Office 365 and Azure Hunting

id: Office 365 and Azure Hunting
version: -1
name: Office 365 and Azure Hunting
description: 'This playbook enables you to collect and investigate suspicious security events from Azure AD environment. '
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e12ceb8c-018b-4a48-806a-4443ee22b71e
    type: start
    task:
      id: e12ceb8c-018b-4a48-806a-4443ee22b71e
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: c8d75c55-e9f1-4808-8272-4c027f784e3b
    type: title
    task:
      id: c8d75c55-e9f1-4808-8272-4c027f784e3b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 9b9c34a8-15c4-46c8-83b9-5a15e108b370
    type: regular
    task:
      id: 9b9c34a8-15c4-46c8-83b9-5a15e108b370
      version: -1
      name: Search for Azure AD service account created or modified
      description: "Hunt for a Azure AD new or modified service account.\nXDR example query:\npreset = msft_azure_ad_audit // go over azure ad audit logs\n| filter activityDisplayName IN (\"Add service principal credentials\", \"Add service principal\")\nAND result = \"success\" // find cases where someone adds SPNs to an account\n\nSplunk example queries:\nsourcetype=\"azure:aad:audit\" activityDisplayName=\"Add service principal\" \n| stats values(activityDisplayName) AS Action, values(initiatedBy.user.userPrincipalName) \nAS UPN, values(targetResources{}.displayName) AS Target,\nvalues(targetResources{}.modifiedProperties{}.displayName) AS \"Modified Resources\",\nvalues(targetResources{}.modifiedProperties{}.oldValue) AS \"Old Values\",\nvalues(targetResources{}.modifiedProperties{}.newValue) AS \"New Values\" by correlationId \n| fields - correlationId\n---------\nsourcetype=\"azure:aad:audit\" activityDisplayName=\"Add service principal credentials\"\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 6240c9dc-c4d0-4e19-8055-d90a16ed5bec
    type: regular
    task:
      id: 6240c9dc-c4d0-4e19-8055-d90a16ed5bec
      version: -1
      name: Search for Azure AD application sharing with additional tenants
      description: "Hunt for Azure AD application sharing with additional tenants.\n**XDR example query:**\npreset = msft_azure_ad_audit  // go over azure ad audit logs\n| filter activityDisplayName = \"Update application\"\nAND operationType=\"Update\"\nand result=\"success\"\nand modifiedDisplayName = \"AvailableToOtherTenants\"  // find cases where someone grants permission to access an app from another azure ad tenant\n\n**Splunk example query:**\nsourcetype=\"azure:aad:audit\" activityDisplayName=\"Update application\" operationType=Update \nresult=success targetResources{}.modifiedProperties{}.displayName=AvailableToOtherTenants \n| table activityDateTime initiatedBy.user.userPrincipalName, \ntargetResources{}.displayName additionalDetails{}.value"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: dd13bebb-ebc9-4d62-85ef-38574f7aaac7
    type: regular
    task:
      id: dd13bebb-ebc9-4d62-85ef-38574f7aaac7
      version: -1
      name: Search for an added Azure AD custom unverified domain
      description: |-
        Hunt for an added Azure AD custom unverified domain.
        XDR example query:
        preset = msft_azure_ad_audit // go over azure ad audit logs
        | filter activityDisplayName = "Add unverified domain" AND result = "success"  // find cases where someone added a custom domain to the azure ad env
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 11ce5bed-ede5-4263-8bfe-5b46d0a44463
    type: regular
    task:
      id: 11ce5bed-ede5-4263-8bfe-5b46d0a44463
      version: -1
      name: Search for SSO being disabled for a domain
      description: |-
        Hunt for SSO being disabled for a domain.
