nldcsc-elastic-rules 0.0.8__py3-none-any.whl

nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_malware_uploaded_onedrive.toml

@@ -0,0 +1,104 @@
+[metadata]
+creation_date = "2022/01/10"
+integration = ["o365"]
+maturity = "production"
+updated_date = "2025/09/30"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies the occurence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers
+can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access.
+Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain
+initial access to other endpoints in the environment.
+"""
+false_positives = ["Benign files can trigger signatures in the built-in virus protection"]
+from = "now-9m"
+index = ["logs-o365.audit-*", "filebeat-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "OneDrive Malware File Upload"
+note = """## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+### Investigating OneDrive Malware File Upload
+
+OneDrive, a cloud storage service, facilitates file sharing and collaboration within organizations. However, adversaries can exploit this by uploading malware, which can spread across shared environments, leading to lateral movement within a network. The detection rule identifies such threats by monitoring OneDrive activities for malware detection events, focusing on file operations flagged by Microsoft's security engine. This proactive approach helps in identifying and mitigating potential breaches.
+
+### Possible investigation steps
+
+- Review the alert details to confirm the event dataset is 'o365.audit' and the event provider is 'OneDrive' to ensure the alert is relevant to OneDrive activities.
+- Examine the specific file operation flagged by the event code 'SharePointFileOperation' and action 'FileMalwareDetected' to identify the file in question and understand the nature of the detected malware.
+- Identify the user account associated with the file upload to determine if the account has been compromised or if the user inadvertently uploaded the malicious file.
+- Check the sharing settings of the affected file to assess the extent of exposure and identify any other users or systems that may have accessed the file.
+- Investigate the file's origin and history within the organization to trace how it was introduced into the environment and whether it has been shared or accessed by other users.
+- Review any additional security alerts or logs related to the user account or file to identify potential patterns of malicious activity or further compromise.
+- Coordinate with IT and security teams to isolate the affected file and user account, and initiate remediation steps to prevent further spread of the malware.
+
+### False positive analysis
+
+- Legitimate software updates or patches may be flagged as malware if they are not yet recognized by the security engine. Users should verify the source and integrity of the file and consider adding it to an exception list if confirmed safe.
+- Files containing scripts or macros used for automation within the organization might trigger false positives. Review the file's purpose and origin, and whitelist it if it is a known and trusted internal tool.
+- Shared files from trusted partners or vendors could be mistakenly identified as threats. Establish a process to verify these files with the sender and use exceptions for recurring, verified files.
+- Archived or compressed files that contain known safe content might be flagged due to their format. Decompress and scan the contents separately to confirm their safety before adding exceptions.
+- Files with unusual or encrypted content used for legitimate business purposes may be misclassified. Ensure these files are documented and approved by IT security before excluding them from alerts.
+
+### Response and remediation
+
+- Immediately isolate the affected OneDrive account to prevent further file sharing and potential spread of malware within the organization.
+- Notify the user associated with the account about the detected malware and instruct them to cease any file sharing activities until further notice.
+- Conduct a thorough scan of the affected files using an updated antivirus or endpoint detection and response (EDR) solution to confirm the presence of malware and identify any additional infected files.
+- Remove or quarantine the identified malicious files from OneDrive and any other locations they may have been shared to prevent further access or execution.
+- Review and revoke any shared links or permissions associated with the infected files to ensure no unauthorized access is possible.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if any lateral movement or additional compromise has occurred.
+- Implement enhanced monitoring and alerting for similar OneDrive activities to quickly detect and respond to any future malware uploads or related threats.
