Detection rules › Splunk
O365 Cross-Tenant Access Change
The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration.
Known false positives
- Business approved changes by known administrators.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | |
| Defense Impairment |
Telemetry coverage
Rule body
name: O365 Cross-Tenant Access Change
id: 7c0fa490-12b0-4d0b-b9f5-e101d1e0e06f
version: 9
creation_date: '2024-04-13'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration.
data_source:
- Office 365 Universal Audit Log
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add a partner to cross-tenant access setting.\",\"Delete partner specific cross-tenant access setting.\") | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Business approved changes by known administrators.
references:
- https://attack.mitre.org/techniques/T1484/002/
- https://thehackernews.com/2023/08/emerging-attacker-exploit-microsoft.html
- https://cyberaffairs.com/news/emerging-attacker-exploit-microsoft-cross-tenant-synchronization/
- https://www.crowdstrike.com/blog/crowdstrike-defends-against-azure-cross-tenant-synchronization-attacks/
finding:
title: The user [$user$] changed the Azure cross-tenant access settings
entity:
field: user
type: user
score: 50
analytic_story:
- Azure Active Directory Persistence
asset_type: O365 Tenant
mitre_attack_id:
- T1484.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: cloud
security_domain: threat
Stages and Predicates
Stage 1: search
`o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add a partner to cross-tenant access setting.","Delete partner specific cross-tenant access setting.")
Stage 2: eval
| eval user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0))
user =if
match(mvindex('Actor{}.ID', -1), "User")mvindex('Actor{}.ID', 0)elif
match(mvindex('Actor{}.ID', -1), "ServicePrincipal")mvindex('Actor{}.ID', 3)else
mvindex('Actor{}.ID', 0)Stage 3: fillnull
| fillnull
Stage 4: stats
| stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id
Stage 5: search
| `security_content_ctime(firstTime)`
Stage 6: search
| `security_content_ctime(lastTime)`
Stage 7: search
| `o365_cross_tenant_access_change_filter`
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Operation | in |
| field:"Operation" kind:in |
Workload | eq |
| field:"Workload" kind:eq value:"AzureActiveDirectory" |
sourcetype | eq |
| field:"sourcetype" kind:eq value:"o365:management:activity" |