From 7295f552bd49c31f6670a3906805250a2f186000 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:09:33 +0530 Subject: [PATCH 1/6] Create MultipleTeamsDeletes.yaml This detection flags the occurrences of deleting multiple teams within an hour. This data is a part of Office 365 Connector in Azure Sentinel. More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' --- .../OfficeActivity/MultipleTeamsDeletes.yaml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 Detections/OfficeActivity/MultipleTeamsDeletes.yaml diff --git a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml new file mode 100644 index 00000000000..0ff59cd0b11 --- /dev/null +++ b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml @@ -0,0 +1,24 @@ +id: 173f8699-6af5-484a-8b06-8c47ba89b380 +name: Multiple Teams deleted by a single user +description: | + 'This detection flags the occurrences of deleting multiple teams within an hour. + This data is a part of Office 365 Connector in Azure Sentinel. +More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' +tactics: + - Impact +relevantTechniques: + - T1485 + - T1489 +query: | + + // Adjust this value to change how many Teams should be deleted before including + let max_delete = 3; + // Adjust this value to change the timewindow the query runs over + let time_window = 1d; + OfficeActivity + | where OfficeWorkload == "MicrosoftTeams" + | where TimeGenerated > ago(time_window) + | where Operation =~ "MemberAdded" + | summarize make_set(ItemName) by UserId + | where set_ItemName > max_delete + | extend AccountCustomEntity = UserId From 07cda894018b360576b5361ca99a6683f43cff4b Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:41:51 +0530 Subject: [PATCH 2/6] Update MultipleTeamsDeletes.yaml --- Detections/OfficeActivity/MultipleTeamsDeletes.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml index 0ff59cd0b11..35be36ad2f9 100644 --- a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml +++ b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml @@ -2,8 +2,7 @@ id: 173f8699-6af5-484a-8b06-8c47ba89b380 name: Multiple Teams deleted by a single user description: | 'This detection flags the occurrences of deleting multiple teams within an hour. - This data is a part of Office 365 Connector in Azure Sentinel. -More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' + This data is a part of Office 365 Connector in Azure Sentinel.More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' tactics: - Impact relevantTechniques: From 4e13190b942f43d4fdac422a6d31950b88c82b17 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:57:07 +0530 Subject: [PATCH 3/6] Update MultipleTeamsDeletes.yaml --- Detections/OfficeActivity/MultipleTeamsDeletes.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml index 35be36ad2f9..581eec7ce31 100644 --- a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml +++ b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml @@ -2,7 +2,7 @@ id: 173f8699-6af5-484a-8b06-8c47ba89b380 name: Multiple Teams deleted by a single user description: | 'This detection flags the occurrences of deleting multiple teams within an hour. - This data is a part of Office 365 Connector in Azure Sentinel.More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' + This data is a part of Office 365 Connector in Azure Sentinel.' tactics: - Impact relevantTechniques: From 70f4306c0a4b9236471e5c6d792ed8e38f5cd2c6 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Thu, 17 Sep 2020 22:52:22 +0530 Subject: [PATCH 4/6] Update MultipleTeamsDeletes.yaml Updated as per review comments. --- Detections/OfficeActivity/MultipleTeamsDeletes.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml index 581eec7ce31..2f379a15886 100644 --- a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml +++ b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml @@ -3,6 +3,15 @@ name: Multiple Teams deleted by a single user description: | 'This detection flags the occurrences of deleting multiple teams within an hour. This data is a part of Office 365 Connector in Azure Sentinel.' +severity: Low +requiredDataConnectors: +- connectorId: Office365 +dataTypes: +- OfficeActivity (Teams) +queryFrequency: 1d +queryPeriod: 1d +triggerOperator: gt +triggerThreshold: 0 tactics: - Impact relevantTechniques: From 83cc167a4ccb0330b5a996a631a4388d49aeeeaf Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Thu, 17 Sep 2020 23:16:31 +0530 Subject: [PATCH 5/6] Update MultipleTeamsDeletes.yaml --- .../OfficeActivity/MultipleTeamsDeletes.yaml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml index 2f379a15886..8403374a87e 100644 --- a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml +++ b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml @@ -20,13 +20,11 @@ relevantTechniques: query: | // Adjust this value to change how many Teams should be deleted before including - let max_delete = 3; + let max_delete_count = 3; // Adjust this value to change the timewindow the query runs over - let time_window = 1d; - OfficeActivity + OfficeActivity | where OfficeWorkload == "MicrosoftTeams" - | where TimeGenerated > ago(time_window) - | where Operation =~ "MemberAdded" - | summarize make_set(ItemName) by UserId - | where set_ItemName > max_delete - | extend AccountCustomEntity = UserId + | where Operation =~ "TeamDeleted" + | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName) by UserId, Operation + | where array_length(DeletedTeams) > max_delete_count + | extend timestamp = StartTime, AccountCustomEntity = UserId From fb1b2a0e1d6f8322a7f013550906c09f5af761e5 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Thu, 17 Sep 2020 23:23:01 +0530 Subject: [PATCH 6/6] Update MultipleTeamsDeletes.yaml --- Detections/OfficeActivity/MultipleTeamsDeletes.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml index 8403374a87e..9ff59ddca13 100644 --- a/Detections/OfficeActivity/MultipleTeamsDeletes.yaml +++ b/Detections/OfficeActivity/MultipleTeamsDeletes.yaml @@ -23,8 +23,8 @@ query: | let max_delete_count = 3; // Adjust this value to change the timewindow the query runs over OfficeActivity - | where OfficeWorkload == "MicrosoftTeams" + | where OfficeWorkload =~ "MicrosoftTeams" | where Operation =~ "TeamDeleted" - | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName) by UserId, Operation + | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DeletedTeams = make_set(TeamName) by UserId | where array_length(DeletedTeams) > max_delete_count | extend timestamp = StartTime, AccountCustomEntity = UserId