Skip to content

Commit 3a52db2

Browse files
terrancedejesusterrancedejesus
authored
[Rule Tuning] M365 Impossible / Atypical Travel FN (#5267)
* [Rule Tuning] M365 Portal Login (Impossible Travel) Fixes #5239 * updated investigation header
1 parent 598e5c3 commit 3a52db2

File tree

2 files changed

+15
-19
lines changed

2 files changed

+15
-19
lines changed

‎rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/09/04"
33
integration = ["o365"]
44
maturity = "production"
5-
updated_date = "2025/09/08"
5+
updated_date = "2025/10/30"
66

77
[rule]
88
author = ["Elastic"]
@@ -23,10 +23,10 @@ from = "now-15m"
2323
index = ["logs-o365.audit-*"]
2424
language = "kuery"
2525
license = "Elastic License v2"
26-
name = "M365 Portal Login (Atypical Travel)"
26+
name = "M365 Identity Login from Atypical Travel Location"
2727
note = """## Triage and analysis
2828
29-
### Investigating M365 Portal Login (Atypical Travel)
29+
### Investigating M365 Identity Login from Atypical Travel Location
3030
3131
Microsoft 365 is a cloud-based suite offering productivity tools accessible from anywhere, making it crucial for business operations. Adversaries may exploit this by logging in from uncommon locations, potentially using VPNs to mask their origin. The detection rule identifies successful logins from atypical locations, flagging potential unauthorized access attempts by analyzing login events and user location patterns.
3232
@@ -37,7 +37,7 @@ Microsoft 365 is a cloud-based suite offering productivity tools accessible from
3737
- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
3838
- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
3939
- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
40-
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns.
40+
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns. These could also indicate mobile and endpoint logins causing false-positives.
4141
4242
### False positive analysis
4343
@@ -50,14 +50,15 @@ Microsoft 365 is a cloud-based suite offering productivity tools accessible from
5050
- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
5151
- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
5252
- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
53+
- Consider adding exceptions to this rule for the user or source application ID if the login attempts are determined to be legitimate and not a security concern.
5354
"""
5455
references = ["https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-"]
5556
risk_score = 47
5657
rule_id = "32d3ad0e-6add-11ef-8c7b-f661ea17fbcc"
5758
severity = "medium"
5859
tags = [
5960
"Domain: Cloud",
60-
"Domain: SaaS",
61+
"Domain: Identity",
6162
"Data Source: Microsoft 365",
6263
"Data Source: Microsoft 365 Audit Logs",
6364
"Use Case: Threat Detection",
@@ -76,10 +77,7 @@ event.dataset:o365.audit and
7677
o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
7778
o365.audit.UserId:(* and not "Not Available") and
7879
source.geo.region_iso_code:* and
79-
o365.audit.Target.ID:(
80-
00000006-0000-0ff1-ce00-000000000000 or
81-
4765445b-32c6-49b0-83e6-1d93765276ca
82-
) and not o365.audit.ApplicationId:(
80+
not o365.audit.ApplicationId:(
8381
29d9ed98-a469-4536-ade2-f981bc1d605e or
8482
38aa3b87-a06d-4817-b275-7a316988d93b or
8583
a809996b-059e-42e2-9866-db24b99a9782

‎rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/09/04"
33
integration = ["o365"]
44
maturity = "production"
5-
updated_date = "2025/09/08"
5+
updated_date = "2025/10/30"
66

77
[rule]
88
author = ["Elastic"]
@@ -22,10 +22,10 @@ from = "now-15m"
2222
index = ["logs-o365.audit-*"]
2323
language = "kuery"
2424
license = "Elastic License v2"
25-
name = "M365 Portal Login (Impossible Travel)"
25+
name = "M365 Identity Login from Impossible Travel Location"
2626
note = """## Triage and analysis
2727
28-
### Investigating M365 Portal Login (Impossible Travel)
28+
### Investigating M365 Identity Login from Impossible Travel Location
2929
3030
Microsoft 365's cloud-based services enable global access, but this can be exploited by adversaries logging in from disparate locations within short intervals, indicating potential account compromise. The detection rule identifies such anomalies by analyzing login events for rapid geographic shifts, flagging suspicious activity that may suggest unauthorized access attempts.
3131
@@ -36,7 +36,7 @@ Microsoft 365's cloud-based services enable global access, but this can be explo
3636
- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
3737
- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
3838
- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
39-
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns.
39+
- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns. These could also indicate mobile and endpoint logins causing false-positives.
4040
4141
### False positive analysis
4242
@@ -49,14 +49,15 @@ Microsoft 365's cloud-based services enable global access, but this can be explo
4949
- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
5050
- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
5151
- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
52+
- Consider adding exceptions to this rule for the user or source application ID if the login attempts are determined to be legitimate and not a security concern.
5253
"""
5354
references = ["https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-"]
5455
risk_score = 47
5556
rule_id = "3896d4c0-6ad1-11ef-8c7b-f661ea17fbcc"
5657
severity = "medium"
5758
tags = [
5859
"Domain: Cloud",
59-
"Domain: SaaS",
60+
"Domain: Identity",
6061
"Data Source: Microsoft 365",
6162
"Data Source: Microsoft 365 Audit Logs",
6263
"Use Case: Threat Detection",
@@ -74,11 +75,8 @@ event.dataset:o365.audit and
7475
event.outcome:success and
7576
o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
7677
o365.audit.UserId:(* and not "Not Available") and
77-
source.geo.country_name:* and
78-
o365.audit.Target.ID:(
79-
00000006-0000-0ff1-ce00-000000000000 or
80-
4765445b-32c6-49b0-83e6-1d93765276ca
81-
) and not o365.audit.ApplicationId:(
78+
source.geo.region_iso_code:* and
79+
not o365.audit.ApplicationId:(
8280
29d9ed98-a469-4536-ade2-f981bc1d605e or
8381
38aa3b87-a06d-4817-b275-7a316988d93b or
8482
a809996b-059e-42e2-9866-db24b99a9782

0 commit comments

Comments
 (0)