Exchange mailbox search activity
| Operation | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for M365-ExchangeSearch rules matching the RecordType but no specific Operation. | N | N |
| Search | A user searched for items in their Exchange Online mailbox via Outlook or Outlook on the web; an Audit (Premium) event capturing the search query. | Y | Y |
any: Exchange mailbox search activity (catch-all)
#Description
Catch-all for M365-ExchangeSearch rules matching the RecordType but no specific Operation.
References #
SearchQueryInitiatedExchange
#Description
A user searched for items in their Exchange Online mailbox via Outlook or Outlook on the web; an Audit (Premium) event capturing the search query.
Example Audit Record #
{
"QuerySource": "Email",
"QueryText": "accounting",
"ScenarioName": "outlookdesktop",
"ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)",
"CustomProperties": [
{
"Name": "UserAgent",
"Value": "officeshared.outlookdesktop"
}
],
"UserId": "attacker_3@attackrange.local",
"ClientIP": "174.97.106.111",
"Id": "0c0c2de9-6aeb-402d-8d6a-967d5eb9397f",
"RecordType": 101,
"CreationTime": "2025-02-27T12:08:57",
"Operation": "SearchQueryInitiatedExchange",
"OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
"UserType": 0,
"UserKey": "10037FFE8C9C6D32",
"Workload": "Exchange",
"AppAccessContext": {
"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c",
"ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c",
"CorrelationId": "FBE4F7F2-ECC2-4AB3-B87E-DA94A7C0EA8B"
},
"Version": 1
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
command (splunk rule field) | ne | (*) | 1 rule | splunk |
command (splunk rule field) | ne | * | 1 rule | splunk |
count (splunk rule field) | gt | 20 | 1 rule | splunk |
suspect_terms_count (splunk rule field) | ge | 2 | 1 rule | splunk |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Splunk #
T1114, T1114.002, T1552
References #
M365 audit records use different field names on each surface #
The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.
- Purview CSV export flattens each record to four columns (
CreationDate,UserIds,Operations,AuditData). The API field names live only inside theAuditDataJSON blob. Expand it withConvertFrom-Json. The wrapper columns are renamed too:CreationDatenotCreationTime,UserIdsnotUserId,OperationsnotOperation. - Sentinel's
OfficeActivitytable renames several fields and turns two integer enum columns into strings. The table below maps them.
| API JSON (event pages) | OfficeActivity column | Note |
|---|---|---|
Id | OfficeId | Renamed. |
Workload | OfficeWorkload | Renamed. |
ObjectId | OfficeObjectId | Renamed. |
CreationTime | TimeGenerated | Renamed. OfficeActivity has no CreationTime column. |
SiteUrl | Site_Url | Renamed (SharePoint family). |
RecordType | RecordType | Same name; the Int32 enum becomes its string enum name. |
UserType | UserType | Same name; the Int32 enum becomes a string. |
ClientIP | ClientIP, Client_IPAddress | Both columns present on OfficeActivity. |
Scope | (none) | No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob. |
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationId | same names | Unchanged. No _s / _d suffixes (a native table, not a custom log). |
Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.