< Back to rules searchA new Microsoft 365 application was installed
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when a new Microsoft 365 app is installed as a means of establishing persistence.
Strategy
Monitor Microsoft 365 audit logs to look for events with an @evt.name
value of Add application.
and event @evt.outcome
of Success
.
Triage and response
- Determine if the user
{{@usr.email}}
intended to install {{@ObjectId}}
. - If
{{@usr.email}}
is not responsible for installing {{@ObjectId}}
, investigate {{@usr.email}}
for anomalous activity. If necessary, initiate your company’s incident response (IR) process.