        XDR example query:
        preset = msft_azure_ad_audit // go over azure ad audit logs
        | filter activityDisplayName = "Disable Desktop Sso for a specific domain" AND result =
        "success" // remove need for SSO on desktop devices
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: f43f3472-e999-4839-8c7d-b55bdc08f0f7
    type: regular
    task:
      id: f43f3472-e999-4839-8c7d-b55bdc08f0f7
      version: -1
      name: Search for modified domain federation settings
      description: |-
        Hunt for modified domain federation settings.
        XDR example query:
        preset = msft_azure_ad_audit // go over azure ad audit logs
        | filter activityDisplayName = "Set federation settings on domain"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 3070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 1d40b042-db29-4326-8c51-16d499af1680
    type: regular
    task:
      id: 1d40b042-db29-4326-8c51-16d499af1680
      version: -1
      name: Search mail permissions that were added to a service principal
      description: |-
        Hunt for cases where mail permissions were added to a service principal.
        XDR example query:
        preset = msft_azure_ad_audit // go over azure ad audit logs
        | filter activityDisplayName IN ("Add app role assignment to service
        principal", "Add delegated permission grant", "Add application" ) and
                modifiedPropertyNewValue ~= "(Mail.Read|Mail.ReadWrite)" and
                modifiedPropertyOldValue not contains "Mail.Read" // find
        cases where mail read was added as a permission to another account.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 3260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 32bb1304-61c7-4d72-8535-c086a3a10bed
    type: condition
    task:
      id: 32bb1304-61c7-4d72-8535-c086a3a10bed
      version: -1
      name: Is Microsoft Policy And Compliance enabled?
      description: Checks if Microsoft Policy And Compliance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value:
              simple: MicrosoftPolicyAndComplianceAuditLog
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 97175d0a-c968-4297-82f9-ca62ba28e4cd
    type: title
    task:
      id: 97175d0a-c968-4297-82f9-ca62ba28e4cd
      version: -1
      name: Manual Hunt
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: ca015250-4fb1-42ce-8516-c708d86f1053
    type: title
    task:
      id: ca015250-4fb1-42ce-8516-c708d86f1053
      version: -1
      name: 'Automatic Hunt '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 8b9ad15d-f0e2-43b9-84fb-b0684357c75f
    type: regular
    task:
      id: 8b9ad15d-f0e2-43b9-84fb-b0684357c75f
      version: -1
      name: Search for Azure AD service account created or modified
      description: Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
      script: '|||o365-auditlog-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      end_date: {}
      free_text: {}
      ip_addresses: {}
      operations:
        simple: Add service principal credentials,Add service principal
      record_type:
        simple: AzureActiveDirectory
      result_size: {}
      start_date: {}
      user_ids: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 2280
        }
      }
    note: false
    evidencedata:
      description:
        simple: Azure AD service account created or modified
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: b33e2258-dd01-4a54-86ae-f38c1ad0f045
    type: regular
    task:
      id: b33e2258-dd01-4a54-86ae-f38c1ad0f045
      version: -1
      name: Search for Azure AD application sharing with additional tenants
      description: Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
      script: '|||o365-auditlog-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      end_date: {}
      free_text:
        simple: AvailableToOtherTenants
      ip_addresses: {}
      operations:
        simple: Update application
      record_type:
        simple: AzureActiveDirectory
      result_size: {}
      start_date: {}
      user_ids: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 2480
        }
      }
    note: false
    evidencedata:
      description:
        simple: Azure AD application sharing with additional tenants
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 11863f50-65fe-4b12-80da-72551d2f44fe
    type: regular
    task:
      id: 11863f50-65fe-4b12-80da-72551d2f44fe
      version: -1
      name: Search for Azure AD custom unverified domain was added
      description: Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
      script: '|||o365-auditlog-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      end_date: {}
      free_text:
        simple: Add unverified domain
      ip_addresses: {}
      operations: {}
      record_type:
        simple: AzureActiveDirectory
      result_size: {}
      start_date: {}
      user_ids: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 2670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: 12bff9a6-df8e-40e4-8f3c-eaca767a7c40
    type: regular
    task:
      id: 12bff9a6-df8e-40e4-8f3c-eaca767a7c40
      version: -1
      name: Search for SSO being disabled for a domain
