detection.wiki

Defender for Office 365 threat intelligence events M365-ThreatIntelligence

2 operations, identified by Operation in the audit log.

OperationDescription
_catch_allCatch-all for M365-ThreatIntelligence rules matching the RecordType but no specific Operation.
TIMailDataThreat-intelligence data was recorded for a mail message by Microsoft Defender for Office 365 (malware/phish verdict surfaced in the threat-intelligence stream).

_catch_all: Defender for Office 365 threat intelligence events (catch-all)

#
RecordType
M365-ThreatIntelligence

Description

Catch-all for M365-ThreatIntelligence rules matching the RecordType but no specific Operation.

Fields #

NameDescription
RecordTypeAuditLogRecordType enum value (named string in Sentinel OfficeActivity; integer in the raw Management Activity API JSON).
OperationThe name of the user or admin activity. For Exchange admin activity this is the cmdlet name; for DLP it is DlpRuleMatch/DlpRuleUndo/DlpInfo. The per-event discriminator (event.action in Elastic ECS).
WorkloadThe Microsoft 365 service where the activity occurred (Exchange, SharePoint, AzureActiveDirectory, MicrosoftTeams, ...). Surfaces as event.provider in Elastic ECS.
ResultStatusWhether the action succeeded: Succeeded, PartiallySucceeded, or Failed (True/False for Exchange admin). For STS-logon events this reflects only the HTTP operation, not logon success: check LogonError.
UserIdUPN of the user who performed the action; system-account and app@sharepoint values also appear.
UserTypeType of actor: Regular, Admin, System, DcAdmin, Application, ServicePrincipal.
UserKeyAlternative ID for the user (the PUID for SharePoint / OneDrive / Exchange events).
ClientIPIPv4/IPv6 address of the device used; may be a trusted-app IP, and is null for Microsoft Entra ID events.
ObjectIdFor SharePoint/OneDrive, the full path of the file/folder; for Exchange admin, the object modified by the cmdlet; shape is operation-specific.
OrganizationIdGUID of the tenant's Office 365 organization (constant per tenant).
IdUnique identifier (GUID) for the audit record.
CreationTimeUTC date/time when the audit record was generated.
ScopeSource of the event: online (a Microsoft 365 service) or onprem (an on-premises service; currently SharePoint only).
AppAccessContextApplication context for the user or service principal that performed the action.

Detection Rules #

View all rules referencing this event →

Elastic #

  • M365 Threat Intelligence Signal source low: Identifies Microsoft 365 audit logs generated for Threat Intelligence signals by Microsoft Defender for Office 365. This includes phishing and malware events, campaign-related threat detections, file-based threats in SharePoint, OneDrive, and Teams, as well as Microsoft Threat Intelligence Center (MSTIC) signals. These events provide early indicators of compromise attempts and can be correlated with other signals for threat hunting and detection.

References #

TIMailData

#
RecordType
M365-ThreatIntelligence

Description

Threat-intelligence data was recorded for a mail message by Microsoft Defender for Office 365 (malware/phish verdict surfaced in the threat-intelligence stream).

Fields #

NameDescription
RecordTypeAuditLogRecordType enum value (named string in Sentinel OfficeActivity; integer in the raw Management Activity API JSON).
OperationThe name of the user or admin activity. For Exchange admin activity this is the cmdlet name; for DLP it is DlpRuleMatch/DlpRuleUndo/DlpInfo. The per-event discriminator (event.action in Elastic ECS).
WorkloadThe Microsoft 365 service where the activity occurred (Exchange, SharePoint, AzureActiveDirectory, MicrosoftTeams, ...). Surfaces as event.provider in Elastic ECS.
ResultStatusWhether the action succeeded: Succeeded, PartiallySucceeded, or Failed (True/False for Exchange admin). For STS-logon events this reflects only the HTTP operation, not logon success: check LogonError.
UserIdUPN of the user who performed the action; system-account and app@sharepoint values also appear.
UserTypeType of actor: Regular, Admin, System, DcAdmin, Application, ServicePrincipal.
UserKeyAlternative ID for the user (the PUID for SharePoint / OneDrive / Exchange events).
ClientIPIPv4/IPv6 address of the device used; may be a trusted-app IP, and is null for Microsoft Entra ID events.
ObjectIdFor SharePoint/OneDrive, the full path of the file/folder; for Exchange admin, the object modified by the cmdlet; shape is operation-specific.
OrganizationIdGUID of the tenant's Office 365 organization (constant per tenant).
IdUnique identifier (GUID) for the audit record.
CreationTimeUTC date/time when the audit record was generated.
ScopeSource of the event: online (a Microsoft 365 service) or onprem (an on-premises service; currently SharePoint only).
AppAccessContextApplication context for the user or service principal that performed the action.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
OperationeqTIMailData1 rulesigma, splunk
WorkloadeqThreatIntelligence1 rulesigma, splunk

Detection Rules #

View all rules referencing this event →

Sigma #

  • Suspicious Email Delivered In Microsoft 365 source medium: Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

References #