+
+## Setup
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+references = [
+    "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide",
+]
+risk_score = 73
+rule_id = "bba1b212-b85c-41c6-9b28-be0e5cdfc9b1"
+severity = "high"
+tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Tactic: Lateral Movement", "Resources: Investigation Guide"]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset:o365.audit and event.provider:OneDrive and event.code:SharePointFileOperation and event.action:FileMalwareDetected
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1080"
+name = "Taint Shared Content"
+reference = "https://attack.mitre.org/techniques/T1080/"
+
+
+[rule.threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1608"
+name = "Stage Capabilities"
+reference = "https://attack.mitre.org/techniques/T1608/"
+[[rule.threat.technique.subtechnique]]
+id = "T1608.001"
+name = "Upload Malware"
+reference = "https://attack.mitre.org/techniques/T1608/001/"
+
+
+[rule.threat.tactic]
+id = "TA0042"
+name = "Resource Development"
+reference = "https://attack.mitre.org/tactics/TA0042/"
+

nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_malware_uploaded_sharepoint.toml

@@ -0,0 +1,103 @@
+[metadata]
+creation_date = "2022/01/10"
+integration = ["o365"]
+maturity = "production"
+updated_date = "2025/09/30"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine.
+Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their
+access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities
+to gain initial access to other endpoints in the environment.
+"""
+false_positives = ["Benign files can trigger signatures in the built-in virus protection"]
+from = "now-9m"
+index = ["logs-o365.audit-*", "filebeat-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "SharePoint Malware File Upload"
+note = """## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+### Investigating SharePoint Malware File Upload
+
+SharePoint, a collaborative platform, facilitates file sharing and storage within organizations. Adversaries exploit this by uploading malware, leveraging the platform's sharing capabilities to propagate threats laterally. The detection rule identifies when SharePoint's file scanning engine flags an upload as malicious, focusing on specific audit events to alert security teams of potential lateral movement threats.
+
+### Possible investigation steps
+
+- Review the specific event details in the alert, focusing on the event.dataset, event.provider, event.code, and event.action fields to confirm the alert is related to a SharePoint file upload flagged as malware.
+- Identify the user account associated with the file upload by examining the audit logs and determine if the account has a history of suspicious activity or if it has been compromised.
+- Analyze the file metadata, including the file name, type, and size, to gather more context about the nature of the uploaded file and assess its potential impact.
+- Check the file's sharing permissions and access history to identify other users or systems that may have interacted with the file, assessing the risk of lateral movement.
+- Investigate the source of the file upload, such as the originating IP address or device, to determine if it aligns with known malicious activity or if it is an anomaly for the user.
+- Coordinate with the IT team to isolate affected systems or accounts if necessary, and initiate a response plan to mitigate any potential spread of the malware within the organization.
+
+### False positive analysis
+
+- Legitimate software updates or patches uploaded to SharePoint may be flagged as malware. To handle this, create exceptions for known update files by verifying their source and hash.
+- Internal security tools or scripts used for testing purposes might trigger false positives. Maintain a list of these tools and exclude them from alerts after confirming their legitimacy.
+- Files with encrypted content, such as password-protected documents, can be mistakenly identified as malicious. Implement a process to review and whitelist these files if they are from trusted sources.
+- Large batch uploads from trusted departments, like IT or HR, may occasionally be flagged. Establish a review protocol for these uploads and whitelist them if they are verified as safe.
+- Files with macros or executable content used in legitimate business processes might be detected. Work with relevant departments to identify and exclude these files from alerts after thorough validation.
+
+### Response and remediation
+
+- Immediately isolate the affected SharePoint site or library to prevent further access and sharing of the malicious file. This can be done by restricting permissions or temporarily disabling access to the site.
+- Notify the security operations team and relevant stakeholders about the detected malware to ensure awareness and initiate a coordinated response.
+- Quarantine the identified malicious file to prevent it from being accessed or executed by users. Use SharePoint's built-in capabilities or integrated security tools to move the file to a secure location.
+- Conduct a thorough scan of the affected SharePoint site and connected systems to identify any additional malicious files or indicators of compromise. Use advanced threat detection tools to ensure comprehensive coverage.
+- Review and revoke any unauthorized access or sharing permissions that may have been granted to the malicious file, ensuring that only legitimate users have access to sensitive data.
+- Escalate the incident to the incident response team if there are signs of lateral movement or if the malware has spread to other parts of the network, following the organization's escalation protocols.
