M365 coverage

378 M365 detection rules across 6 vendors covering 167 (Workload, Operation) pairs. Each RecordType and Operation maps to a catalog entry under the Microsoft 365 Unified Audit Log catalog.

Attributed to a specific Unified Audit Log operation

200 rules that name a specific UAL Operation (resolved exactly, by RecordType, or by an operation contains/prefix match), mapped to that operation's catalog event.

AzureActiveDirectory 86 rules, 32 operations

*Add service principal* 1 rule

O365 Added Service Principal splunk (medium) T1136, T1136.003

*principal* 1 rule

O365 Added Service Principal splunk (medium) T1136, T1136.003

Add a partner to cross-tenant access setting. 1 rule

O365 Cross-Tenant Access Change splunk (medium) T1484, T1484.002

Add app role assignment grant to user. 1 rule

O365 Add App Role Assignment Grant User splunk (medium) T1136, T1136.003

Add app role assignment to service principal. 2 rules

O365 Admin Consent Bypassed by Service Principal splunk (medium) T1098, T1098.003
O365 Service Principal Privilege Escalation splunk (medium) T1098, T1098.003

Add application. 3 rules

O365 AD PowerShell App Login Subsequent Activity chronicle (medium) T1098, T1098.001
O365 Application Available To Other Tenants splunk (medium) T1098, T1098.003
O365 Entra ID Application Creation chronicle (low)

Add delegated permission grant. 1 rule

O365 AD PowerShell App Login Subsequent Activity chronicle (medium) T1098, T1098.001

Add eligible member to role. 2 rules

O365 Privileged Role Assigned splunk (medium) T1098, T1098.003
O365 Privileged Role Assigned To Service Principal splunk (medium) T1098, T1098.003

Add group. 2 rules

Hunt for Office 365 group creation failures chronicle (low)
Hunt for Office 365 group creation success chronicle (low)

Add member to group. 2 rules

Hunt for Office 365 group modification add member success chronicle (low)
Office 365 group modification add member success has exceeded a defined threshold chronicle (low)

Add member to role. 6 rules

M365 Identity Global Administrator Role Assigned elastic (medium) T1098, T1098.003
O365 Add User To Admin Role chronicle (medium) T1098, T1098.003
O365 High Privilege Role Granted splunk (medium) T1098, T1098.003
O365 Privileged Role Assigned splunk (medium) T1098, T1098.003
O365 Privileged Role Assigned To Service Principal splunk (medium) T1098, T1098.003
O365 Recently Created Entra ID User Assigned Roles chronicle (medium) T1098, T1098.003

Add owner to application. 1 rule

O365 Application Registration Owner Added splunk (medium) T1098

Add registered users to device. 1 rule

M365 Identity OAuth Flow by User Sign-in to Device Registration elastic (high) T1098, T1098.005, T1528, T1566, T1566.002

Add service principal. 2 rules

O365 Multiple Service Principals Created by SP splunk (low) T1136, T1136.003
O365 Multiple Service Principals Created by User splunk (low) T1136, T1136.003

Add user* 1 rule

O365 External Guest User Invited splunk (medium) T1136, T1136.003

Add user. 1 rule

O365 Recently Created Entra ID User Assigned Roles chronicle (medium) T1098, T1098.003

Change user license. 1 rule

O365 Advanced Audit Disabled splunk (medium) T1685, T1685.002

Consent to application. 5 rules

M365 Identity OAuth Illicit Consent Grant by Rare Client and User elastic (medium) T1098, T1528, T1566, T1566.002
O365 File Permissioned Application Consent Granted by User splunk (medium) T1528
O365 Mail Permissioned Application Consent Granted by User splunk (medium) T1528
O365 Tenant Wide Admin Consent Granted splunk (medium) T1098, T1098.003
O365 User Consent Blocked for Risky Application splunk (medium) T1528

Delete group. 1 rule

Office 365 group deletion success chronicle (low)

Delete partner specific cross-tenant access setting. 1 rule

O365 Cross-Tenant Access Change splunk (medium) T1484, T1484.002

Disable Strong Authentication. 2 rules

Disabling Multi Factor Authentication sigma (high) T1556, T1556.006
O365 Disable MFA splunk (medium) T1556

PasswordLogonInitialAuthUsingPassword 2 rules

M365 Identity User Account Lockouts elastic (medium) T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004
M365 Identity User Brute Force Attempted elastic (medium) T1110, T1110.001, T1110.003, T1110.004

Remove member from group. 1 rule

Hunt for Office 365 group modification remove member success chronicle (low)

Set Company Information. 1 rule

O365 Bypass MFA via Trusted IP splunk (medium) T1686, T1686.001

Update application – Certificates and secrets management 2 rules

O365 AD PowerShell App Login Subsequent Activity chronicle (medium) T1098, T1098.001
O365 Entra ID App Client Secret Added, Updated or Deleted chronicle (medium) T1098, T1098.001

