A new Microsoft 365 application was installed

microsoft-365

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1136-create-account

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a new Microsoft 365 app is installed as a means of establishing persistence.

Strategy

Monitor Microsoft 365 audit logs to look for events with an @evt.name value of Add application. and event @evt.outcome of Success.

Triage and response

  1. Determine if the user {{@usr.email}} intended to install {{@ObjectId}}.
  2. If {{@usr.email}} is not responsible for installing {{@ObjectId}}, investigate {{@usr.email}} for anomalous activity. If necessary, initiate your company’s incident response (IR) process.