initial upload

splunk · Jan 8, 2025 · 4ca537c · 4ca537c
1 parent 7afa788
commit 4ca537c
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/...ets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.log b/...ets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.log
diff --git a/...ets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.yml b/...ets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.yml
@@ -0,0 +1,12 @@
+author: Steven Dick
+id: 722e396e-9e74-4516-882d-0fc94f5d2b33
+date: '2024-12-19'
+description: 'Sample of events when Sharepoint is searched for a sensitive term / or high rate of searching.'
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search.log
+sourcetypes:
+- o365:management:activity
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
+- https://attack.mitre.org/techniques/T1213/002/