Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding condition to filter noisy logic and updated description for Team Detection #11572

Merged
merged 2 commits into from
Dec 18, 2024
Merged

Adding condition to filter noisy logic and updated description for Team Detection #11572

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
abc2e34
Adding condition to filter noisy logic and updated description
ashwin-patil Dec 17, 2024
d8d0798
Merge branch 'master' into ashwin/teamsaction-fixes-dec24
v-prasadboke Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Detections/MultipleDataSources/AnomalousIPUsageFollowedByTeamsAction.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@ name: Anomalous login followed by Teams action
description: |
'Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed.
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges)
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
severity: Medium
requiredDataConnectors:
Expand Down Expand Up @@ -67,6 +68,7 @@ query: |
OfficeActivity
| where TimeGenerated > ago(queryfrequency)
| where Operation in~ ("TeamsAdminAction", "MemberAdded", "MemberRemoved", "MemberRoleChanged", "AppInstalled", "BotAddedToTeam")
| where not (Operation in~ ("MemberAdded", "MemberRemoved") and CommunicationType in~ ("GroupChat", "OneonOne")) // These events have been noisy and are related to initiaing chat conversation and not admin operations.
| project OperationTimeGenerated = TimeGenerated, UserId = tolower(UserId), Operation
| join kind = inner(
userIpDelta
Expand Down Expand Up @@ -113,7 +115,7 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: SuspiciousIP
version: 1.1.1
version: 1.1.2
kind: Scheduled
metadata:
source:
Expand Down
Loading