O365 ZAP Activity Detection

name: O365 ZAP Activity Detection
id: 4df275fd-a0e5-4246-8b92-d3201edaef7a
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when the Microsoft Zero-hour Automatic Purge (ZAP) capability takes action against a user's mailbox. This capability is an enhanced protection feature that retro-actively removes email with known malicious content for user inboxes. Since this is a retroactive capability, there is still a window in which the user may fall victim to the malicious content.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*"
      | fromjson Data
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user
        BY AlertId,trc,signature,Name,dest,src,vendor_account,vendor_product
      | rename Name as signature, AlertId as signature_id, trc as user
      | eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";")
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_zap_activity_detection_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Some features of Zero-hour purge are only offered within E3/E5 license level tenants, events may not be available otherwise.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ was included in a ZAP protection activity.
threat_objects:
    - field: file_name
      type: file_name
    - field: src_user
      type: email_address
    - field: url
      type: url
analytic_story:
    - Spearphishing Attachments
    - Suspicious Emails
asset_type: O365 Tenant
mitre_attack_id:
    - T1566.001
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat