathan Co-authored-by: Jonhnathan --- ...ft_365_mass_download_by_a_single_user.toml | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml diff --git a/rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml b/rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml new file mode 100644 index 000000000..212fe095a --- /dev/null +++ b/rules/integrations/o365/impact_microsoft_365_mass_download_by_a_single_user.toml @@ -0,0 +1,43 @@ +[metadata] +creation_date = "2021/07/15" +maturity = "development" +updated_date = "2021/10/13" +integration = "o365" + +[rule] +author = ["Austin Songer"] +description = """ +Identifies when Microsoft Cloud App Security reported when a single user performs more than 50 downloads within 1 minute. +""" +false_positives = ["Unknown"] +from = "now-30m" +index = ["filebeat-*", "logs-o365*"] +language = "kuery" +license = "Elastic License v2" +name = "Microsoft 365 Mass download by a single user" +note = """## Config + +The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. +""" +references = [ + "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", +] +risk_score = 47 +rule_id = "571ff456-aa7f-4e48-8a88-39698bb5418f" +severity = "medium" +tags = ["Elastic", "Cloud", "Microsoft 365", "Continuous Monitoring", "SecOps", "Configuration Audit"] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Mass download by a single user" and event.outcome:success +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" +id = "TA0010"