detection.wiki

DLP policy matches in Exchange

OperationDescriptionSampleRule
anyCatch-all for M365-ComplianceDLPExchange rules matching the RecordType but no specific Operation.NY
DlpRuleMatchA Microsoft Purview Data Loss Prevention policy rule was matched. The event is emitted for both the Exchange (ComplianceDLPExchange, RecordType 13) and SharePoint/OneDrive (ComplianceDLPSharePoint, RecordType 11) workloads.YY

any: DLP policy matches in Exchange (catch-all)

#
RecordType
ComplianceDLPExchange

Description

Catch-all for M365-ComplianceDLPExchange rules matching the RecordType but no specific Operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • M365 Purview DLP Signal source low: Identifies Microsoft 365 Data Loss Prevention (DLP) and Data Lifecycle Management (DLM) signals from Microsoft Purview across Exchange, SharePoint, OneDrive, and endpoint devices. These events indicate potential data exfiltration attempts, policy violations involving sensitive data, or unauthorized sharing of classified information. This building block rule generates security events for correlation, threat hunting, and telemetry collection to support detection of collection and exfiltration activities.T1005, T1114, T1530, T1567, T1567.002

References #

DlpRuleMatch

#
RecordType
ComplianceDLPExchange

Description

A Microsoft Purview Data Loss Prevention policy rule was matched. The event is emitted for both the Exchange (ComplianceDLPExchange, RecordType 13) and SharePoint/OneDrive (ComplianceDLPSharePoint, RecordType 11) workloads.

Example Audit Record #

{
  "CreationTime": "2024-03-07T20:09:53",
  "ExchangeMetaData": {
    "BCC": [],
    "CC": [],
    "FileSize": 311930,
    "From": "attacker@attack_range.lan",
    "IsViewableByExternalUsers": true,
    "MessageID": "<ZH7PR08MB823166E17DBAFA71D07DF8DEB4202@PH7PR08MB8231.namprd08.prod.outlook.com>",
    "RecipientCount": 1,
    "Sent": "2024-03-07T20:09:51",
    "Subject": "Sensitive Data in this attachment",
    "To": [
      "exfiltrate@bad_guy.lol"
    ],
    "UniqueID": "36a153f5-5132-4aa5-6b8e-08dc3ee28c5a"
  },
  "Id": "83fd011f-dc7a-42ca-92a3-5b5be62f67ee",
  "IncidentId": "13e596c7-af2c-e41a-d800-08dc3ee3f6dd",
  "ObjectId": "<ZH7PR08MB823166E17DBAFA71D07DF8DEB4202@PH7PR08MB8231.namprd08.prod.outlook.com>",
  "Operation": "DlpRuleMatch",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "PolicyDetails": [
    {
      "PolicyId": "c70e344d-f421-4d19-a4c0-3e7040d5fa57",
      "PolicyName": "SSN External Exchange",
      "Rules": [
        {
          "ActionParameters": [
            "GenerateIncidentReport:admin@attack_range.lan"
          ],
          "Actions": [
            "GenerateIncidentReport"
          ],
          "ConditionsMatched": {
            "ConditionMatchedInNewScheme": true,
            "OtherConditions": [
              {
                "Name": "AccessScope",
                "Value": "IncludeExternalUsers"
              }
            ],
            "SensitiveInformation": [
              {
                "ClassifierType": "None",
                "Confidence": 85,
                "Count": 2,
                "Location": "SUPER SECRET INFO.pdf",
                "SensitiveInformationDetailedClassificationAttributes": [
                  {
                    "Confidence": 65,
                    "Count": 2,
                    "IsMatch": false
                  },
                  {
                    "Confidence": 75,
                    "Count": 2,
                    "IsMatch": false
                  },
                  {
                    "Confidence": 85,
                    "Count": 2,
                    "IsMatch": true
                  }
                ],
                "SensitiveInformationTypeName": "U.S. Social Security Number (SSN)",
                "SensitiveType": "a44669fe-0d48-453d-a9b1-2cc83f2cba77",
                "UniqueCount": 2
              }
            ]
          },
          "ManagementRuleId": "e88f4d39-c643-4295-a2f4-12ae1e791032",
          "RuleId": "dea3e6ad-de39-48f1-bd91-a843acebeb79",
          "RuleMode": "Enable",
          "RuleName": "ATTACK RANGE SECRET DATA RULE",
          "Severity": "Low"
        }
      ]
    }
  ],
  "RecordType": 13,
  "SensitiveInfoDetectionIsIncluded": false,
  "UserId": "attacker@attack_range.lan",
  "UserKey": "517ca540-0bed-49c7-86b5-e455008c13d6",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

  • O365 DLP Rule Triggered source: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will…T1048, T1567

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

  • Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
  • Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.
API JSON (event pages)OfficeActivity columnNote
IdOfficeIdRenamed.
WorkloadOfficeWorkloadRenamed.
ObjectIdOfficeObjectIdRenamed.
CreationTimeTimeGeneratedRenamed. OfficeActivity has no CreationTime column.
SiteUrlSite_UrlRenamed (SharePoint family).
RecordTypeRecordTypeSame name; the Int32 enum becomes its string enum name.
UserTypeUserTypeSame name; the Int32 enum becomes a string.
ClientIPClientIP, Client_IPAddressBoth columns present on OfficeActivity.
Scope(none)No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob.
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationIdsame namesUnchanged. No _s / _d suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.