Anvilogic critical experimental spl

O365 Anonymous Link Created or Updated [splunk-o365]

This use case detects when an anonymous sharing link is created or updated for files and folders in SharePoint Online or OneDrive for Business. These links allow external users to access shared content without authentication, meaning anyone with the link can access the resource, making it a potential security risk if not managed carefully. A threat actor could abuse the AnonymousLinkCreated and AnonymousLinkUpdated functionality to gain access to sensitive data, bypass authentication mechanisms, and exfiltrate information.

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_o365` "AnonymousLinkUpdated" 
OR "AnonymousLinkCreated"
| table _time, host, user,account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...