PST Export Alert Using New-ComplianceSearchAction

Status: test
Severity: medium
Log source: product m365, service threat_management
Author: Nikita Khalimonenkov
Source: github.com/SigmaHQ/sigma

Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.

Known false positives

Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1114` Email Collection

Rules detecting the same action

These rules filter on the same operation.

Deprecated - M365 Security Compliance Potential Ransomware Activity (Elastic)
M365 Purview Security Compliance Signal (Elastic)

Rule body

title: PST Export Alert Using New-ComplianceSearchAction
id: 6897cd82-6664-11ed-9022-0242ac120002
related:
    - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
      type: similar
status: test
description: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
references:
    - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps
author: Nikita Khalimonenkov
date: 2022-11-17
tags:
    - attack.collection
    - attack.t1114
logsource:
    service: threat_management
    product: m365
detection:
    selection:
        eventSource: SecurityComplianceCenter
        Payload|contains|all:
            - 'New-ComplianceSearchAction'
            - 'Export'
            - 'pst'
    condition: selection
falsepositives:
    - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: SecurityComplianceCenter
    Payload|contains|all:
        - 'New-ComplianceSearchAction'
        - 'Export'
        - 'pst'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Payload`	match	`Export` `New-ComplianceSearchAction` `pst`	`field:"Payload" kind:match`
`eventSource`	eq	`SecurityComplianceCenter`	`field:"aws::eventSource" kind:eq value:"SecurityComplianceCenter"`