Exchange mailbox search activity

OperationDescriptionSampleRule
anyCatch-all for M365-ExchangeSearch rules matching the RecordType but no specific Operation.NN
SearchQueryInitiatedExchangeA user searched for items in their Exchange Online mailbox via Outlook or Outlook on the web; an Audit (Premium) event capturing the search query.YY

any: Exchange mailbox search activity (catch-all)

#
RecordType
ExchangeSearch

Description

Catch-all for M365-ExchangeSearch rules matching the RecordType but no specific Operation.

References #

SearchQueryInitiatedExchange

#
RecordType
ExchangeSearch

Description

A user searched for items in their Exchange Online mailbox via Outlook or Outlook on the web; an Audit (Premium) event capturing the search query.

Example Audit Record #

{
  "QuerySource": "Email",
  "QueryText": "accounting",
  "ScenarioName": "outlookdesktop",
  "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)",
  "CustomProperties": [
    {
      "Name": "UserAgent",
      "Value": "officeshared.outlookdesktop"
    }
  ],
  "UserId": "attacker_3@attackrange.local",
  "ClientIP": "174.97.106.111",
  "Id": "0c0c2de9-6aeb-402d-8d6a-967d5eb9397f",
  "RecordType": 101,
  "CreationTime": "2025-02-27T12:08:57",
  "Operation": "SearchQueryInitiatedExchange",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "UserType": 0,
  "UserKey": "10037FFE8C9C6D32",
  "Workload": "Exchange",
  "AppAccessContext": {
    "APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c",
    "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c",
    "CorrelationId": "FBE4F7F2-ECC2-4AB3-B87E-DA94A7C0EA8B"
  },
  "Version": 1
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
command (splunk rule field)ne(*)1 rulesplunk
command (splunk rule field)ne*1 rulesplunk
count (splunk rule field)gt201 rulesplunk
suspect_terms_count (splunk rule field)ge21 rulesplunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

  • O365 Email Suspicious Search Behavior source: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a mailbox within a limited timeframe. This behavior may indicate that a malicious actor has gained control of…T1114, T1114.002, T1552

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

  • Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
  • Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.
API JSON (event pages)OfficeActivity columnNote
IdOfficeIdRenamed.
WorkloadOfficeWorkloadRenamed.
ObjectIdOfficeObjectIdRenamed.
CreationTimeTimeGeneratedRenamed. OfficeActivity has no CreationTime column.
SiteUrlSite_UrlRenamed (SharePoint family).
RecordTypeRecordTypeSame name; the Int32 enum becomes its string enum name.
UserTypeUserTypeSame name; the Int32 enum becomes a string.
ClientIPClientIP, Client_IPAddressBoth columns present on OfficeActivity.
Scope(none)No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob.
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationIdsame namesUnchanged. No _s / _d suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.