+- Implement enhanced monitoring and logging for SharePoint and related services to detect any future attempts to upload or share malicious files, leveraging the specific query fields used in the detection rule.
+
+## Setup
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+references = [
+    "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide",
+]
+risk_score = 73
+rule_id = "0e52157a-8e96-4a95-a6e3-5faae5081a74"
+severity = "high"
+tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Tactic: Lateral Movement", "Resources: Investigation Guide"]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset:o365.audit and event.provider:SharePoint and event.code:SharePointFileOperation and event.action:FileMalwareDetected
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1080"
+name = "Taint Shared Content"
+reference = "https://attack.mitre.org/techniques/T1080/"
+
+
+[rule.threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1608"
+name = "Stage Capabilities"
+reference = "https://attack.mitre.org/techniques/T1608/"
+[[rule.threat.technique.subtechnique]]
+id = "T1608.001"
+name = "Upload Malware"
+reference = "https://attack.mitre.org/techniques/T1608/001/"
+
+
+[rule.threat.tactic]
+id = "TA0042"
+name = "Resource Development"
+reference = "https://attack.mitre.org/tactics/TA0042/"
+

nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml

@@ -0,0 +1,140 @@
+[metadata]
+creation_date = "2021/05/17"
+integration = ["o365"]
+maturity = "production"
+updated_date = "2025/05/07"
+
+[rule]
+author = ["Elastic", "Austin Songer"]
+description = """
+Identifies the assignment of rights to access content from another mailbox. An adversary may use the compromised account
+to send messages to other accounts in the network of the target organization while creating inbox rules, so messages can
+evade spam/phishing detection mechanisms.
+"""
+false_positives = [
+    "Assignment of rights to a service account.",
+    "Delegation by first-party applications that require mailbox access."
+]
+index = ["filebeat-*", "logs-o365.audit-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "Suspicious Mailbox Permission Delegation in Exchange Online"
+note = """## Triage and Analysis
+
+### Investigating Suspicious Mailbox Permission Delegation in Exchange Online
+
+This rule detects the delegation of mailbox permissions in Microsoft 365 Exchange. This behavior may indicate that an adversary is attempting to gain access to another user's mailbox or send messages on behalf of that user.
+
+### Possible Investigation Steps
+- `user.id` and `o365.audit.Parameters.Identity`: Determine which account was delegated access and which account performed the delegation. Review both for unusual activity.
+- `event.action`: Indicates the type of permission granted. Review which delegation action was taken.
+- `o365.audit.Parameters.AccessRights` or `GrantSendOnBehalfTo`: Confirm the exact permission granted.
+- `@timestamp` and `event.ingested`: Review the timing of the delegation and whether it aligns with user activity or known business events.
+- `source.ip` and `source.geo`: Validate that the source IP and location are expected for the admin or account performing the action.
+- `user_agent.original`: If present, review to identify any automation, script, or unexpected interface used to assign the permissions.
+
+#### FullAccess (`Add-MailboxPermission`)
+- `o365.audit.Parameters.Identity`: The mailbox being accessed.
+- `o365.audit.Parameters.User`: The user granted FullAccess.
+- Review for subsequent mailbox logins or message rules created by the grantee.
+
+#### SendAs (`Add-RecipientPermission`)
+- `o365.audit.Parameters.Identity`: The account the grantee is allowed to impersonate.
+- `o365.audit.Parameters.Trustee`: The user who was granted the ability to send as the identity.
+- Search for recent messages sent "as" the identity and validate whether the activity was legitimate.
+
+#### SendOnBehalf (`Set-Mailbox`)
+- `o365.audit.Parameters.GrantSendOnBehalfTo`: The user allowed to send on behalf of the mailbox owner.
+- Check for outbound emails or meeting requests with "on behalf of" headers.
+
+### False Positive Analysis
+
+- Delegation to Assistants: Executive or admin assistants often receive FullAccess or SendOnBehalf permissions.
+- Shared Mailboxes: Teams or departments may share access to mailboxes for operational efficiency.
+- Automated Admin Actions: System or service accounts may perform these actions as part of onboarding or automation.
