Try in Splunk Security Cloud

Description

This analytic identifies instances where a user in the Office 365 environment grants consent to an application that requests file permissions, specifically targeting OneDrive or SharePoint. Such permissions mean the application could potentially access, modify, or delete files stored within these services. The detection process leverages O365 audit logs, particularly focusing on events related to OAuth application consents. By examining these logs, the analytic is designed to capture and alert on any actions where users grant consent to applications requesting file-related permissions for OneDrive or SharePoint. The sensitivity of file permissions, especially in platforms as widely utilized as OneDrive and SharePoint, cannot be overstated. While many legitimate applications might require such permissions to operate, there's an inherent risk with malicious or overly permissive applications. Attackers could craft or exploit applications to gain file permissions, aiming to access, exfiltrate, or manipulate sensitive data housed in OneDrive or SharePoint. It's crucial for security operations centers to monitor these consents to ensure that only trustworthy applications gain access and that users aren't inadvertently granting permissions to potentially harmful applications. If this detection flags a true positive, it indicates that an application has been granted permissions that could allow it to interact with OneDrive or SharePoint files in potentially malicious ways. Such actions could lead to data breaches, data loss, or unauthorized data manipulation. Immediate investigation would be required to validate the application's legitimacy, understand the nature of its requested permissions, and assess the potential risks associated with the access it's been granted.

  • Type: TTP

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2023-10-18
  • Author: Mauricio Velazco, Splunk
  • ID: 6c382336-22b8-4023-9b80-1689e799f21f

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1528 Steal Application Access Token Credential Access
Kill Chain Phase
  • Exploitation
NIST
  • DE.CM
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8
9
10



`o365_management_activity` Workload=AzureActiveDirectory Operation="Consent to application." ResultStatus=Success 
| eval admin_consent =mvindex('ModifiedProperties{}.NewValue', 0) 
| search admin_consent=False 
| eval permissions =mvindex('ModifiedProperties{}.NewValue', 4) 
| rex field=permissions "Scope: (?<Scope>[^,]+)" 
| makemv delim=" " Scope 
| search Scope IN ("Files.Read", "Files.Read.All", "Files.ReadWrite", "Files.ReadWrite.All", "Files.ReadWrite.AppFolder") 
| stats max(_time) as lastTime values(Scope) by Operation, user, object, ObjectId 
| `security_content_ctime(lastTime)` 
| `o365_file_permissioned_application_consent_granted_by_user_filter`

Macros

The SPL above uses the following Macros:

:information_source: o365_file_permissioned_application_consent_granted_by_user_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • Workload
  • Operation
  • ResultStatus
  • ModifiedProperties{}.NewValue
  • object
  • ObjectId

How To Implement

You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.

Known False Positives

OAuth applications that require file permissions may be legitimate, investigate and filter as needed.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
40.0 80 50 User $user$ consented an OAuth application that requests file-related permissions.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1