detection.wiki

Defender for Office 365 threat intelligence events

OperationDescriptionSampleRule
anyCatch-all for M365-ThreatIntelligence rules matching the RecordType but no specific Operation.NY
TIMailDataThreat-intelligence data was recorded for a mail message by Microsoft Defender for Office 365 (malware/phish verdict surfaced in the threat-intelligence stream).YY

any: Defender for Office 365 threat intelligence events (catch-all)

#
RecordType
ThreatIntelligence

Description

Catch-all for M365-ThreatIntelligence rules matching the RecordType but no specific Operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • M365 Threat Intelligence Signal source low: Identifies Microsoft 365 audit logs generated for Threat Intelligence signals by Microsoft Defender for Office 365. This includes phishing and malware events, campaign-related threat detections, file-based threats in SharePoint, OneDrive, and Teams, as well as Microsoft Threat Intelligence Center (MSTIC) signals. These events provide early indicators of compromise attempts and can be correlated with other signals for threat hunting and detection.T1204, T1204.001, T1204.002, T1566, T1566.001, T1566.002

References #

TIMailData

#
RecordType
ThreatIntelligence

Description

Threat-intelligence data was recorded for a mail message by Microsoft Defender for Office 365 (malware/phish verdict surfaced in the threat-intelligence stream).

Example Audit Record #

{
  "AdditionalActionsAndResults": [
    "OriginalDelivery: [N/A]"
  ],
  "AttachmentData": [
    {
      "FileName": "BJVHCG!!.pdf",
      "FileType": "pdf",
      "FileVerdict": 1,
      "MalwareFamily": "Scam_PDF_Norton_M",
      "SHA256": "b7e8a516206134071ba2868600b6d62eeb421fce16c4700c9399fa46d5127fbf"
    }
  ],
  "AuthDetails": [
    {
      "Name": "SPF",
      "Value": "Pass"
    },
    {
      "Name": "DKIM",
      "Value": "Pass"
    },
    {
      "Name": "DMARC",
      "Value": "Pass"
    },
    {
      "Name": "Comp Auth",
      "Value": "pass"
    }
  ],
  "CreationTime": "2024-03-19T11:39:21",
  "DeliveryAction": "Blocked",
  "DetectionMethod": "File detonation reputation",
  "DetectionType": "Inline",
  "Directionality": "Inbound",
  "EventDeepLink": "https://security.microsoft.com/?hash=/threatexplorer?messageParams=14742693-1a1a-4fbc-db85-08dc4808fbd2,14742693-1a1a-4fbc-db85-08dc4808fbd2-1568395857471009376-1,2024-03-19T00:00:00,2024-03-19T23:59:59&view=Malware",
  "Id": "b048dfad-f435-e166-58e0-79575e66b0c3",
  "InternetMessageId": "<V24CUPPT-68X1-Z888-ZX3H-MU7GGA1SNBV@gmail.com>",
  "LatestDeliveryLocation": "Quarantine",
  "MessageTime": "2024-03-19T11:37:47",
  "NetworkMessageId": "14742693-1a1a-4fbc-db85-08dc4808fbd2",
  "ObjectId": "14742693-1a1a-4fbc-db85-08dc4808fbd215683958574710093761",
  "Operation": "TIMailData",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "OriginalDeliveryLocation": "Quarantine",
  "P1Sender": "attacker@bad_guy.lol",
  "P2Sender": "attacker@bad_guy.lol",
  "PhishConfidenceLevel": "High",
  "Policy": "SafeAttachements",
  "PolicyAction": "Quarantine",
  "Recipients": [
    "victim@attack_range.lan"
  ],
  "RecordType": 28,
  "SenderIp": "209.85.216.45",
  "Subject": "invoice Copy",
  "ThreatsAndDetectionTech": [
    "Malware: [File detonation reputation]",
    "Phish: [Advanced filter]"
  ],
  "UserId": "ThreatIntel",
  "UserKey": "ThreatIntel",
  "UserType": 4,
  "Verdict": "Malware",
  "Version": 1,
  "Workload": "ThreatIntelligence"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
m365::Directionalityeqinbound2 rulessigma, splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

  • Suspicious Email Delivered In Microsoft 365 source medium: Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.T1566, T1566.001, T1566.002

Splunk #

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

  • Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
  • Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.
API JSON (event pages)OfficeActivity columnNote
IdOfficeIdRenamed.
WorkloadOfficeWorkloadRenamed.
ObjectIdOfficeObjectIdRenamed.
CreationTimeTimeGeneratedRenamed. OfficeActivity has no CreationTime column.
SiteUrlSite_UrlRenamed (SharePoint family).
RecordTypeRecordTypeSame name; the Int32 enum becomes its string enum name.
UserTypeUserTypeSame name; the Int32 enum becomes a string.
ClientIPClientIP, Client_IPAddressBoth columns present on OfficeActivity.
Scope(none)No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob.
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationIdsame namesUnchanged. No _s / _d suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.