      description: Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
      script: '|||o365-auditlog-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      end_date: {}
      free_text:
        simple: Disable Desktop SSO for a specific domain
      ip_addresses: {}
      operations: {}
      record_type:
        simple: AzureActiveDirectory
      result_size: {}
      start_date: {}
      user_ids: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 2870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: a18788f3-0bf4-4372-8541-927a7b9936cf
    type: regular
    task:
      id: a18788f3-0bf4-4372-8541-927a7b9936cf
      version: -1
      name: Search for domain federation settings modified
      description: Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
      script: '|||o365-auditlog-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      end_date: {}
      free_text: {}
      ip_addresses: {}
      operations:
        simple: Set domain authentication,Set federation settings on domain
      record_type:
        simple: AzureActiveDirectory
      result_size: {}
      start_date: {}
      user_ids: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 3070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: 841b04e8-ecab-460f-898d-54710a044b8a
    type: regular
    task:
      id: 841b04e8-ecab-460f-898d-54710a044b8a
      version: -1
      name: Search whether mail permissions were added to a service principal
      description: Use the o365-search-auditlog command to search the unified audit log. This log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Entra ID, Microsoft Teams, Power BI, and other Microsoft 365 services. You can search for all events in a specified date range, or you can filter the results based on specific criteria, such as the action, the user who performed the action, or the target object.
      script: '|||o365-auditlog-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      end_date: {}
      free_text:
        simple: Add app role assignment to service principal,Add delegated permission grant,Add application
      ip_addresses: {}
      operations: {}
      record_type:
        simple: AzureActiveDirectory
      result_size: {}
      start_date: {}
      user_ids: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 3260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: 8e96920a-4cd6-490f-8974-8d57e7ec0762
    type: regular
    task:
      id: 8e96920a-4cd6-490f-8974-8d57e7ec0762
      version: -1
      name: Set added mail permissions to a service principal
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      append: {}
      key:
        simple: MailPermissionsAdded
      stringify: {}
      value:
        complex:
          root: O365AuditLog
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: O365AuditLog.ModifiedProperties.NewValue
                iscontext: true
              right:
                value:
                  simple: Mail.Read
            - operator: containsGeneral
              left:
                value:
                  simple: O365AuditLog.ModifiedProperties.NewValue
                iscontext: true
              right:
                value:
                  simple: Mail.ReadWrite
          - - operator: notContainsGeneral
              left:
                value:
                  simple: O365AuditLog.ModifiedProperties.OldValue
                iscontext: true
              right:
                value:
                  simple: Mail.Read
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 3640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "45":
    id: "45"
    taskid: 5ce1ba8d-8292-476c-8a58-70f3248c1296
    type: condition
    task:
      id: 5ce1ba8d-8292-476c-8a58-70f3248c1296
      version: -1
      name: Found mail permissions were added to a service principal?
      description: Checks for cases where mail permissions were added to a service principal.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: O365AuditLog
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: O365AuditLog.ModifiedProperties.NewValue
                      iscontext: true
                    right:
                      value:
                        simple: Mail.Read
                  - operator: isEqualString
                    left:
                      value:
                        simple: O365AuditLog.ModifiedProperties.NewValue
                      iscontext: true
                    right:
                      value:
                        simple: Mail.ReadWrite
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: O365AuditLog.ModifiedProperties.OldValue
                      iscontext: true
                    right:
                      value:
                        simple: Mail.Read
            iscontext: true
    view: |-
      {
        "position": {
          "x": 300,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "45_28_#default#": 0.19,
      "45_44_yes": 0.53
    },
    "paper": {
      "dimensions": {
        "height": 2045,
        "width": 1200,
        "x": 70,
        "y": 1830
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests
fromversion: 5.5.0
supportedModules:
- agentix
- xsiam