+- Project-Based Access: Temporary access granted for short-term collaboration.
+- Maintain an allowlist of known delegation relationships.
+
+### Response and Remediation
+
+If the delegation is determined to be unauthorized or suspicious:
+
+- Revoke the delegated permissions immediately to prevent further access.
+- Reset credentials for the impacted accounts if compromise is suspected.
+- Review mailbox rules and sent items to detect abuse.
+- Alert impacted users and advise on suspicious activity to watch for.
+- Audit audit logs around the delegation for additional attacker actions (e.g., MFA disablement, mailbox rule creation, login from foreign IPs).
+- Review conditional access, role-based access control, and app permissions to reduce the attack surface.
+- Harden delegation policies by requiring approvals, limiting delegation to specific groups, or implementing Just-in-Time (JIT) access for mailboxes.
+"""
+references = [
+    "https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/give-mailbox-permissions-to-another-user?view=o365-worldwide"
+]
+risk_score = 21
+rule_id = "0ce6487d-8069-4888-9ddd-61b52490cebc"
+severity = "low"
+tags = [
+    "Domain: Cloud",
+    "Domain: SaaS",
+    "Data Source: Microsoft 365",
+    "Data Source: Microsoft Exchange",
+    "Data Source: Microsoft 365 Audit Logs",
+    "Use Case: Configuration Audit",
+    "Tactic: Persistence",
+    "Resources: Investigation Guide"
+]
+timestamp_override = "event.ingested"
+type = "new_terms"
+
+query = '''
+event.dataset: "o365.audit" and
+event.provider: "Exchange" and
+event.outcome: "success" and
+not o365.audit.UserType : (3 or 4) and
+(
+    (event.action: "Add-MailboxPermission" and o365.audit.Parameters.AccessRights: "FullAccess") or
+    (event.action: "Add-RecipientPermission" and o365.audit.Parameters.AccessRights: "SendAs") or
+    (event.action: "Set-Mailbox" and o365.audit.Parameters.GrantSendOnBehalfTo: *)
+) and
+not user.id:(
+    "NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)" or
+    "NT AUTHORITY\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)" or
+    "NT AUTHORITY\SYSTEM (w3wp)"
+    )
+'''
+
+[rule.investigation_fields]
+field_names = [
+    "@timestamp",
+    "o365.audit.ObjectId",
+    "o365.audit.Parameters.Identity",
+    "user.id",
+    "source.ip",
+    "user_agent.original",
+    "event.action",
+]
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1098"
+name = "Account Manipulation"
+reference = "https://attack.mitre.org/techniques/T1098/"
+[[rule.threat.technique.subtechnique]]
+id = "T1098.002"
+name = "Additional Email Delegate Permissions"
+reference = "https://attack.mitre.org/techniques/T1098/002/"
+
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[rule.new_terms]
+field = "new_terms_fields"
+value = ["o365.audit.UserId"]
+[[rule.new_terms.history_window_start]]
+field = "history_window_start"
+value = "now-14d"

nldcsc_elastic_rules/rules/integrations/o365/persistence_microsoft_365_exchange_management_role_assignment.toml

@@ -0,0 +1,101 @@
+[metadata]
+creation_date = "2020/11/20"
+integration = ["o365"]
+maturity = "production"
+updated_date = "2025/09/30"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in
+order to maintain persistence in an environment.
+"""
+false_positives = [
+    """
+    A new role may be assigned to a management group by a system or network administrator. Verify that the configuration
+    change was expected. Exceptions can be added to this rule to filter expected behavior.
+    """,
+]
+from = "now-9m"
+index = ["logs-o365.audit-*", "filebeat-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "Microsoft 365 Exchange Management Group Role Assignment"
+note = """## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+### Investigating Microsoft 365 Exchange Management Group Role Assignment
+
+Microsoft 365 Exchange Management roles define permissions for managing Exchange environments. Adversaries may exploit this by assigning roles to unauthorized users, ensuring persistent access. The detection rule monitors successful role assignments within Exchange, flagging potential unauthorized changes that align with persistence tactics, thus aiding in identifying and mitigating unauthorized access attempts.