Update application*Certificates and secrets management 1 rule

O365 Service Principal New Client Credentials splunk (medium) T1098, T1098.001

Update application. 8 rules

O365 AD PowerShell App Login Subsequent Activity chronicle (medium) T1098, T1098.001
O365 Application Available To Other Tenants splunk (medium) T1098, T1098.003
O365 Entra ID App Modify Permission Change On Watchlist chronicle (medium)
O365 Entra ID App Permissions Percent Threshold Exceeded chronicle (medium)
O365 Entra ID App Permissions Threshold Exceeded chronicle (medium)
O365 FullAccessAsApp Permission Assigned splunk (medium) T1098, T1098.002, T1098.003
O365 Mailbox Read Access Granted to Application splunk (medium) T1098, T1098.003, T1114, T1114.002
O365 Privileged Graph API Permission Assigned splunk (medium) T1003, T1003.002

Update authorization policy. 1 rule

O365 Block User Consent For Risky Apps Disabled splunk (medium) T1685

Update policy. 2 rules

Entra ID conditional access policy modification chronicle (low) T1484
O365 External Identity Policy Changed splunk (medium) T1136, T1136.003

Update user. 2 rules

Microsoft365 MFA Disabled panther (low) T1556
O365 New MFA Method Registered splunk (medium) T1098, T1098.005

UserLoggedIn 17 rules

Azure Login Bypassing Conditional Access Policies sigma (high) T1078
Hunt for suspicious sign-in to Entra ID Using Extrnal Call Method chronicle (medium)
M365 Identity Login from Atypical Region elastic (medium) T1078, T1078.004
M365 Identity Login from Impossible Travel Location elastic (medium) T1078, T1078.004
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs elastic (high) T1078, T1078.004, T1528, T1550, T1550.001, T1566
M365 Identity OAuth Flow by User Sign-in to Device Registration elastic (high) T1098, T1098.005, T1528, T1566, T1566.002
M365 Identity OAuth Phishing via First-Party Microsoft Application elastic (high) T1078, T1078.004, T1566, T1566.002
M365 Identity OAuth ROPC Grant via Legacy Authentication Client elastic (medium) T1078, T1078.004
M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA) elastic (high) T1539, T1566
O365 AD PowerShell App Login Subsequent Activity chronicle (medium) T1098, T1098.001
O365 Admin Login Activity To Uncommon Microsoft Cloud Apps chronicle (high) T1078, T1078.004
O365 Concurrent Sessions From Different Ips splunk (medium) T1185
O365 Login Activity To Azure AD PowerShell App chronicle (medium) T1078, T1078.004
O365 Login Activity To Uncommon Microsoft Cloud Apps chronicle (medium) T1078, T1078.004
O365 Multiple AppIDs and UserAgents Authentication Spike splunk (low) T1078
O365 Multiple OS Vendors Authenticating From User splunk (medium) T1110
O365 Persistent Login Activity To Azure AD PowerShell App chronicle (medium) T1021, T1021.007

UserLoginFailed 11 rules

High Number of Login Failures from a single source splunk (low) T1110, T1110.001
M365 Identity User Account Lockouts elastic (medium) T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004
M365 Identity User Brute Force Attempted elastic (medium) T1110, T1110.001, T1110.003, T1110.004
Microsoft365 Brute Force Login by User panther (medium) T1110
O365 Excessive SSO logon errors splunk (low) T1556
O365 High Number Of Failed Authentications for User splunk (medium) T1110, T1110.001
O365 Multi-Source Failed Authentications Spike splunk T1110, T1110.003, T1110.004, T1586, T1586.003
O365 Multiple AppIDs and UserAgents Authentication Spike splunk (low) T1078
O365 Multiple Failed MFA Requests For User splunk (medium) T1621
O365 Multiple OS Vendors Authenticating From User splunk (medium) T1110
O365 Multiple Users Failing To Authenticate From Ip splunk (medium) T1110, T1110.003, T1110.004, T1586, T1586.003

Exchange 130 rules, 57 operations

*AntiPhish* 1 rule

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002

*Malware* 1 rule

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002

*SafeAttachment* 1 rule

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002

*SafeLink* 1 rule

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002

*TransportRule 1 rule

O365 Email Transport Rule Changed splunk (low) T1114, T1114.003, T1564, T1564.008

Add-FederatedDomain 2 rules

M365 Exchange Federated Domain Created or Modified elastic (low) T1484, T1484.002
New Federated Domain Added - Exchange sigma (medium) T1136, T1136.003

