Detection : External User Added to Team and Immediately Uploads File

[Samik Roy (samikroy)]

Proposed Changes

This detection identifies an external user is added to a Team or Teams chat
and within 1 minute of being added upload a file via the chat.

[Jose Sebastián Canós (ep3p)]

You may want to specify the kind of join to not lose events of the left table.

[Samik Roy (samikroy)]

You may want to specify the kind of join to not lose events of the left table.

Thank you for the review Jose Sebastián Canós (@ep3p) .
Have added inner as a join kind to avoid default innerunique picking a random one.
Please let know further.

[Shain (shainw)]

Adding Pete Bryan (@petebryan) as he did the Hunting query that this is based on and he may have tested to see if this type of detection was too noisy for a detection - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/UserAddToTeamsAndUploadsFile.yaml.. Pete Bryan (@petebryan) - thoughts?

[Samik Roy (samikroy)]

Adding Pete Bryan (@petebryan) as he did the Hunting query that this is based on and he may have tested to see if this type of detection was too noisy for a detection - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/UserAddToTeamsAndUploadsFile.yaml.. Pete Bryan (@petebryan) - thoughts?

Pete Bryan (@petebryan) - please share your thoughts

[Pete Bryan (petebryan)]

Samik Roy (@samikroy) so when I first created this we didn't have an official Teams connector publicly available yet so we had limited data to determine FP rate. However in the data did show this was potentially quite noisy. It would be good to re-evaluate to see if that is still the case.

[Samik Roy (samikroy)]

Samik Roy (@samikroy) so when I first created this we didn't have an official Teams connector publicly available yet so we had limited data to determine FP rate. However in the data did show this was potentially quite noisy. It would be good to re-evaluate to see if that is still the case.

Agree Pete Bryan (@petebryan) , this detection now applies few more filters

External User Added > File Uploaded > File is accessed by many users > External user is removed.
Please have a look and let me know
Thank you.

[Shain (shainw)]

I did some testing and looks like looking only for #EXT# (external users) and checking for within 1m has very low results. Approving and we will watch if alerts start to flood for some customers.