+
+### Possible investigation steps
+
+- Review the event details to confirm the event.action is "New-ManagementRoleAssignment" and the event.outcome is "success" to ensure the alert is valid.
+- Identify the user account associated with the role assignment by examining the event.dataset and event.provider fields, and verify if the account is authorized to make such changes.
+- Check the history of role assignments for the identified user to determine if there are any patterns of unauthorized or suspicious activity.
+- Investigate the specific management role that was assigned to understand its permissions and potential impact on the environment.
+- Correlate this event with other recent activities from the same user or IP address to identify any additional suspicious behavior or anomalies.
+- Consult with the relevant IT or security teams to verify if the role assignment was part of a legitimate administrative task or change request.
+
+### False positive analysis
+
+- Routine administrative role assignments can trigger alerts. Regularly review and document legitimate role changes to differentiate them from unauthorized activities.
+- Automated scripts or tools used for role management may cause false positives. Identify and whitelist these tools to prevent unnecessary alerts.
+- Changes made during scheduled maintenance windows might be flagged. Establish a process to temporarily suppress alerts during these periods while ensuring post-maintenance reviews.
+- Role assignments related to onboarding or offboarding processes can appear suspicious. Implement a verification step to confirm these changes align with HR records and expected activities.
+- Frequent role changes by specific users with administrative privileges may not indicate malicious intent. Monitor these users' activities and establish a baseline to identify deviations from normal behavior.
+
+### Response and remediation
+
+- Immediately revoke the newly assigned management role from the unauthorized user to prevent further unauthorized access or changes.
+- Conduct a thorough review of recent activity logs for the affected account to identify any suspicious actions taken since the role assignment.
+- Reset the credentials of the compromised account and enforce multi-factor authentication to enhance security.
+- Notify the security team and relevant stakeholders about the incident for awareness and further investigation.
+- Implement additional monitoring on the affected account and similar high-privilege accounts to detect any further unauthorized attempts.
+- Review and update access control policies to ensure that only authorized personnel can assign management roles in Microsoft 365.
+- Consider conducting a security awareness session for administrators to reinforce the importance of monitoring and managing role assignments securely.
+
+## Setup
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+references = [
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide",
+]
+risk_score = 47
+rule_id = "98995807-5b09-4e37-8a54-5cae5dc932d7"
+severity = "medium"
+tags = [
+    "Domain: Cloud",
+    "Data Source: Microsoft 365",
+    "Use Case: Identity and Access Audit",
+    "Tactic: Persistence",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"New-ManagementRoleAssignment" and event.outcome:success
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1098"
+name = "Account Manipulation"
+reference = "https://attack.mitre.org/techniques/T1098/"
+[[rule.threat.technique.subtechnique]]
+id = "T1098.003"
+name = "Additional Cloud Roles"
+reference = "https://attack.mitre.org/techniques/T1098/003/"
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+

nldcsc_elastic_rules/rules/integrations/o365/persistence_microsoft_365_global_administrator_role_assign.toml

@@ -0,0 +1,105 @@
+[metadata]
+creation_date = "2022/01/06"
+integration = ["o365"]
+maturity = "production"
+updated_date = "2025/11/08"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies when the Microsoft 365 Global Administrator or Company Administrator role is assigned to a user or service
+principal. The Global Administrator role has extensive privileges across Entra ID and Microsoft 365 services, making it
+a high-value target for adversaries seeking persistent access. Successful assignments of this role may indicate
+potential privilege escalation or unauthorized access attempts, especially if performed by accounts that do not
+typically manage high-privilege roles.
+"""
+from = "now-9m"
+index = ["logs-o365.audit-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "Microsoft 365 Global Administrator Role Assigned"
+note = """## Triage and Analysis
+
+### Investigating Microsoft 365 Global Administrator Role Assigned
+
+The Microsoft 365 Global Administrator role grants comprehensive administrative access across Entra ID and services such as Microsoft 365 Defender, Exchange, SharePoint, and Skype for Business. Adversaries who compromise an account may assign this role to themselves or other users to ensure persistent and privileged access. This rule identifies successful assignments of this role by inspecting audit logs from Azure Active Directory (Entra ID) where the role display name matches "Administrator."
