Detection rules › Sigma
Microsoft 365 - Unusual Volume of File Deletion
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact |
Rules detecting the same action
These rules filter on the same operation.
Rule body
title: Microsoft 365 - Unusual Volume of File Deletion
id: 78a34b67-3c39-4886-8fb4-61c46dc18ecd
status: test
description: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
author: austinsonger
date: 2021-08-19
modified: 2022-10-09
tags:
- attack.impact
- attack.t1485
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: 'Unusual volume of file deletion'
status: success
condition: selection
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: SecurityComplianceCenter
eventName: 'Unusual volume of file deletion'
status: success
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"Unusual volume of file deletion" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"SecurityComplianceCenter" |
status | eq |
| field:"status" kind:eq value:"success" |