Compare commits
30 Commits
| Author | SHA1 | Date |
|---|---|---|
 lancymorry
|
f238aeaf05 | 7 months ago |
 郭吉民
|
32e37585cd | 7 months ago |
 DengYanjia
|
4cbd982f74 | 7 months ago |
 lly
|
71f46cb052 | 7 months ago |
|
lly
|
1f9b203953 | 7 months ago |
|
lly
|
3356a0b7bc | 7 months ago |
|
DengYanjia
|
2b5e393a58 | 7 months ago |
 林协鸿
|
4629e94830 | 7 months ago |
|
郭吉民
|
7e5af04ca5 | 7 months ago |
 黎星辰
|
09007270c3 | 7 months ago |
|
lancymorry
|
aadd24d025 | 7 months ago |
|
pex7hfbnt
|
58eb17b849 | 7 months ago |
|
pex7hfbnt
|
340a7f96e3 | 7 months ago |
|
郭吉民
|
fc00532c2d | 7 months ago |
|
pex7hfbnt
|
e222c39967 | 7 months ago |
|
pex7hfbnt
|
bf5a070658 | 7 months ago |
|
pex7hfbnt
|
8bc3507637 | 7 months ago |
|
pex7hfbnt
|
e9cff0e553 | 7 months ago |
|
lly
|
7424167841 | 7 months ago |
|
unknown
|
3c0bcacb2d | 7 months ago |
|
DengYanjia
|
602d857b22 | 8 months ago |
|
郭吉民
|
541df41774 | 8 months ago |
|
pex7hfbnt
|
865d77c51c | 8 months ago |
|
unknown
|
3b9436beef | 8 months ago |
|
pex7hfbnt
|
61bf150a17 | 8 months ago |
|
郭吉民
|
d76bd3e7c2 | 8 months ago |
|
lly
|
c32c950dc4 | 8 months ago |
|
DengYanjia
|
51da9a2377 | 8 months ago |
|
pex7hfbnt
|
7e9da37e22 | 8 months ago |
|
lancymorry
|
061029d383 | 8 months ago |
@ -0,0 +1,16 @@
|
||||
{
|
||||
"workbench.colorCustomizations": {
|
||||
"sideBar.background": "#1f2329",
|
||||
"activityBar.background": "#2A2E37",
|
||||
"titleBar.activeBackground": "#2A2E37",
|
||||
"editor.background": "#181B20",
|
||||
"terminal.background": "#181B20",
|
||||
"panel.background": "#181B20",
|
||||
"dropdown.background": "#181B20",
|
||||
"dropdown.listBackground": "#181B20",
|
||||
"editorGroupHeader.tabsBackground": "#1F2229",
|
||||
"tab.inactiveBackground": "#23282E",
|
||||
"menu.background": "#2A2F37",
|
||||
"menu.selectionBackground": "#0E629D"
|
||||
}
|
||||
}
|
||||
Binary file not shown.
@ -1,99 +1,100 @@
|
||||
[
|
||||
{
|
||||
"name": "Suspicious User Agent",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE UserAgent LIKE '%python%' OR UserAgent LIKE '%ruler%' OR UserAgent LIKE '%curl%' OR UserAgent LIKE '%Wget%' OR UserAgent LIKE '%python-requests%' OR UserAgent LIKE '%AADInternals%' OR UserAgent LIKE '%azurehound%' OR UserAgent LIKE '%axios%' OR UserAgent LIKE '%BAV2ROPC%' "
|
||||
},
|
||||
{
|
||||
"name": "User adding or removing Inbox Rule",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%InboxRule%' OR Operation LIKE 'Set-Mailbox' OR Operation LIKE '%DeliverToMailboxAndForward%' OR Operation LIKE '%ForwardingAddress%' OR Operation LIKE '%ForwardingAddress%' "
|
||||
},
|
||||
{
|
||||
"name": "After Hours Activity",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE (CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END >= 20 OR CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END < 6) AND NOT (Operation LIKE 'File%' OR Operation LIKE 'List%' OR Operation LIKE 'Page%' OR Operation LIKE '%UserLogin%');"
|
||||
},
|
||||
{
|
||||
"name": "Possible file exfiltration",
|
||||
"severity": "Low",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%FileUploaded%' "
|
||||
},
|
||||
{
|
||||
"name": "Admin searching in emails of other users",
|
||||
"severity": "Low",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%SearchStarted%' OR Operation LIKE '%SearchExportDownloaded%' OR Operation LIKE '%ViewedSearchExported%' "
|
||||
},
|
||||
{
|
||||
"name": "Strong Authentication Disabled",
|
||||
"severity": "medium",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%disable strong authentication%'"
|
||||
},
|
||||
{
|
||||
"name": "User added to admin group",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add member to group%' AND ModifiedProperties Like '%admin%') OR ( Operation LIKE '%AddedToGroup%' AND TargetUserOrGroupName Like '%admin%') "