Add-MailboxFolderPermission 3 rules

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
O365 Mailbox Folder Read Permission Granted splunk (medium) T1098, T1098.002
Rare and potentially high-risk Office operations kusto (low) T1098, T1114

Add-MailboxPermission 5 rules

Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt kusto (medium) T1078, T1548
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
M365 Exchange Mailbox High-Risk Permission Delegated elastic (low) T1098, T1098.002
O365 Elevated Mailbox Permission Assigned splunk (medium) T1098, T1098.002
Rare and potentially high-risk Office operations kusto (low) T1098, T1114

Add-RecipientPermission 1 rule

M365 Exchange Mailbox High-Risk Permission Delegated elastic (low) T1098, T1098.002

AddFolderPermissions 1 rule

O365 Mailbox Folder Read Permission Assigned splunk (medium) T1098, T1098.002

Disable-* 2 rules

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002
O365 Email Transport Rule Changed splunk (low) T1114, T1114.003, T1564, T1564.008

Disable-AntiPhishRule 2 rules

M365 Exchange Anti-Phish Rule Modification elastic (medium) T1685
Office Policy Tampering kusto (medium) T1098, T1685

Disable-MalwareFilterRule 1 rule

M365 Exchange Malware Filter Rule Modified elastic (medium) T1484, T1685

Disable-SafeAttachmentRule 2 rules

M365 Exchange Email Safe Attachment Rule Disabled elastic (low) T1685
Office Policy Tampering kusto (medium) T1098, T1685

Disable-SafeLinksRule 2 rules

M365 Exchange Email Safe Link Policy Disabled elastic (medium) T1484, T1685
Office Policy Tampering kusto (medium) T1098, T1685

Disable-TransportRule 1 rule

M365 Exchange Mail Flow Transport Rule Modified elastic (medium) T1537, T1685

DlpRuleMatch 1 rule

O365 DLP Rule Triggered splunk (low) T1048, T1567

HardDelete 6 rules

M365 Exchange MFA Notification Email Deleted or Moved elastic (low) T1070, T1070.008, T1098, T1098.005
O365 Email Hard Delete Excessive Volume splunk (low) T1070, T1070.008, T1485
O365 Email Password and Payroll Compromise Behavior splunk (medium) T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Receive and Hard Delete Takeover Behavior splunk (low) T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Exfiltration Behavior splunk (low) T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior splunk (low) T1070, T1070.008, T1114, T1114.001, T1485

MailItemsAccessed 8 rules

Exchange workflow MailItemsAccessed operation anomaly kusto (medium) T1114
M365 Exchange Mailbox Accessed by Unusual Client elastic (medium) T1114, T1114.002
M365 Exchange Mailbox Items Accessed Excessively elastic (medium) T1114, T1114.002
M365 or Entra ID Identity Sign-in from a Suspicious Source elastic (high) T1078
O365 Multiple Mailboxes Accessed via API splunk (medium) T1114, T1114.002
O365 OAuth App Mailbox Access via EWS splunk (medium) T1114, T1114.002
O365 OAuth App Mailbox Access via Graph API splunk (medium) T1114, T1114.002
Office 365 mail accessed via unexpected application chronicle (medium)

ModifyFolderPermissions 2 rules

O365 Mailbox Folder Read Permission Assigned splunk (medium) T1098, T1098.002
O365 Mailbox Inbox Folder Shared with All Users splunk (medium) T1114, T1114.002

MoveToDeletedItems 1 rule

M365 Exchange MFA Notification Email Deleted or Moved elastic (low) T1070, T1070.008, T1098, T1098.005

New-* 2 rules

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002
O365 Email Transport Rule Changed splunk (low) T1114, T1114.003, T1564, T1564.008

New-AcceptedDomain 1 rule

M365 Exchange Federated Domain Created or Modified elastic (low) T1484, T1484.002

New-InboxRule 12 rules

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
Inbox Rules Creation Or Update Activity in O365 sigma (medium) T1114, T1114.003, T1564, T1564.008
M365 Exchange Inbox Forwarding Rule Created elastic (medium) T1114, T1114.003
M365 Exchange Inbox Phishing Evasion Rule Created elastic (high) T1137, T1137.005, T1564, T1564.008
M365 Exchange Inbox Rule with Obfuscated Name elastic (medium) T1137, T1137.005, T1564, T1564.008
Mail Forwarding/Redirecting Activity In O365 sigma (medium) T1020, T1114, T1114.003, T1564, T1564.008
Malicious BEC Inbox Rule kusto (medium) T1078, T1098
Malicious Inbox Rule kusto (medium) T1078, T1098
O365 BEC Email Hiding Rule Created splunk (medium) T1564, T1564.008
O365 Email New Inbox Rule Created splunk (low) T1114, T1114.003, T1564, T1564.008
O365 New Email Forwarding Rule Created splunk (medium) T1114, T1114.003
Rare and potentially high-risk Office operations kusto (low) T1098, T1114