+
+### Possible investigation steps
+
+- Review the `user.id` and `user.name` fields to determine who performed the role assignment. Assess whether this user normally has permissions to modify high-privilege roles.
+- Confirm the `event.action` is `"Add member to role."` and that the `Role_DisplayName.NewValue` is `"Global Administrator"` or a similarly privileged role.
+- Review the `user.target.id` and `user.target.name` fields to identify the user or service principal that received the role.
+- Inspect `o365.audit.ExtendedProperties.additionalDetails` for context on how the action was performed (e.g., via Admin Portal, Graph API).
+- Pivot to sign-in logs for the assigning account to check for recent anomalies such as logins from new geolocations, unrecognized devices, or suspicious IP ranges.
+- Investigate if the account assignment occurred outside of known change windows, during non-business hours, or by a user with no change history.
+- Correlate with other role assignments or directory changes to check for broader role abuse or privilege escalation campaigns.
+
+### False positive analysis
+
+- Role assignments by IT administrators as part of routine maintenance or incident response may appear suspicious in environments without change tracking or ticket correlation.
+- PIM (Privileged Identity Management) activations may temporarily elevate accounts to Global Administrator and then revoke the role afterward.
+- Onboarding processes or internal audits may require temporary elevation to Global Administrator for legitimate users.
+- Automation tools and scripts may trigger this alert if misconfigured to assign Global Administrator privileges during provisioning or sync jobs.
+
+### Response and remediation
+
+- If the assignment is unapproved or suspicious, immediately revoke the Global Administrator role from the assigned user or service principal.
+- Reset credentials and initiate containment steps for the assigning account, especially if compromise is suspected.
+- Enable or verify enforcement of MFA for both assigning and assigned accounts.
+- Review Azure AD activity logs for additional signs of privilege misuse or suspicious directory changes.
+- Notify the appropriate identity and security operations teams to investigate further and begin incident response procedures.
+- Limit the number of Global Administrator accounts and enforce role-based access control (RBAC) using least privilege principles.
+- Consider implementing conditional access policies to limit role assignment actions to specific networks, devices, or user groups.
+"""
+references = [
+    "https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#global-administrator",
+    "https://learn.microsoft.com/en-us/purview/audit-log-activities",
+    "https://www.blackhat.com/us-24/briefings/schedule/#unoauthorized-a-technique-to-privilege-escalation-to-global-administrator-39231"
+]
+risk_score = 47
+rule_id = "88671231-6626-4e1b-abb7-6e361a171fbb"
+severity = "medium"
+tags = [
+    "Domain: Cloud",
+    "Domain: SaaS",
+    "Domain: Identity",
+    "Data Source: Microsoft 365",
+    "Data Source: Microsoft 365 Audit Logs",
+    "Use Case: Identity and Access Audit",
+    "Tactic: Persistence",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset:o365.audit
+    and event.code:"AzureActiveDirectory"
+    and event.action:"Add member to role."
+    and event.outcome: "success"
+    and o365.audit.ModifiedProperties.Role_DisplayName.NewValue: (
+        "Global Administrator" or "Company Administrator"
+    )
+    and o365.audit.AzureActiveDirectoryEventType: 1
+    and o365.audit.RecordType: 8
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1098"
+name = "Account Manipulation"
+reference = "https://attack.mitre.org/techniques/T1098/"
+[[rule.threat.technique.subtechnique]]
+id = "T1098.003"
+name = "Additional Cloud Roles"
+reference = "https://attack.mitre.org/techniques/T1098/003/"
+
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+

nldcsc_elastic_rules/rules/integrations/o365/persistence_microsoft_365_teams_guest_access_enabled.toml

@@ -0,0 +1,91 @@
+[metadata]
+creation_date = "2020/11/20"
+integration = ["o365"]
+maturity = "production"
+updated_date = "2025/09/26"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization
+to access teams and channels. An adversary may enable guest access to maintain persistence in an environment.
