Detection rules › By event

M365-ExchangeAdmin

Event	Rules
any	2
Add-FederatedDomain	2
Add-MailboxPermission	5
Add-RecipientPermission	1
Disable-AntiPhishRule	2
Disable-MalwareFilterRule	1
Disable-SafeAttachmentRule	2
Disable-SafeLinksRule	2
Disable-TransportRule	1
New-AcceptedDomain	1
New-InboxRule	12
New-ManagementRoleAssignment	4
New-TransportRule	5
Remove-AcceptedDomain	1
Remove-AntiPhishPolicy	2
Remove-AntiPhishRule	2
Remove-DlpPolicy	2
Remove-FederatedDomain	1
Remove-MalwareFilterPolicy	1
Remove-MalwareFilterRule	1
Remove-SafeAttachmentPolicy	1
Remove-SafeAttachmentRule	1
Remove-SafeLinksPolicy	1
Remove-TransportRule	1
Set-AcceptedDomain	1
Set-AdminAuditLogConfig	3
Set-DkimSigningConfig	1
Set-InboxRule	10
Set-Mailbox	6
Set-MailboxAuditBypassAssociation	1
Set-MailboxFolderPermission	1
Set-TransportRule	5

any

2 detection rules reference this event. View event page.

Splunk (2)

O365 Email Security Feature Changed severity medium T1685, T1685.002
O365 Email Transport Rule Changed severity low T1114, T1114.003, T1564, T1564.008

Add-FederatedDomain

2 detection rules reference this event. View event page.

Sigma (1)

New Federated Domain Added - Exchange severity medium T1136, T1136.003

Elastic (1)

M365 Exchange Federated Domain Created or Modified severity low T1484, T1484.002

Add-MailboxPermission

5 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Mailbox High-Risk Permission Delegated severity low T1098, T1098.002

Splunk (1)

O365 Elevated Mailbox Permission Assigned severity medium T1098, T1098.002

Kusto (3)

Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt severity medium T1078, T1548
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114

Add-RecipientPermission

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Mailbox High-Risk Permission Delegated severity low T1098, T1098.002

Disable-AntiPhishRule

2 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Anti-Phish Rule Modification severity medium T1685

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Disable-MalwareFilterRule

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Malware Filter Rule Modified severity medium T1484, T1685

Disable-SafeAttachmentRule

2 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Email Safe Attachment Rule Disabled severity low T1685

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Disable-SafeLinksRule

2 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Email Safe Link Policy Disabled severity medium T1484, T1685

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Disable-TransportRule

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Mail Flow Transport Rule Modified severity medium T1537, T1685

New-AcceptedDomain

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Federated Domain Created or Modified severity low T1484, T1484.002

New-InboxRule

12 detection rules reference this event. View event page.

Sigma (2)

Inbox Rules Creation Or Update Activity in O365 severity medium T1114, T1114.003, T1564, T1564.008
Mail Forwarding/Redirecting Activity In O365 severity medium T1020, T1114, T1114.003, T1564, T1564.008

Elastic (3)

M365 Exchange Inbox Forwarding Rule Created severity medium T1114, T1114.003
M365 Exchange Inbox Phishing Evasion Rule Created severity high T1137, T1137.005, T1564, T1564.008
M365 Exchange Inbox Rule with Obfuscated Name severity medium T1137, T1137.005, T1564, T1564.008

Splunk (3)

O365 BEC Email Hiding Rule Created severity medium T1564, T1564.008
O365 Email New Inbox Rule Created severity low T1114, T1114.003, T1564, T1564.008
O365 New Email Forwarding Rule Created severity medium T1114, T1114.003

Kusto (4)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Malicious BEC Inbox Rule severity medium T1078, T1098
Malicious Inbox Rule severity medium T1078, T1098
Rare and potentially high-risk Office operations severity low T1098, T1114

New-ManagementRoleAssignment

4 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Management Group Role Assigned severity medium T1098, T1098.003

Splunk (1)

O365 ApplicationImpersonation Role Assigned severity medium T1098, T1098.002

Kusto (2)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114

New-TransportRule

5 detection rules reference this event. View event page.