|
||||
},
|
||||
{
|
||||
"name": "New Policy created",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add policy%' ) "
|
||||
},
|
||||
{
|
||||
"name": "Security Alert triggered",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AlertTriggered%' AND NOT Severity Like '%Low%') "
|
||||
},
|
||||
{
|
||||
"name": "Transport rules ( mail flow rules ) modified",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%TransportRule%') "
|
||||
},
|
||||
{
|
||||
"name": "An application was registered in Azure AD",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add service principal.%') "
|
||||
},
|
||||
{
|
||||
"name": "Add app role assignment grant to user",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add app role assignment grant to user.%') "
|
||||
},
|
||||
{
|
||||
"name": "eDiscovery Abuse",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%New-ComplianceSearch%') "
|
||||
},
|
||||
{
|
||||
"name": "Operations affecting OAuth Applications",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation = 'Add application.' OR Operation = 'Update application' OR Operation = 'Add service principal.' OR Operation = 'Update application Certificates and secrets management' OR Operation = 'Update applicationUpdate service principal.' OR Operation = 'Add app role assignment grant to user.' OR Operation = 'Add delegated permission grant.' OR Operation = 'Add owner to application.' OR Operation = 'Add owner to service principal.') "
|
||||
},
|
||||
{
|
||||
"name": "Suspicious Operations affecting Mailbox ",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation = 'Set-MailboxJunkEmailConfiguration' OR Operation = 'SoftDelete' OR Operation = 'SendAs' OR Operation = 'HardDelete' OR Operation = 'MoveToDeletedItems' ) "
|
||||
},
|
||||
{
|
||||
"name": "Suspicious Operations affecting SharePoint ",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation = 'AddedToSecureLink' OR Operation = 'SearchQueryPerformed' OR Operation = 'SecureLinkCreated' OR Operation = 'SecureLinkUpdated' OR Operation = 'SharingInvitationCreated' ) "
|
||||
},
|
||||
{
|
||||
"name": "User Modifying RetentionPolicy ",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%UnifiedAuditLogRetentionPolicy%' ) "
|
||||
},
|
||||
{
|
||||
"name": "User Modifying Audit Logging ",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AdminAuditLogConfig%' ) "
|
||||
},
|
||||
{
|
||||
"name": "String Authentication Disabled ",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Disable Strong Authentication.%' ) "
|
||||
}
|
||||
|
||||
|
||||
]
|
||||
{
|
||||
"description": "此 JSON 文件包含与 O365 安全检测相关的规则，每条规则包括名称、严重性等级和查询语句。",
|
||||
"rules": [
|
||||
{
|
||||
"name": "Suspicious User Agent",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE UserAgent LIKE '%python%' OR UserAgent LIKE '%ruler%' OR UserAgent LIKE '%curl%' OR UserAgent LIKE '%Wget%' OR UserAgent LIKE '%python-requests%' OR UserAgent LIKE '%AADInternals%' OR UserAgent LIKE '%azurehound%' OR UserAgent LIKE '%axios%' OR UserAgent LIKE '%BAV2ROPC%' "
|
||||
},
|
||||
{
|
||||
"name": "User adding or removing Inbox Rule",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%InboxRule%' OR Operation LIKE 'Set-Mailbox' OR Operation LIKE '%DeliverToMailboxAndForward%' OR Operation LIKE '%ForwardingAddress%' OR Operation LIKE '%ForwardingAddress%' "
|
||||
},
|
||||
{
|
||||
"name": "After Hours Activity",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE (CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END >= 20 OR CASE WHEN CAST(substr(CreationTime, 12, 2) AS INTEGER) < 0 THEN 24 + (CAST(substr(CreationTime, 12, 2) AS INTEGER)) ELSE CAST(substr(CreationTime, 12, 2) AS INTEGER) END < 6) AND NOT (Operation LIKE 'File%' OR Operation LIKE 'List%' OR Operation LIKE 'Page%' OR Operation LIKE '%UserLogin%');"
