Exchange mailbox activities (per-item)

Operation	Description	Sample	Rule
any	Catch-all for M365-ExchangeItem rules matching the RecordType but no specific Operation.	N	Y
Add-MailboxFolderPermission	A permission entry was added to a mailbox folder (UAL operation AddFolderPermissions), granting a delegate access to a specific folder.	N	Y
Add-MailboxPermission	FullAccess (delegate) mailbox permission was granted, allowing another user to access the mailbox; logged as a mailbox activity even when an admin performs it.	N	Y
AddFolderPermissions	Permissions were added to a mailbox folder, granting another user access to the folder's contents.	Y	Y
Create	Create activity in Exchange mailbox, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
HardDelete	A mailbox item was permanently deleted (hard-deleted) and is not recoverable from the Deleted Items folder.	N	Y
MailboxLogin	A sign-in to a mailbox was recorded by Exchange mailbox auditing.	Y	N
ModifyFolderPermissions	Permissions on a mailbox folder were modified, changing who can access the folder's contents.	Y	Y
MoveToDeletedItems	A mailbox item was moved to the Deleted Items folder.	N	Y
Send	The mailbox user sent, replied to, or forwarded an email message (mailbox Send action).	Y	Y
SendAs	A message was sent using the SendAs permission, sending as though it came from the mailbox owner; a common impersonation technique.	Y	Y
SendOnBehalf	A message was sent using the SendOnBehalf permission, sending on behalf of the mailbox owner.	N	Y
SoftDelete	A mailbox item was soft-deleted (moved to the Recoverable Items / Deleted Items dumpster and recoverable by the user).	N	Y
Update	Update activity in Exchange mailbox, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
UpdateInboxRules	An inbox rule was added, removed, or changed; inbox rules process Inbox messages by condition and are commonly abused for auto-forwarding or evidence deletion.	Y	Y

any: Exchange mailbox activities (per-item) (catch-all)

RecordType: ExchangeItem

Description

Catch-all for M365-ExchangeItem rules matching the RecordType but no specific Operation.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Splunk
`Workload`	2 detection rules	Splunk

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`m365::Folder.Path` (splunk rule field)	in	`\\recoverable items\\deletions`	2 rules	splunk
`m365::Folder.Path` (splunk rule field)	in	`\\sent items`	2 rules	splunk
`Status` (splunk rule field)	eq	`delivered`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Email Send and Hard Delete Exfiltration Behavior source: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches HardDelete
O365 Email Send and Hard Delete Suspicious Behavior source: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches HardDelete, Send, SendAs, SendOnBehalf, SoftDelete

References #

Add-MailboxFolderPermission

RecordType: ExchangeItem

Description

A permission entry was added to a mailbox folder (UAL operation AddFolderPermissions), granting a delegate access to a specific folder.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	3 detection rules	Kusto, Splunk
`UserId`	2 detection rules	Kusto
`TimeGenerated`	1 detection rule	Kusto
`Workload`	1 detection rule	Splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Mailbox Folder Read Permission Granted source: The following analytic identifies instances where read permissions are granted to mailbox folders within an Office 365 environment. It detects this activity by monitoring the o365_management_activity data source for the…T1098, T1098.002

Kusto #

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account source medium: It is possible that a disabled user account is compromised and another account on the same IP is used to perform operations that are not typical for that user. The query filters the SigninLogs for entries where ResultType is indicates a disabled account and the TimeGenerated is within a defined time range. It then summarizes these entries by IPAddress and AppId, calculating various statistics such as number of login attempts, distinct UPNs, App IDs etc and joins these results with another set of results from SigninLogs, filtering for entries with less than normal number of successful sign-ins. It then filters out entries where there were no successful sign-ins or where successful sign-ins did not occur within the same lookback period as the failed sign-ins, later projecting relevant fields by the count of login attempts, and expands the set of successful sign-ins into individual events. Finally, it joins these results with entries from OfficeActivity where certain operations deemed rare and high risk have been performed, ensuring their occurrance within a certain time range of the successful sign-ins.T1078, T1098, T1114↳ also matches Add-MailboxPermission
Rare and potentially high-risk Office operations source low: Identifies Office operations that are typically rare and can provide capabilities useful to attackers.T1098, T1114↳ also matches Add-MailboxPermission

References #

Add-MailboxPermission

RecordType: ExchangeItem

Description

FullAccess (delegate) mailbox permission was granted, allowing another user to access the mailbox; logged as a mailbox activity even when an admin performs it.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	4 detection rules	Kusto, Splunk
`UserId`	2 detection rules	Kusto
`AccessRights`	1 detection rule	Splunk
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`o365.audit.Parameters.AccessRights`	1 detection rule	Elastic
`ResultStatus`	1 detection rule	Kusto
`TimeGenerated`	1 detection rule	Kusto
`user.id`	1 detection rule	Elastic
`UserType`	1 detection rule	Elastic
`Workload`	1 detection rule	Splunk

Common Indicators #

Field	Kind	Value	Rules	Vendors
`AccessRights`	eq	`fullaccess`	2 rules	elastic, splunk
`AccessRights` (splunk rule field)	eq	`changeowner`	1 rule	splunk
`AccessRights` (splunk rule field)	eq	`changepermission`	1 rule	splunk
`Parameters[3].Value` (kusto rule field)	contains	`fullaccess`	1 rule	kusto
`ResultStatus` (kusto rule field)	eq	`True`	1 rule	kusto
`event.outcome` (elastic rule field)	eq	`success`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Exchange Mailbox High-Risk Permission Delegated source low: Identifies the assignment of rights to access content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target organization while creating inbox rules, so messages can evade spam/phishing detection mechanisms.T1098, T1098.002

