Hunt for TABL changes

Hunt Hypothesis

Adversaries may modify Tenant Allow/Block List (TABL) settings to bypass email filtering and exfiltrate data. SOC teams should proactively hunt for TABL changes in Azure Sentinel to identify potential exfiltration attempts and unauthorized access to sensitive communications.

KQL Query

CloudAppEvents
| where ActionType contains "TenantAllowBlockListItems"
| order by Timestamp desc

Analytic Rule Definition

id: bc2d8214-afb6-4876-b210-25b69325b9b2
name: Hunt for TABL changes
description: |
  This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365
description-detailed: |
  This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365
  Reference - https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  CloudAppEvents
  | where ActionType contains "TenantAllowBlockListItems"
  | order by Timestamp desc
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: DefenseEvasion
• Technique: T1562 — T1562

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/General/Hunt for TABL changes.yaml)

False Positive Guidance

• Scenario: Scheduled TABL Sync Job
  Description: A scheduled job runs to synchronize the TABL configuration with the on-premises Active Directory.
  Filter/Exclusion: tabl_change_type = "sync" AND source = "onpremises_sync"

• Scenario: Admin Manual TABL Update via PowerShell
  Description: An administrator manually updates the TABL using the Set-Tabl PowerShell cmdlet.
  Filter/Exclusion: user_agent = "PowerShell" AND action = "update" AND source = "admin_console"

• Scenario: TABL Changes via Microsoft 365 Admin Center
  Description: An admin modifies the TABL settings through the Microsoft 365 Admin Center.
  Filter/Exclusion: source = "admin_center" AND action = "update"

• Scenario: TABL Configuration via Azure AD Connect
  Description: The TABL is configured or updated through Azure AD Connect during directory synchronization.
  Filter/Exclusion: source = "azure_ad_connect" AND action = "sync"

• Scenario: TABL Changes via API Integration
  Description: A third-party tool or internal system uses the Microsoft Graph API to update TABL settings.
  Filter/Exclusion: source = "graph_api" AND action = "update" AND user = "internal_tool_user"