From bc53382319a6dad9462a0cfd6ba7b6aa04dd1884 Mon Sep 17 00:00:00 2001 From: Oliver Springer <9538543+JTweet@users.noreply.github.com> Date: Fri, 16 Jan 2026 20:46:42 +0100 Subject: [PATCH 1/2] Also detect the registration of new mobile authenticator apps --- detections/cloud/o365_new_mfa_method_registered.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml index 5e79df1abe..01675ea842 100644 --- a/detections/cloud/o365_new_mfa_method_registered.yml +++ b/detections/cloud/o365_new_mfa_method_registered.yml @@ -1,7 +1,7 @@ name: O365 New MFA Method Registered id: 4e12db1f-f7c7-486d-8152-a221cad6ac2b -version: 7 -date: '2025-05-02' +version: 8 +date: '2026-01-16' author: Mauricio Velazco, Splunk status: production type: TTP @@ -16,11 +16,11 @@ description: The following analytic detects the registration of a new Multi-Fact Immediate verification and remediation are required to secure the affected account. search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update user.\" | eval propertyName = mvindex('ModifiedProperties{}.Name', 0) - | search propertyName = StrongAuthenticationMethod + | search propertyName IN (\"StrongAuthenticationMethod\", \"StrongAuthenticationPhoneAppDetail\") | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0) | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) - | rex field=newvalue max_match=0 \"(?i)(?\\\"MethodType\\\")\" - | rex field=oldvalue max_match=0 \"(?i)(?\\\"MethodType\\\")\" + | rex field=newvalue max_match=0 \"(?i)(?\\\"MethodType|DeviceName\\\")\" + | rex field=oldvalue max_match=0 \"(?i)(?\\\"MethodType|DeviceName\\\")\" | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) | where count_new_method_type > count_old_method_type From ce5981d57c07f3ff308840f4f79e25c7df6e950b Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 19 Jan 2026 20:29:13 +0100 Subject: [PATCH 2/2] Update o365_new_mfa_method_registered.yml --- .../cloud/o365_new_mfa_method_registered.yml | 41 +++++++++++-------- 1 file changed, 24 insertions(+), 17 deletions(-) diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml index 01675ea842..3d9c8366fe 100644 --- a/detections/cloud/o365_new_mfa_method_registered.yml +++ b/detections/cloud/o365_new_mfa_method_registered.yml @@ -14,24 +14,31 @@ description: The following analytic detects the registration of a new Multi-Fact account. If confirmed malicious, the attacker could bypass existing security measures, solidify their access, and potentially escalate privileges or access sensitive data. Immediate verification and remediation are required to secure the affected account. -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update user.\" - | eval propertyName = mvindex('ModifiedProperties{}.Name', 0) - | search propertyName IN (\"StrongAuthenticationMethod\", \"StrongAuthenticationPhoneAppDetail\") - | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0) - | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) - | rex field=newvalue max_match=0 \"(?i)(?\\\"MethodType|DeviceName\\\")\" - | rex field=oldvalue max_match=0 \"(?i)(?\\\"MethodType|DeviceName\\\")\" - | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) - | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) - | where count_new_method_type > count_old_method_type - | fillnull - | stats earliest(_time) as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue vendor_account vendor_product dest signature src - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_new_mfa_method_registered_filter`" +search: | + `o365_management_activity` + Workload=AzureActiveDirectory + Operation="Update user." + | eval propertyName = mvindex('ModifiedProperties{}.Name', 0) + | search propertyName IN ("StrongAuthenticationMethod", "StrongAuthenticationPhoneAppDetail") + | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0) + | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) + | rex field=newvalue max_match=0 "(?i)(?MethodType|DeviceName)" + | rex field=oldvalue max_match=0 "(?i)(?MethodType|DeviceName)" + | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) + | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) + | where count_new_method_type > count_old_method_type + | fillnull + | stats earliest(_time) as firstTime + latest(_time) as lastTime + values(propertyName) as propertyName + by user newvalue oldvalue vendor_account + vendor_product dest signature src + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_new_mfa_method_registered_filter` how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. -known_false_positives: Users may register MFA methods legitimally, investigate and +known_false_positives: Users may register MFA methods legitimately, investigate and filter as needed. references: - https://attack.mitre.org/techniques/T1098/005/ @@ -72,7 +79,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method.log sourcetype: o365:management:activity source: o365