Splunk unknown stable spl

O365 Email Access By Security Administrator

The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.

View Source

Detection Logic

`o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
| rename InternetMessageId as signature_id, UserId as src_user
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       src vendor_account vendor_product
       src_user signature_id
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_email_access_by_security_administrator_filter`

False Positives

  • ⚠ Legitamate access by security administators for incident response measures.

Field Validations

Loading…

Comments (0)

Loading comments...