New-ManagementRoleAssignment 4 rules

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
M365 Exchange Management Group Role Assigned elastic (medium) T1098, T1098.003
O365 ApplicationImpersonation Role Assigned splunk (medium) T1098, T1098.002
Rare and potentially high-risk Office operations kusto (low) T1098, T1114

New-TransportRule 5 rules

M365 Exchange Inbox Forwarding Rule Created elastic (medium) T1114, T1114.003
M365 Exchange Mail Flow Transport Rule Created elastic (medium) T1114, T1114.003, T1537
Mail redirect via ExO transport rule kusto (medium) T1020, T1114
O365 New Forwarding Mailflow Rule Created splunk (medium) T1114
Threat Essentials - Mail redirect via ExO transport rule kusto (medium) T1020, T1114

PasswordLogonInitialAuthUsingPassword 2 rules

M365 Identity User Account Lockouts elastic (medium) T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004
M365 Identity User Brute Force Attempted elastic (medium) T1110, T1110.001, T1110.003, T1110.004

Remove-* 2 rules

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002
O365 Email Transport Rule Changed splunk (low) T1114, T1114.003, T1564, T1564.008

Remove-AcceptedDomain 1 rule

M365 Exchange Federated Domain Created or Modified elastic (low) T1484, T1484.002

Remove-AntiPhishPolicy 2 rules

M365 Exchange Anti-Phish Policy Deleted elastic (medium) T1484, T1685
Office Policy Tampering kusto (medium) T1098, T1685

Remove-AntiPhishRule 2 rules

M365 Exchange Anti-Phish Rule Modification elastic (medium) T1685
Office Policy Tampering kusto (medium) T1098, T1685

Remove-DlpPolicy 2 rules

Deprecated - M365 Exchange DLP Policy Deleted elastic (medium) T1685
Office Policy Tampering kusto (medium) T1098, T1685

Remove-FederatedDomain 1 rule

M365 Exchange Federated Domain Created or Modified elastic (low) T1484, T1484.002

Remove-MalwareFilterPolicy 1 rule

M365 Exchange Malware Filter Policy Deleted elastic (medium) T1685

Remove-MalwareFilterRule 1 rule

M365 Exchange Malware Filter Rule Modified elastic (medium) T1484, T1685

Remove-SafeAttachmentPolicy 1 rule

Office Policy Tampering kusto (medium) T1098, T1685

Remove-SafeAttachmentRule 1 rule

Office Policy Tampering kusto (medium) T1098, T1685

Remove-SafeLinksPolicy 1 rule

Office Policy Tampering kusto (medium) T1098, T1685

Remove-TransportRule 1 rule

M365 Exchange Mail Flow Transport Rule Modified elastic (medium) T1537, T1685

SearchQueryInitiatedExchange 1 rule

O365 Email Suspicious Search Behavior splunk (low) T1114, T1114.002, T1552

Send 1 rule

O365 Email Send Attachments Excessive Volume splunk (low) T1070, T1070.008, T1485

Send* 2 rules

O365 Email Send and Hard Delete Exfiltration Behavior splunk (low) T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior splunk (low) T1070, T1070.008, T1114, T1114.001, T1485

SendAs 1 rule

O365 Email Send Attachments Excessive Volume splunk (low) T1070, T1070.008, T1485

SendOnBehalf 1 rule

O365 Email Send Attachments Excessive Volume splunk (low) T1070, T1070.008, T1485

Set-* 2 rules

O365 Email Security Feature Changed splunk (medium) T1685, T1685.002
O365 Email Transport Rule Changed splunk (low) T1114, T1114.003, T1564, T1564.008

Set-AcceptedDomain 1 rule

M365 Exchange Federated Domain Created or Modified elastic (low) T1484, T1484.002

Set-AdminAuditLogConfig 3 rules

Exchange AuditLog Disabled kusto (medium) T1685
Office 365 logging has been enabled chronicle (critical) T1685, T1685.002
Office 365 logging is disabled chronicle (critical) T1685, T1685.002

Set-DkimSigningConfig 1 rule

M365 Exchange DKIM Signing Configuration Disabled elastic (medium) T1484, T1685

Set-InboxRule 10 rules

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
Inbox Rules Creation Or Update Activity in O365 sigma (medium) T1114, T1114.003, T1564, T1564.008
M365 Exchange Inbox Forwarding Rule Created elastic (medium) T1114, T1114.003
M365 Exchange Inbox Phishing Evasion Rule Created elastic (high) T1137, T1137.005, T1564, T1564.008
M365 Exchange Inbox Rule with Obfuscated Name elastic (medium) T1137, T1137.005, T1564, T1564.008
Mail Forwarding/Redirecting Activity In O365 sigma (medium) T1020, T1114, T1114.003, T1564, T1564.008
O365 BEC Email Hiding Rule Created splunk (medium) T1564, T1564.008
O365 Email New Inbox Rule Created splunk (low) T1114, T1114.003, T1564, T1564.008
O365 New Email Forwarding Rule Created splunk (medium) T1114, T1114.003
Rare and potentially high-risk Office operations kusto (low) T1098, T1114

