Detection rules › By catalog entry

M365-ExchangeItem

Catalog entry	Rules
any	2
Add-MailboxFolderPermission	3
Add-MailboxPermission	5
AddFolderPermissions	1
HardDelete	6
ModifyFolderPermissions	2
MoveToDeletedItems	1
Send	2
SendAs	2
SendOnBehalf	2
SoftDelete	3
UpdateInboxRules	2

any

2 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

O365 Email Send and Hard Delete Exfiltration Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485

Add-MailboxFolderPermission

3 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

O365 Mailbox Folder Read Permission Granted severity medium T1098,T1098.002

Kusto (2)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078,T1098,T1114
Rare and potentially high-risk Office operations severity low T1098,T1114

Add-MailboxPermission

5 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange Mailbox High-Risk Permission Delegated severity low T1098,T1098.002

Splunk (1)

O365 Elevated Mailbox Permission Assigned severity medium T1098,T1098.002

Kusto (3)

Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt severity medium T1078,T1548
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078,T1098,T1114
Rare and potentially high-risk Office operations severity low T1098,T1114

AddFolderPermissions

1 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

O365 Mailbox Folder Read Permission Assigned severity medium T1098,T1098.002

HardDelete

6 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070,T1070.008,T1098,T1098.005

Splunk (5)

ModifyFolderPermissions

2 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

O365 Mailbox Folder Read Permission Assigned severity medium T1098,T1098.002
O365 Mailbox Inbox Folder Shared with All Users severity medium T1114,T1114.002

MoveToDeletedItems

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070,T1070.008,T1098,T1098.005

Send

2 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

O365 Email Send and Hard Delete Suspicious Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485
O365 Email Send Attachments Excessive Volume severity low T1070,T1070.008,T1485

SendAs

2 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

O365 Email Send and Hard Delete Suspicious Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485
O365 Email Send Attachments Excessive Volume severity low T1070,T1070.008,T1485

SendOnBehalf

2 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

O365 Email Send and Hard Delete Suspicious Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485
O365 Email Send Attachments Excessive Volume severity low T1070,T1070.008,T1485

SoftDelete

3 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070,T1070.008,T1098,T1098.005

Splunk (2)

O365 Email Password and Payroll Compromise Behavior severity medium T1070,T1070.008,T1114,T1114.001,T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485

UpdateInboxRules

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Mail Forwarding/Redirecting Activity In O365 severity medium T1020,T1114,T1114.003,T1564,T1564.008

Splunk (1)

O365 New Email Forwarding Rule Enabled severity medium T1114,T1114.003

Back to all M365-ExchangeItem catalog entries