Adding and Updating O365 detections

[mvelazc0]

Details

What does this PR have in it? Screenshots are worth 1000 words 😄

New Analytic Stories

• Office 365 Account Compromise
• Office 365 Persistence Mechanisms

Removed Analytic Story

• O365 detections

New Detections

• O365 Service Principal New Client Credentials
• O365 Mailbox Read Access Granted to Application
• O365 Tenant Wide Admin Consent Granted
• O365 Application Registration Owner Added
• O365 Mailbox Inbox Folder Shared with All Users
• O365 Advanced Audit Disabled
• O365 High Number Of Failed Authentications for User
• O365 Multiple Users Failing To Authenticate From Ip
• O365 User Consent Blocked for Risky Application
• O365 User Consent Denied for OAuth Application
• O365 Mail Permissioned Application Consent Granted by User
• O365 ApplicationImpersonation Role Assigned
• O365 File Permissioned Application Consent Granted by User
• O365 Multiple Failed MFA Requests For User
• O365 High Privilege Role Granted
• O365 New MFA Method Registered
• O365 Multiple AppIDs and UserAgents Authentication Spike
• O365 Block User Consent For Risky Apps Disabled
• O365 Multi-Source Failed Authentications Spike

Updated Detections

• High Number of Login Failures from a single source
• O365 Add App Role Assignment Grant User
• O365 Added Service Principal
• O365 Bypass MFA via Trusted IP
• O365 Disable MFA
• O365 Excessive Authentication Failures Alert
• O365 Excessive SSO logon errors
• O365 New Federated Domain Added
• O365 PST export alert
• O365 Suspicious Admin Email Forwarding*
• O365 Suspicious Rights Delegation
• O365 Suspicious User Email Forwarding

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.

[patel-bhavin]

use CIM name for UserId in all the detections in the PR. CIM names are usually aliased by the TAs and are in lowercase format in splunk. If its not available, lets use the rename command.