Set-Mailbox 6 rules

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
M365 Exchange Inbox Forwarding Rule Created elastic (medium) T1114, T1114.003
M365 Exchange Mailbox High-Risk Permission Delegated elastic (low) T1098, T1098.002
Mail Forwarding/Redirecting Activity In O365 sigma (medium) T1020, T1114, T1114.003, T1564, T1564.008
O365 Mailbox Email Forwarding Enabled splunk (medium) T1114, T1114.003
Rare and potentially high-risk Office operations kusto (low) T1098, T1114

Set-MailboxAuditBypassAssociation 1 rule

M365 Exchange Mailbox Audit Logging Bypass Added elastic (medium) T1098, T1685

Set-MailboxFolderPermission 1 rule

O365 Mailbox Folder Read Permission Granted splunk (medium) T1098, T1098.002

Set-MsolDomainFederationSettings 1 rule

M365 Exchange Federated Domain Created or Modified elastic (low) T1484, T1484.002

Set-TransportRule 5 rules

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account kusto (medium) T1078, T1098, T1114
M365 Exchange Inbox Forwarding Rule Created elastic (medium) T1114, T1114.003
Mail redirect via ExO transport rule kusto (medium) T1020, T1114
Rare and potentially high-risk Office operations kusto (low) T1098, T1114
Threat Essentials - Mail redirect via ExO transport rule kusto (medium) T1020, T1114

SoftDelete 2 rules

M365 Exchange MFA Notification Email Deleted or Moved elastic (low) T1070, T1070.008, T1098, T1098.005
O365 Email Password and Payroll Compromise Behavior splunk (medium) T1070, T1070.008, T1114, T1114.001, T1485

UpdateInboxRules 2 rules

Mail Forwarding/Redirecting Activity In O365 sigma (medium) T1020, T1114, T1114.003, T1564, T1564.008
O365 New Email Forwarding Rule Enabled splunk (medium) T1114, T1114.003

UserLoginFailed 2 rules

M365 Identity User Account Lockouts elastic (medium) T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004
M365 Identity User Brute Force Attempted elastic (medium) T1110, T1110.001, T1110.003, T1110.004

Microsoft Teams 1 rule, 1 operation

TeamsAdminAction 1 rule

Anomalous login followed by Teams action kusto (medium) T1078, T1098, T1136, T1199

MicrosoftTeams 14 rules, 9 operations

ChatCreated 1 rule

M365 Teams Rogue Help Desk Chat Created elastic (high) T1566, T1566.003

FileAccessed 1 rule

Accessed files shared by temporary external user kusto (low) T1566

FileUploaded 1 rule

Accessed files shared by temporary external user kusto (low) T1566

MemberAdded 3 rules

Accessed files shared by temporary external user kusto (low) T1566
Anomalous login followed by Teams action kusto (medium) T1078, T1098, T1136, T1199
External user added and removed in short timeframe kusto (low) T1136

MemberRemoved 4 rules

Accessed files shared by temporary external user kusto (low) T1566
Anomalous login followed by Teams action kusto (medium) T1078, T1098, T1136, T1199
External user added and removed in short timeframe kusto (low) T1136
Office 365 Teams member removed chronicle (low)

Set-CsTeamsClientConfiguration 1 rule

Deprecated - M365 Teams Guest Access Enabled elastic (medium) T1098, T1484

Set-CsTenantFederationConfiguration 1 rule

Deprecated - M365 Teams External Access Enabled elastic (medium) T1484, T1685

TeamDeleted 1 rule

Multiple Teams deleted by a single user kusto (low) T1485, T1489

TeamsTenantSettingChanged 1 rule

M365 Teams Custom Application Interaction Enabled elastic (medium) T1484, T1685

OneDrive 14 rules, 8 operations

FileAccessed 1 rule

M365 SharePoint/OneDrive File Access via PowerShell elastic (high) T1059, T1059.001, T1213, T1213.002, T1530

FileDownloaded 4 rules

M365 OneDrive/SharePoint Excessive File Downloads elastic (medium) T1020, T1530, T1567
M365 SharePoint/OneDrive File Access via PowerShell elastic (high) T1059, T1059.001, T1213, T1213.002, T1530
Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020

