Microsoft Defender for Cloud Apps alert events

Operation	Description	Sample	Rule
any	Catch-all for M365-MCASAlerts rules matching the RecordType but no specific Operation.	N	Y
Activity from anonymous IP addresses	Defender for Cloud Apps detected user activity originating from an IP address associated with anonymizing proxies or Tor exit nodes.	N	Y
Activity from infrequent country	Defender for Cloud Apps detected user activity from a geographic location not previously seen for that user.	N	Y
Activity from suspicious IP addresses	Defender for Cloud Apps detected user activity from an IP address classified as malicious by Microsoft Threat Intelligence.	N	Y
Activity performed by terminated user	Defender for Cloud Apps detected activity from a user account whose account has been disabled or terminated.	N	Y
Data exfiltration to unsanctioned apps	Defender for Cloud Apps detected a significant volume of data being transferred to unsanctioned cloud applications.	N	Y
Impossible travel activity	Defender for Cloud Apps detected sign-ins or activity from two geographically distant locations within a time window that precludes physical travel.	N	Y
Log on from a risky IP address	Defender for Cloud Apps detected a sign-in from an IP address with a high risk score based on threat intelligence feeds.	N	Y
Potential ransomware activity	Defender for Cloud Apps detected file activity patterns consistent with ransomware, such as rapid mass file modification or deletion.	N	Y
Suspicious inbox forwarding	Defender for Cloud Apps detected a new inbox-forwarding rule that routes mail to an external address, a common data exfiltration technique.	N	Y
Suspicious OAuth app file download activities	Defender for Cloud Apps detected an OAuth application downloading an unusually large number of files, suggesting credential abuse or data staging.	N	Y

any: Microsoft Defender for Cloud Apps alert events (catch-all)

RecordType: MCASAlerts

Description

Catch-all for M365-MCASAlerts rules matching the RecordType but no specific Operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Defender Alerts Signal (UAL) source medium: Identifies alerts generated by Microsoft Defender products including Windows Defender for Endpoint (WDATP), Microsoft Cloud App Security (MCAS), Microsoft Defender for Identity, Microsoft 365 Defender custom detections, and Defender Experts for XDR via M365 Unified Audit Logs (UAL). These cross-platform alerts indicate detected threats across endpoints, cloud applications, and identity systems. This building block rule generates security events for correlation, threat hunting, and telemetry collection to support comprehensive threat detection.

Activity from anonymous IP addresses

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected user activity originating from an IP address associated with anonymizing proxies or Tor exit nodes.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma
`status` (sigma rule field)	eq	`success`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Activity from Anonymous IP Addresses source medium: Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.T1573

Activity from infrequent country

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected user activity from a geographic location not previously seen for that user.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma
`status` (sigma rule field)	eq	`success`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Activity from Infrequent Country source medium: Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.T1573

Activity from suspicious IP addresses

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected user activity from an IP address classified as malicious by Microsoft Threat Intelligence.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma
`status` (sigma rule field)	eq	`success`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Activity from Suspicious IP Addresses source medium: Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.T1573

Activity performed by terminated user

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected activity from a user account whose account has been disabled or terminated.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma
`status` (sigma rule field)	eq	`success`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Activity Performed by Terminated User source medium: Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.

Data exfiltration to unsanctioned apps

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected a significant volume of data being transferred to unsanctioned cloud applications.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma
`status` (sigma rule field)	eq	`success`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Data Exfiltration to Unsanctioned Apps source medium: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.T1537

Impossible travel activity

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected sign-ins or activity from two geographically distant locations within a time window that precludes physical travel.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma
`status` (sigma rule field)	eq	`success`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Microsoft 365 - Impossible Travel Activity source medium: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.T1078

Log on from a risky IP address

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected a sign-in from an IP address with a high risk score based on threat intelligence feeds.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Logon from a Risky IP Address source medium: Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.T1078

Potential ransomware activity

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected file activity patterns consistent with ransomware, such as rapid mass file modification or deletion.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::eventSource` (sigma rule field)	eq	`securitycompliancecenter`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Microsoft 365 - Potential Ransomware Activity source medium: Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.T1486

Suspicious inbox forwarding

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected a new inbox-forwarding rule that routes mail to an external address, a common data exfiltration technique.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Suspicious Inbox Forwarding source low: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.T1020

Suspicious OAuth app file download activities

RecordType: MCASAlerts

Description

Defender for Cloud Apps detected an OAuth application downloading an unusually large number of files, suggesting credential abuse or data staging.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Suspicious OAuth App File Download Activities source medium: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.