Office 365: Suspicious download activity by user · rule 91724

Description

Office 365: Suspicious download activity by user: $(office_365.UserId)

Query · wazuh

if_matched_sid=91702 AND same_field frequency=100 timeframe=60

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Analyst notes

frequency=100; timeframe=60s; same_field

Raw source Office 365: Suspicious download activity by user · rule 91724 · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="91724" level="10" frequency="100" timeframe="60" ignore="30">
        <if_matched_sid>91702</if_matched_sid>
        <same_field>office_365.UserId</same_field>
        <description>Office 365: Suspicious download activity by user: $(office_365.UserId)</description>
        <options>no_full_log</options>
        <group>OneDrive,SharePoint</group>
        <mitre>
            <id>T1213.002</id>
        </mitre>
    </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.