FileMalwareDetected 1 rule

M365 OneDrive Malware File Upload elastic (high) T1080, T1608, T1608.001

FileSyncDownloadedFull 2 rules

Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020

FileSyncUploadedFull 2 rules

Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020

FileUploaded 2 rules

Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020

SharingPolicyChanged 1 rule

M365 SharePoint Site Sharing Policy Weakened elastic (medium) T1484, T1685

SiteCollectionAdminAdded 1 rule

M365 SharePoint Site Administrator Added elastic (medium) T1098, T1098.003

Power Apps 1 rule, 1 operation

AdminDeleteApp 1 rule

Power Apps - App activity from unauthorized geo kusto (low) T1078

Power Automate 2 rules, 2 operations

CreateFlow 1 rule

Power Automate - Departing employee flow activity kusto (high) T0813, T0826, T0879, T1485, T1491, T1567

DeleteFlow 1 rule

Power Automate - Unusual bulk deletion of flow resources kusto (medium) T0828, T1485, T1685

Power Platform 2 rules, 2 operations

GovernanceApiPolicyOperation 1 rule

Power Platform - DLP policy updated or removed kusto (low) T1480

PutConnection 1 rule

Power Platform - Connector added to a sensitive environment kusto (low) T0871, T1537, T1567

SecurityComplianceCenter 25 rules, 19 operations

Activity from anonymous IP addresses 1 rule

Activity from Anonymous IP Addresses sigma (medium) T1573

Activity from infrequent country 1 rule

Activity from Infrequent Country sigma (medium) T1573

Activity from suspicious IP addresses 1 rule

Activity from Suspicious IP Addresses sigma (medium) T1573

Activity performed by terminated user 1 rule

Activity Performed by Terminated User sigma (medium)

AdminMailAccess 1 rule

O365 Email Access By Security Administrator splunk (medium) T1114, T1114.002, T1567

AdminSubmission 1 rule

O365 Email Reported By Admin Found Malicious splunk (medium) T1566, T1566.001, T1566.002

AlertEntityGenerated 4 rules

O365 Email Reported By User Found Malicious splunk (medium) T1566, T1566.001, T1566.002
O365 Email Suspicious Behavior Alert splunk (medium) T1114, T1114.003
O365 Safe Links Detection splunk (medium) T1566, T1566.001
O365 ZAP Activity Detection splunk (low) T1566, T1566.001, T1566.002

AlertTriggered 2 rules

Deprecated - M365 Security Compliance Email Reported by User as Malware or Phish elastic (medium) T1566, T1566.001, T1566.002
O365 Security And Compliance Alert Triggered splunk (medium) T1078, T1078.004

Data exfiltration to unsanctioned apps 1 rule

Data Exfiltration to Unsanctioned Apps sigma (medium) T1537

eDiscovery search started or exported 1 rule

PST Export Alert Using eDiscovery Alert sigma (medium) T1114

Impossible travel activity 1 rule

Microsoft 365 - Impossible Travel Activity sigma (medium) T1078

Log on from a risky IP address 1 rule

Logon from a Risky IP Address sigma (medium) T1078

Potential ransomware activity 1 rule

Microsoft 365 - Potential Ransomware Activity sigma (medium) T1486

SearchCreated 1 rule

O365 Compliance Content Search Started splunk (medium) T1114, T1114.002

SearchExported 1 rule

O365 Compliance Content Search Exported splunk (medium) T1114, T1114.002

Suspicious inbox forwarding 1 rule

Suspicious Inbox Forwarding sigma (low) T1020

Suspicious OAuth app file download activities 1 rule

Suspicious OAuth App File Download Activities sigma (medium)

Unusual volume of file deletion 2 rules

Deprecated - M365 Security Compliance Unusual Volume of File Deletion elastic (medium) T1485
Microsoft 365 - Unusual Volume of File Deletion sigma (medium) T1485

User restricted from sending email 2 rules

Deprecated - M365 Security Compliance User Restricted from Sending Email elastic (medium)
Microsoft 365 - User Restricted from Sending Email sigma (medium) T1199

SharePoint 38 rules, 14 operations

AnonymousLinkCreated 2 rules

Microsoft365 External Document Sharing panther (low) T1039
O365 OneDrive Anonymous Link Created or Updated chronicle (medium)

AnonymousLinkUpdated 1 rule

O365 OneDrive Anonymous Link Created or Updated chronicle (medium)

AnonymousLinkUsed 1 rule

O365 OneDrive Anonymous Link Accessed chronicle (medium) T1048, T1048.002

DlpRuleMatch 1 rule

O365 DLP Rule Triggered splunk (low) T1048, T1567

FileAccessed 3 rules

M365 SharePoint/OneDrive File Access via PowerShell elastic (high) T1059, T1059.001, T1213, T1213.002, T1530
O365 Exfiltration via File Access splunk (low) T1530, T1567
O365 OneDrive Anonymous File Accessed chronicle (medium) T1048, T1048.002

