Skip to content

O365 BEC Email Hiding Rule Created (again) #3618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jul 28, 2025
Merged

O365 BEC Email Hiding Rule Created (again) #3618

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
43fa38e
Add threshold filter
0xC0FFEEEE Jul 23, 2025
afefa15
use correct drilldown field
0xC0FFEEEE Jul 23, 2025
1032077
Add rule name to risk message
0xC0FFEEEE Jul 23, 2025
3ccf82c
update risk message
0xC0FFEEEE Jul 24, 2025
59c0aef
Merge branch 'develop' into bec_rule_threshold
patel-bhavin Jul 24, 2025
e9735eb
Merge branch 'develop' into bec_rule_threshold
patel-bhavin Jul 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions detections/cloud/o365_bec_email_hiding_rule_created.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: O365 BEC Email Hiding Rule Created
id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
version: 3
date: '2025-07-01'
version: 4
date: '2025-07-23'
author: '0xC0FFEEEE, Github Community'
type: TTP
status: production
Expand All @@ -18,6 +18,7 @@ search: |-
| eval read_score=if(MarkAsRead="True", 1, 0)
| eval folder_score=if(match(MoveToFolder, "^(RSS|Conversation History|Archive)"), 1, 0)
| eval suspicious_score=entropy_score+len_score+read_score+folder_score
| where suspicious_score>2
| `o365_bec_email_hiding_rule_created_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
Office 365 management activity events. You also need to have the Splunk TA URL
Expand All @@ -28,15 +29,15 @@ references:
- https://attack.mitre.org/techniques/T1564/008/
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search dest = "$user$"'
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for $user$
search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Potential BEC mailbox rule was created by $user$
message: Potential BEC mailbox rule - $Name$ was created by user - $user$
risk_objects:
- field: user
type: user
Expand Down
Loading