Panther rules: microsoft365

from panther_msft_helpers import m365_alert_context


def rule(event):
    return event.get("Operation", "") == "UserLoginFailed"


def title(event):
    return (
        f"Microsoft365: [{event.get('UserId', '<user-not-found>')}] "
        "may be undergoing a Brute Force Attack."
    )


def alert_context(event):
    return m365_alert_context(event)

AnalysisType: rule
Description: A Microsoft365 user was denied login access several times
DisplayName: "Microsoft365 Brute Force Login by User"
Enabled: true
Filename: microsoft365_brute_force_login_by_user.py
Reports:
  MITRE ATT&CK:
    - TA0006:T1110 # Credential Access - Brute Force
Runbook: Analyze the IP they came from and actions taken before/after.
Reference: https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/authentication/access-denied-when-connect-to-office-365
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - Microsoft365.Audit.AzureActiveDirectory
RuleID: "Microsoft365.Brute.Force.Login.by.User"
Threshold: 10

import re
from fnmatch import fnmatch

from panther_base_helpers import EMAIL_REGEX
from panther_msft_helpers import m365_alert_context

ALLOWED_DOMAINS = ["mycompany.com", "alloweddomain.com"]  # should be in lowercase

ALLOWED_USERS = ["exception@outsider.com"]  # should be in lowercase

ALLOWED_PATHS = ["*/External/*", "External/*"]


def allowed_path(relative_url):
    for path in ALLOWED_PATHS:
        if fnmatch(relative_url, path):
            return True
    return False


def rule(event):
    if event.get("Operation", "") == "AnonymousLinkCreated":
        return not allowed_path(event.get("SourceRelativeUrl"))
    if event.get("Operation", "") == "AddedToSecureLink":
        if allowed_path(event.get("SourceRelativeUrl")):
            return False
        target = event.get("TargetUserOrGroupName", "")
        if target.lower() in ALLOWED_USERS:
            return False
        if re.fullmatch(EMAIL_REGEX, target):
            if target.split("@")[1].lower() not in ALLOWED_DOMAINS:
                return True
    return False


def title(event):
    return (
        f"Microsoft365: [{event.get('SourceRelativeUrl')}] "
        "has been shared with external users by "
        f"[{event.get('UserId', '<user-not-found>')}]"
    )


def alert_context(event):
    return m365_alert_context(event)

AnalysisType: rule
Description: Document shared externally
DisplayName: "Microsoft365 External Document Sharing"
Enabled: true
Filename: microsoft365_external_sharing.py
Reports:
  MITRE ATT&CK:
    - TA0009:T1039 # Collection - Data from Network Shared Drive
Runbook: Check the document metadata to ensure it is not a sensitive document.
Reference: https://support.microsoft.com/en-us/topic/manage-sharing-with-external-users-in-microsoft-365-small-business-2951a85f-c970-4375-aa4f-6b0d7035fe35#:~:text=Top%20of%20Page-,Turn%20external%20sharing%20on%20or%20off,-The%20ability%20to
Severity: Low
DedupPeriodMinutes: 60
LogTypes:
  - Microsoft365.Audit.SharePoint
RuleID: "Microsoft365.External.Document.Sharing"
Threshold: 1

import json

from panther_msft_helpers import m365_alert_context


def rule(event):
    if event.get("Operation", "") == "Update user.":
        modified_properties = event.get("ModifiedProperties", [])
        for prop in modified_properties:
            if prop.get("Name", "") == "StrongAuthenticationMethod":
                new_value = prop.get("NewValue")
                old_value = prop.get("OldValue")
                if isinstance(new_value, str):
                    new_value = json.loads(new_value)
                if isinstance(old_value, str):
                    old_value = json.loads(old_value)

                if old_value and not new_value:
                    return True
                break
    return False


def title(event):
    return "Microsoft365: MFA Removed on " f"[{event.get('ObjectId', '')}]"


def alert_context(event):
    return m365_alert_context(event)

AnalysisType: rule
Description: A user's MFA has been removed
DisplayName: "Microsoft365 MFA Disabled"
Enabled: true
Filename: microsoft365_mfa_disabled.py
Reports:
  MITRE ATT&CK:
    - TA003:T1556 # Persistence - Modify Authentication Process
    - TA005:T1556 # Defense Evansion - Modify Authentication Process
    - TA006:T1556 # Credential Access - Modify Authentication Process
Runbook: Depending on company policy, either suggest or require the user re-enable two step verification.
Reference: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide
Severity: Low
DedupPeriodMinutes: 60
LogTypes:
  - Microsoft365.Audit.AzureActiveDirectory
RuleID: "Microsoft365.MFA.Disabled"
Threshold: 1