FileDownloaded 9 rules

Dataverse - Mass download from SharePoint document management kusto (low) T1567
Hunt for Non-Anonymous Office 365 file downloads chronicle (low) T1048, T1048.002
M365 SharePoint/OneDrive File Access via PowerShell elastic (high) T1059, T1059.001, T1213, T1213.002, T1530
O365 Exfiltration via File Download splunk (low) T1530, T1567
O365 OneDrive Anonymous File Downloaded chronicle (medium) T1048, T1048.002
Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020
SharePointFileOperation via devices with previously unseen user agents kusto (medium) T1030
SharePointFileOperation via previously unseen IPs kusto (medium) T1030

FileMalwareDetected 3 rules

Dataverse - Malware found in SharePoint document management site kusto (medium) T1204
M365 SharePoint Malware File Detected elastic (high) T1080, T1608, T1608.001
O365 SharePoint Malware Detection splunk (medium) T1204, T1204.002

FileSyncDownloadedFull 2 rules

Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020

FileSyncUploadedFull 2 rules

Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020

FileUploaded 7 rules

Dataverse - Executable uploaded to SharePoint document management site kusto (low) T0863, T0873
Dataverse - Malware found in SharePoint document management site kusto (medium) T1204
New executable via Office FileUploaded Operation kusto (low) T1105, T1570
Office365 Sharepoint File transfer above threshold kusto (medium) T1020
Office365 Sharepoint File transfer Folders above threshold kusto (medium) T1020
SharePointFileOperation via devices with previously unseen user agents kusto (medium) T1030
SharePointFileOperation via previously unseen IPs kusto (medium) T1030

SearchQueryInitiatedSharepoint 1 rule

O365 SharePoint Suspicious Search Behavior splunk (low) T1213, T1213.002, T1552

SearchQueryPerformed 3 rules

M365 SharePoint Search for Sensitive Content elastic (low) T1213, T1213.002, T1530, T1619
O365 Email Suspicious Search Behavior splunk (low) T1114, T1114.002, T1552
O365 SharePoint Suspicious Search Behavior splunk (low) T1213, T1213.002, T1552

SharingPolicyChanged 2 rules

M365 SharePoint Site Sharing Policy Weakened elastic (medium) T1484, T1685
O365 SharePoint Allowed Domains Policy Changed splunk (medium) T1136, T1136.003

SiteCollectionAdminAdded 1 rule

M365 SharePoint Site Administrator Added elastic (medium) T1098, T1098.003

SkypeForBusiness 2 rules, 2 operations

Set-CsTeamsClientConfiguration 1 rule

Deprecated - M365 Teams Guest Access Enabled elastic (medium) T1098, T1484

Set-CsTenantFederationConfiguration 1 rule

Deprecated - M365 Teams External Access Enabled elastic (medium) T1484, T1685

ThreatIntelligence 3 rules, 2 operations

AtpDetection 1 rule

O365 Threat Intelligence Suspicious File Detected splunk (medium) T1204, T1204.002

TIMailData 2 rules

O365 Threat Intelligence Suspicious Email Delivered splunk (low) T1566, T1566.001, T1566.002
Suspicious Email Delivered In Microsoft 365 sigma (medium) T1566, T1566.001, T1566.002

Attributed to a workload, not a specific operation

54 rules that name a Workload or RecordType but no single Operation, mapped to that RecordType's catch-all event.

AzureActiveDirectory 5 rules, 1 operation

(any) 5 rules

M365 Entra ID Risk Detection Signal elastic (low) T1078, T1078.004, T1110, T1110.003
M365 Identity Unusual SSO Authentication Errors for User elastic (medium) T1078, T1078.004, T1528, T1566, T1606, T1606.002
Malformed user agent kusto (medium) T1071, T1189, T1203
Multiple Password Reset by user kusto (low) T1078, T1110
O365 Excessive Authentication Failures Alert splunk (low) T1110

