- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Detect when a new Microsoft 365 teams app or bot is installed as a means of establishing persistence.
Monitor Microsoft 365 audit logs to look for events with an @evt.name
value of AppInstalled
, where the AddOnType
has a value of 1
OR 4
and a new @AddOnName
is observed.
According to Microsoft, the following values indicate the types of add-ons that exist:
1
- Indicates a bot.2
- Indicates a connector.3
- Indicates a tab.However, some add-ons use the value 4
for existing teams apps that could be potentially unapproved bots or applications that could be malicious.
{{@usr.email}}
intended to install {{@AddOnName}}
.{{@usr.email}}
is not responsible for installing {{@AddOnName}}
, investigate {{@usr.email}}
for anomalous activity. If necessary, initiate your company’s incident response (IR) process.Updated rule name and query to include bots.