Elastic (2)

M365 Exchange Inbox Forwarding Rule Created severity medium T1114, T1114.003
M365 Exchange Mail Flow Transport Rule Created severity medium T1114, T1114.003, T1537

Splunk (1)

O365 New Forwarding Mailflow Rule Created severity medium T1114

Kusto (2)

Mail redirect via ExO transport rule severity medium T1020, T1114
Threat Essentials - Mail redirect via ExO transport rule severity medium T1020, T1114

Remove-AcceptedDomain

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Federated Domain Created or Modified severity low T1484, T1484.002

Remove-AntiPhishPolicy

2 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Anti-Phish Policy Deleted severity medium T1484, T1685

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Remove-AntiPhishRule

2 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Anti-Phish Rule Modification severity medium T1685

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Remove-DlpPolicy

2 detection rules reference this event. View event page.

Elastic (1)

Deprecated - M365 Exchange DLP Policy Deleted severity medium T1685

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Remove-FederatedDomain

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Federated Domain Created or Modified severity low T1484, T1484.002

Remove-MalwareFilterPolicy

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Malware Filter Policy Deleted severity medium T1685

Remove-MalwareFilterRule

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Malware Filter Rule Modified severity medium T1484, T1685

Remove-SafeAttachmentPolicy

1 detection rules reference this event. View event page.

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Remove-SafeAttachmentRule

1 detection rules reference this event. View event page.

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Remove-SafeLinksPolicy

1 detection rules reference this event. View event page.

Kusto (1)

Office Policy Tampering severity medium T1098, T1685

Remove-TransportRule

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Mail Flow Transport Rule Modified severity medium T1537, T1685

Set-AcceptedDomain

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Federated Domain Created or Modified severity low T1484, T1484.002

Set-AdminAuditLogConfig

3 detection rules reference this event. View event page.

Kusto (1)

Exchange AuditLog Disabled severity medium T1685

YARA-L (2)

Office 365 logging has been enabled severity critical T1685, T1685.002
Office 365 logging is disabled severity critical T1685, T1685.002

Set-DkimSigningConfig

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange DKIM Signing Configuration Disabled severity medium T1484, T1685

Set-InboxRule

10 detection rules reference this event. View event page.

Sigma (2)

Inbox Rules Creation Or Update Activity in O365 severity medium T1114, T1114.003, T1564, T1564.008
Mail Forwarding/Redirecting Activity In O365 severity medium T1020, T1114, T1114.003, T1564, T1564.008

Elastic (3)

M365 Exchange Inbox Forwarding Rule Created severity medium T1114, T1114.003
M365 Exchange Inbox Phishing Evasion Rule Created severity high T1137, T1137.005, T1564, T1564.008
M365 Exchange Inbox Rule with Obfuscated Name severity medium T1137, T1137.005, T1564, T1564.008

Splunk (3)

O365 BEC Email Hiding Rule Created severity medium T1564, T1564.008
O365 Email New Inbox Rule Created severity low T1114, T1114.003, T1564, T1564.008
O365 New Email Forwarding Rule Created severity medium T1114, T1114.003

Kusto (2)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114

Set-Mailbox

6 detection rules reference this event. View event page.

Sigma (1)

Mail Forwarding/Redirecting Activity In O365 severity medium T1020, T1114, T1114.003, T1564, T1564.008

Elastic (2)

M365 Exchange Inbox Forwarding Rule Created severity medium T1114, T1114.003
M365 Exchange Mailbox High-Risk Permission Delegated severity low T1098, T1098.002

Splunk (1)

O365 Mailbox Email Forwarding Enabled severity medium T1114, T1114.003

Kusto (2)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114

Set-MailboxAuditBypassAssociation

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Mailbox Audit Logging Bypass Added severity medium T1098, T1685

Set-MailboxFolderPermission

1 detection rules reference this event. View event page.

Splunk (1)

O365 Mailbox Folder Read Permission Granted severity medium T1098, T1098.002

Set-TransportRule

5 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Inbox Forwarding Rule Created severity medium T1114, T1114.003

Kusto (4)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Mail redirect via ExO transport rule severity medium T1020, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114
Threat Essentials - Mail redirect via ExO transport rule severity medium T1020, T1114