Detection rules › By event

M365-ExchangeItem

Event	Rules
any	2
Add-MailboxFolderPermission	3
Add-MailboxPermission	5
AddFolderPermissions	1
HardDelete	6
ModifyFolderPermissions	2
MoveToDeletedItems	1
Send	3
SendAs	3
SendOnBehalf	3
SoftDelete	3
UpdateInboxRules	2

any

2 detection rules reference this event. View event page.

Splunk (2)

O365 Email Send and Hard Delete Exfiltration Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485

Add-MailboxFolderPermission

3 detection rules reference this event. View event page.

Splunk (1)

O365 Mailbox Folder Read Permission Granted severity medium T1098, T1098.002

Kusto (2)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114

Add-MailboxPermission

5 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Mailbox High-Risk Permission Delegated severity low T1098, T1098.002

Splunk (1)

O365 Elevated Mailbox Permission Assigned severity medium T1098, T1098.002

Kusto (3)

Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt severity medium T1078, T1548
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
Rare and potentially high-risk Office operations severity low T1098, T1114

AddFolderPermissions

1 detection rules reference this event. View event page.

Splunk (1)

O365 Mailbox Folder Read Permission Assigned severity medium T1098, T1098.002

HardDelete

6 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070, T1070.008, T1098, T1098.005

Splunk (5)

O365 Email Hard Delete Excessive Volume severity low T1070, T1070.008, T1485
O365 Email Password and Payroll Compromise Behavior severity medium T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Receive and Hard Delete Takeover Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Exfiltration Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485

ModifyFolderPermissions

2 detection rules reference this event. View event page.

Splunk (2)

O365 Mailbox Folder Read Permission Assigned severity medium T1098, T1098.002
O365 Mailbox Inbox Folder Shared with All Users severity medium T1114, T1114.002

MoveToDeletedItems

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070, T1070.008, T1098, T1098.005

Send

3 detection rules reference this event. View event page.

Splunk (3)

O365 Email Hard Delete Excessive Volume severity low T1070, T1070.008, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send Attachments Excessive Volume severity low T1070, T1070.008, T1485

SendAs

3 detection rules reference this event. View event page.

Splunk (3)

O365 Email Hard Delete Excessive Volume severity low T1070, T1070.008, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send Attachments Excessive Volume severity low T1070, T1070.008, T1485

SendOnBehalf

3 detection rules reference this event. View event page.

Splunk (3)

O365 Email Hard Delete Excessive Volume severity low T1070, T1070.008, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send Attachments Excessive Volume severity low T1070, T1070.008, T1485

SoftDelete

3 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070, T1070.008, T1098, T1098.005

Splunk (2)

O365 Email Password and Payroll Compromise Behavior severity medium T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485

UpdateInboxRules

2 detection rules reference this event. View event page.

Sigma (1)

Mail Forwarding/Redirecting Activity In O365 severity medium T1020, T1114, T1114.003, T1564, T1564.008

Splunk (1)

O365 New Email Forwarding Rule Enabled severity medium T1114, T1114.003