+"""
+false_positives = [
+    """
+    Teams guest access may be enabled by a system or network administrator. Verify that the configuration change was
+    expected. Exceptions can be added to this rule to filter expected behavior.
+    """,
+]
+from = "now-9m"
+index = ["logs-o365.audit-*", "filebeat-*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "Microsoft 365 Teams Guest Access Enabled"
+note = """## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+### Investigating Microsoft 365 Teams Guest Access Enabled
+
+Microsoft Teams allows organizations to collaborate with external users through guest access, facilitating communication and teamwork. However, adversaries can exploit this feature to gain persistent access to sensitive environments by enabling guest access without authorization. The detection rule monitors audit logs for specific configurations that indicate guest access has been enabled, helping identify unauthorized changes and potential security breaches.
+
+### Possible investigation steps
+
+- Review the audit logs to confirm the event.action "Set-CsTeamsClientConfiguration" was successfully executed with the parameter o365.audit.Parameters.AllowGuestUser set to True.
+- Identify the user account responsible for enabling guest access by examining the event logs for the user ID or account name associated with the action.
+- Check the user's activity history to determine if there are any other suspicious actions or patterns, such as changes to other configurations or unusual login times.
+- Investigate the context of the change by reviewing any related communications or requests that might justify enabling guest access, ensuring it aligns with organizational policies.
+- Assess the potential impact by identifying which teams and channels now have guest access enabled and evaluate the sensitivity of the information accessible to external users.
+- Contact the user or their manager to verify if the change was authorized and necessary, and document their response for future reference.
+
+### False positive analysis
+
+- Legitimate collaboration with external partners may trigger alerts when guest access is enabled for business purposes. To manage this, create exceptions for known and approved external domains or specific projects that require guest access.
+- Routine administrative actions by IT staff to enable guest access for specific teams or channels can be mistaken for unauthorized changes. Implement a process to log and approve such changes internally, and exclude these from triggering alerts.
+- Automated scripts or third-party applications that configure Teams settings, including guest access, might cause false positives. Identify and whitelist these scripts or applications to prevent unnecessary alerts.
+- Changes made during scheduled maintenance windows can be misinterpreted as unauthorized. Define and exclude these time periods from monitoring to reduce false positives.
+
+### Response and remediation
+
+- Immediately disable guest access in Microsoft Teams by updating the Teams client configuration to prevent unauthorized external access.
+- Conduct a thorough review of recent audit logs to identify any unauthorized changes or suspicious activities related to guest access settings.
+- Notify the security team and relevant stakeholders about the potential breach to ensure awareness and initiate further investigation.
+- Revoke any unauthorized guest accounts that have been added to Teams to eliminate potential persistence mechanisms.
+- Implement additional monitoring on Teams configurations to detect any future unauthorized changes to guest access settings.
+- Escalate the incident to the organization's incident response team for a comprehensive investigation and to determine if further containment actions are necessary.
+- Review and update access control policies to ensure that enabling guest access requires appropriate authorization and oversight.
+
+## Setup
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+references = [
+    "https://docs.microsoft.com/en-us/powershell/module/skype/get-csteamsclientconfiguration?view=skype-ps",
+]
+risk_score = 47
+rule_id = "5e552599-ddec-4e14-bad1-28aa42404388"
+severity = "medium"
+tags = ["Domain: Cloud", "Data Source: Microsoft 365", "Use Case: Configuration Audit", "Tactic: Persistence", "Resources: Investigation Guide"]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset:o365.audit and event.provider:(SkypeForBusiness or MicrosoftTeams) and
+event.category:web and event.action:"Set-CsTeamsClientConfiguration" and
+o365.audit.Parameters.AllowGuestUser:True and event.outcome:success
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1098"
+name = "Account Manipulation"
+reference = "https://attack.mitre.org/techniques/T1098/"
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+