[New Rule] Microsoft 365 - Site Collection Admin Added

[austinsonger]

Description

Identifies when a site collection administrator has been added.

Required Info

Target indexes

filebeat-*, logs-o365*

Platforms

Microsoft 365

Optional Info

Query

event.dataset:o365.audit and event.provider:(SharePoint or OneDrive) and event.category:web and 
event.action:SiteCollectionAdminAdded event.outcome:success

New fields required in ECS/data sources for this rule?

Related issues or PRs

False Positives

MITRE

ATTACK TACTIC Credential Access, Persistence

ATTACK TECHNIQUE Account Manipulation

References

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[austinsonger]

I'm just leaving a comment for activity.

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[austinsonger]

Just keeping it open.Just keeping it open.

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic[bot]]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.