|
||||
},
|
||||
{
|
||||
"name": "Possible file exfiltration",
|
||||
"severity": "Low",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%FileUploaded%' "
|
||||
},
|
||||
{
|
||||
"name": "Admin searching in emails of other users",
|
||||
"severity": "Low",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%SearchStarted%' OR Operation LIKE '%SearchExportDownloaded%' OR Operation LIKE '%ViewedSearchExported%' "
|
||||
},
|
||||
{
|
||||
"name": "Strong Authentication Disabled",
|
||||
"severity": "medium",
|
||||
"query": "SELECT * FROM events WHERE Operation LIKE '%disable strong authentication%'"
|
||||
},
|
||||
{
|
||||
"name": "User added to admin group",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add member to group%' AND ModifiedProperties Like '%admin%') OR ( Operation LIKE '%AddedToGroup%' AND TargetUserOrGroupName Like '%admin%') "
|
||||
},
|
||||
{
|
||||
"name": "New Policy created",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%add policy%' ) "
|
||||
},
|
||||
{
|
||||
"name": "Security Alert triggered",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AlertTriggered%' AND NOT Severity Like '%Low%') "
|
||||
},
|
||||
{
|
||||
"name": "Transport rules ( mail flow rules ) modified",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%TransportRule%') "
|
||||
},
|
||||
{
|
||||
"name": "An application was registered in Azure AD",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add service principal.%') "
|
||||
},
|
||||
{
|
||||
"name": "Add app role assignment grant to user",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Add app role assignment grant to user.%') "
|
||||
},
|
||||
{
|
||||
"name": "eDiscovery Abuse",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%New-ComplianceSearch%') "
|
||||
},
|
||||
{
|
||||
"name": "Operations affecting OAuth Applications",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation = 'Add application.' OR Operation = 'Update application' OR Operation = 'Add service principal.' OR Operation = 'Update application Certificates and secrets management' OR Operation = 'Update applicationUpdate service principal.' OR Operation = 'Add app role assignment grant to user.' OR Operation = 'Add delegated permission grant.' OR Operation = 'Add owner to application.' OR Operation = 'Add owner to service principal.') "
|
||||
},
|
||||
{
|
||||
"name": "Suspicious Operations affecting Mailbox ",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation = 'Set-MailboxJunkEmailConfiguration' OR Operation = 'SoftDelete' OR Operation = 'SendAs' OR Operation = 'HardDelete' OR Operation = 'MoveToDeletedItems' ) "
|
||||
},
|
||||
{
|
||||
"name": "Suspicious Operations affecting SharePoint ",
|
||||
"severity": "Medium",
|
||||
"query": "SELECT * FROM events WHERE ( Operation = 'AddedToSecureLink' OR Operation = 'SearchQueryPerformed' OR Operation = 'SecureLinkCreated' OR Operation = 'SecureLinkUpdated' OR Operation = 'SharingInvitationCreated' ) "
|
||||
},
|
||||
{
|
||||
"name": "User Modifying RetentionPolicy ",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%UnifiedAuditLogRetentionPolicy%' ) "
|
||||
},
|
||||
{
|
||||
"name": "User Modifying Audit Logging ",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%AdminAuditLogConfig%' ) "
|
||||
},
|
||||
{
|
||||
"name": "String Authentication Disabled ",
|
||||
"severity": "High",
|
||||
"query": "SELECT * FROM events WHERE ( Operation LIKE '%Disable Strong Authentication.%' ) "
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
|
Before Width: | Height: | Size: 10 KiB |
|
Before Width: | Height: | Size: 236 KiB |
|
Before Width: | Height: | Size: 86 KiB |
|
Before Width: | Height: | Size: 70 KiB |
|
Before Width: | Height: | Size: 222 KiB |
Loading…
Reference in new issue