Create ExternalUserAddedRemovedInTeams.yaml

Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml

@@ -0,0 +1,36 @@
+id: e9ceg568-6257-4dab-9a48-4793727y46a2
+name: External user added and removed in short timeframe
+description: |
+  'This detection flags the occurances of external user accounts that are added to a Team and then removed within
+  one hour.This data is a part of Office 365 Connector in Azure Sentinel.'
+tactics:
+  - Persistence
+relevantTechniques:
+  - T1136
+query: |
+
+  // If you want to look at user added further than 7 days ago adjust this value
+  let time_ago = 7d;
+  // If you want to change the timeframe of how quickly accounts need to be added and removed change this value
+  let time_delta = 1h;
+  OfficeActivity
+  | where OfficeWorkload == "MicrosoftTeams"
+  | where TimeGenerated > ago(time_ago)
+  | where OfficeWorkload == "MicrosoftTeams"
+  | where TimeGenerated > ago(time_ago)
+  | where Operation =~ "MemberAdded"
+  | extend UPN = tostring(parse_json(Members)[0].UPN)
+  | where UPN contains ("#EXT#")
+  | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName=ItemName
+  | join (
+   OfficeActivity
+  | where OfficeWorkload == "MicrosoftTeams"
+  | where TimeGenerated > ago(time_ago)
+  | where Operation =~ "MemberRemoved"
+  | extend UPN = tostring(parse_json(Members)[0].UPN)
+  | where UPN contains ("#EXT#")
+  | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName=ItemName
+  ) on UPN
+  | where TimeDeleted < (TimeAdded + time_delta)
+  | project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName
+  | extend timestamp = TimeAdded, AccountCustomEntity = UPN