Dynamics 365 / Dataverse 29 rules, 1 operation

(any) 29 rules

Dataverse - Anomalous application user activity kusto (medium) T0834, T0859, T0871, T1528, T1569
Dataverse - Audit log data deletion kusto (low) T1070
Dataverse - Audit logging disabled kusto (low) T1685
Dataverse - Bulk record ownership re-assignment or sharing kusto (medium) T1548
Dataverse - Export activity from terminated or notified employee kusto (medium) T1048, T1567
Dataverse - Hierarchy security manipulation kusto (medium) T1078, T1548
Dataverse - Honeypot instance activity kusto (medium) T1526, T1538, T1567
Dataverse - Login by a sensitive privileged user kusto (high) T1078, T1133, T1190, T1212
Dataverse - Login from IP in the block list kusto (high) T1078, T1133, T1190
Dataverse - Login from IP not in the allow list kusto (high) T1078, T1133, T1190
Dataverse - Mass deletion of records kusto (medium) T1485
Dataverse - Mass export of records to Excel kusto (low) T1567
Dataverse - Mass record updates kusto (medium) T1485, T1565, T1641
Dataverse - New Dataverse application user activity type kusto (medium) T0871, T1078, T1635
Dataverse - New non-interactive identity granted access kusto (informational) T0859, T1078, T1098
Dataverse - New sign-in from an unauthorized domain kusto (medium) T1078, T1133, T1190
Dataverse - New user agent type that was not used before kusto (low) T0819, T0866, T1036, T1078
Dataverse - New user agent type that was not used with Office 365 kusto (low) T1133, T1190
Dataverse - Organization settings modified kusto (informational) T1078
Dataverse - Removal of blocked file extensions kusto (medium) T1629
Dataverse - SharePoint document management site added or updated kusto (informational) T1537, T1567
Dataverse - Suspicious security role modifications kusto (medium) T1404, T1548, T1626
Dataverse - Suspicious use of TDS endpoint kusto (low) T1048, T1190
Dataverse - Suspicious use of Web API kusto (medium) T1106, T1526, T1567, T1580, T1595
Dataverse - Terminated employee exfiltration to USB drive kusto (high) T1052
Dataverse - TI map IP to DataverseActivity kusto (medium) T0859, T0886, T1021, T1078, T1133, T1199
Dataverse - TI map URL to DataverseActivity kusto (medium) T0819, T0862, T0863, T0865, T0873, T1204
Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection kusto (medium) T1629
Dataverse - User bulk retrieval outside normal activity kusto (low) T1048

Exchange 7 rules, 1 operation

(any) 7 rules

M365 Purview DLP Signal elastic (low) T1005, T1114, T1530, T1567, T1567.002
M365 Purview Insider Risk Signal elastic (low)
M365 Quarantine and Hygiene Signal elastic (low) T1566, T1566.001, T1566.002
M365 Threat Intelligence Signal elastic (low) T1204, T1204.001, T1204.002, T1566, T1566.001, T1566.002
Multiple users email forwarded to same destination kusto (medium) T1020, T1114
NRT Malicious Inbox Rule kusto (medium) T1078, T1098
NRT Multiple users email forwarded to same destination kusto (medium) T1020, T1114

Power Apps 2 rules, 1 operation

(any) 2 rules

Power Apps - App activity from unauthorized geo kusto (low) T1078
Power Apps - Multiple users access a malicious link after launching new app kusto (high) T1189, T1566

Power Automate 1 rule, 1 operation

(any) 1 rule

Power Automate - Departing employee flow activity kusto (high) T0813, T0826, T0879, T1485, T1491, T1567

Power Platform 4 rules, 1 operation

(any) 4 rules

Dataverse - Guest user exfiltration following Power Platform defense impairment kusto (high) T1567, T1629
Power Apps - App activity from unauthorized geo kusto (low) T1078
Power Apps - Bulk sharing of Power Apps to newly created guest users kusto (medium) T1534, T1566, T1587
Power Apps - Multiple apps deleted kusto (medium) T0826, T1485

SecurityComplianceCenter 9 rules, 1 operation

(any) 9 rules

Deprecated - M365 Security Compliance Potential Ransomware Activity elastic (medium) T1486, T1565, T1565.001
M365 AIR Investigation Signal elastic (low) T1204, T1566
M365 Defender Alerts Signal (UAL) elastic (medium)
M365 Purview DLP Signal elastic (low) T1005, T1114, T1530, T1567, T1567.002
M365 Purview Insider Risk Signal elastic (low)
M365 Purview Security Compliance Signal elastic (low)
M365 Security Compliance Admin Signal elastic (low) T1059, T1059.001, T1098, T1685
M365 Threat Intelligence Signal elastic (low) T1204, T1204.001, T1204.002, T1566, T1566.001, T1566.002
PST Export Alert Using New-ComplianceSearchAction sigma (medium) T1114

SharePoint 2 rules, 1 operation

(any) 2 rules

M365 Purview DLP Signal elastic (low) T1005, T1114, T1530, T1567, T1567.002
O365 Exfiltration via File Sync Download splunk (low) T1530, T1567

ThreatIntelligence 1 rule, 1 operation

(any) 1 rule

M365 Threat Intelligence Signal elastic (low) T1204, T1204.001, T1204.002, T1566, T1566.001, T1566.002

Not attributed to a Unified Audit Log operation

126 rules that do not map to a single UAL operation: they scan the entire log with no operation filter, query a Defender Advanced Hunting table (a different telemetry surface, attributed via the synthetic Defender catalog), or resolve to nothing. Each group names why.