detection.wiki

Detection rules › Splunk

O365 DLP Rule Triggered

Status
production
Severity
low
Group by
action, aws::recipientAccountId, dest, reason, recipient, signature_id, src, user, vendor_product
Author
Steven Dick
Source
github.com/splunk/security_content

The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to de termine what, if any, security relevance the underlying DLP events contain.

Known false positives

  • WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.

MITRE ATT&CK coverage

TacticTechniques
Exfiltration

Telemetry coverage

PlatformRecord / event type
Microsoft 365DlpRuleMatch
Microsoft 365DlpRuleMatch

Rule body

name: O365 DLP Rule Triggered
id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871
version: 10
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to de termine what, if any, security relevance the underlying DLP events contain.
data_source:
    - Office 365 Universal Audit Log
search: '`o365_management_activity` Operation=DLPRuleMatch | eval recipient = ''ExchangeMetaData.To{}'', signature_id = ''ExchangeMetaData.UniqueID'', signature = ''PolicyDetails{}.Rules{}.RuleName'' , src_user = UserId, reason =''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName'', result=''PolicyDetails{}.Rules{}.Actions{}'', file_name=case(NOT match(''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'',"Message Body"),''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'') | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_dlp_rule_triggered_filter` '
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions.
known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.
references:
    - https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ triggered a Microsoft Office DLP rule.
analytic_story:
    - Data Exfiltration
asset_type: O365 Tenant
mitre_attack_id:
    - T1048
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

Stages and Predicates

Stage 1: search

`o365_management_activity` Operation=DLPRuleMatch

Stage 2: eval

| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
file_name =
else'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'

Stage 3: fillnull

| fillnull

Stage 4: stats

| stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason

Stage 5: search

| `security_content_ctime(firstTime)`

Stage 6: search

| `security_content_ctime(lastTime)`

Stage 7: search

| `o365_dlp_rule_triggered_filter`

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Operationeq
  • DLPRuleMatch
field:"Operation" kind:eq value:"DLPRuleMatch"
sourcetypeeq
  • o365:management:activity
field:"sourcetype" kind:eq value:"o365:management:activity"