Splunk #

O365 Elevated Mailbox Permission Assigned source: The following analytic identifies the assignment of elevated mailbox permissions in an Office 365 environment via the Add-MailboxPermission operation. It leverages logs from the Exchange workload in the o365_management_activity data…T1098, T1098.002

Kusto #

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account source medium: It is possible that a disabled user account is compromised and another account on the same IP is used to perform operations that are not typical for that user. The query filters the SigninLogs for entries where ResultType is indicates a disabled account and the TimeGenerated is within a defined time range. It then summarizes these entries by IPAddress and AppId, calculating various statistics such as number of login attempts, distinct UPNs, App IDs etc and joins these results with another set of results from SigninLogs, filtering for entries with less than normal number of successful sign-ins. It then filters out entries where there were no successful sign-ins or where successful sign-ins did not occur within the same lookback period as the failed sign-ins, later projecting relevant fields by the count of login attempts, and expands the set of successful sign-ins into individual events. Finally, it joins these results with entries from OfficeActivity where certain operations deemed rare and high risk have been performed, ensuring their occurrance within a certain time range of the successful sign-ins.T1078, T1098, T1114↳ also matches Add-MailboxFolderPermission
Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt source medium: This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group. Ensure this impossible travel incident with increase of privileges is legitimate in your environment.T1078, T1548
Rare and potentially high-risk Office operations source low: Identifies Office operations that are typically rare and can provide capabilities useful to attackers.T1098, T1114↳ also matches Add-MailboxFolderPermission

References #

AddFolderPermissions

RecordType: ExchangeItem

Description

Permissions were added to a mailbox folder, granting another user access to the folder's contents.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`object`	1 detection rule	Splunk
`Operation`	1 detection rule	Splunk
`Workload`	1 detection rule	Splunk

Example Audit Record #

{
  "ClientIP": "::1",
  "ClientIPAddress": "::1",
  "ClientInfoString": "Client=WebServices;Action=ConfigureGroupMailbox",
  "CreationTime": "2026-07-04T16:14:07Z",
  "ExternalAccess": true,
  "Id": "a13c7c20-7e3e-4b97-60c5-08ded9e74629",
  "InternalLogonType": 1,
  "Item": {
    "Id": "LgAAAABMYtd4GPx9R7PxdHNLUNBPAQAuIGs53Y6iSr2GkXQN/2i/AAAAAAENAAAC",
    "ImmutableId": "ErrorDuringIdConversion",
    "ParentFolder": {
      "Id": "LgAAAABMYtd4GPx9R7PxdHNLUNBPAQAuIGs53Y6iSr2GkXQN/2i/AAAAAAENAAAC",
      "MemberRights": "ReadAny, Create, EditOwned, DeleteOwned, EditAny, DeleteAny, Visible, FreeBusySimple, FreeBusyDetailed",
      "MemberSid": "S-1-8-3887482716-1326096224-1882406844-699167947-0",
      "MemberUpn": "Owner@local",
      "Name": "Calendar",
      "Path": "\\Calendar"
    }
  },
  "LogonType": 1,
  "LogonUserSid": "S-1-5-80-447828073-3829008076-3733868015-3112024911-3885364408",
  "MailboxGuid": "e7b6475c-9f60-4f0a-bc3f-3370cb74ac29",
  "MailboxOwnerMasterAccountSid": "S-1-5-10",
  "MailboxOwnerSid": "S-1-5-21-2202824495-2635967380-1894632064-35782174",
  "MailboxOwnerUPN": "AllCompany.181245214720.zzjydiec@example.onmicrosoft.com",
  "Operation": "AddFolderPermissions",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "OrganizationName": "example.onmicrosoft.com",
  "OriginatingServer": "DS4PR16MB7145 (15.20.4200.000)\r\n",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "UserId": "S-1-5-80-447828073-3829008076-3733868015-3112024911-3885364408",
  "UserKey": "00000000-0000-0000-0000-000000000000",
  "UserType": 2,
  "Version": 1,
  "Workload": "Exchange"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`group.name` (splunk rule field)	ne	`calendar`	1 rule	splunk
`group.name` (splunk rule field)	ne	`contacts`	1 rule	splunk
`group.name` (splunk rule field)	ne	`personmetadata`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Mailbox Folder Read Permission Assigned source: The following analytic identifies instances where read permissions are assigned to mailbox folders within an Office 365 environment. It leverages the o365_management_activity data source, specifically monitoring the…T1098, T1098.002↳ also matches ModifyFolderPermissions

References #

Create

RecordType: ExchangeItem

Description

Create activity in Exchange mailbox, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "ActorInfoString": "Client=REST;python-requests/2.34.2[AppId=22222222-2222-2222-2222-222222222222];",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "IssuedAtTime": "2026-07-04T15:04:45Z",
    "UniqueTokenId": "pO6tpCIhWEeDjtm8HsIAAA"
  },
  "AppId": "00000003-0000-0000-c000-000000000000",
  "AuthType": "MSAuth1.0",
  "ClientAppId": "22222222-2222-2222-2222-222222222222",
  "ClientIP": "203.0.113.10",
  "ClientIPAddress": "203.0.113.10",
  "ClientInfoString": "Client=REST;;",
  "ClientRequestId": "1a689a70-c828-402c-82e8-10b44c2bee66",
  "CreationTime": "2026-07-04T15:09:47Z",
  "ExternalAccess": false,
  "HostAppId": "c999ed3e-27ae-4cb3-b3a2-46b056af63d3",
  "Id": "f43f0730-a65d-4238-97d9-08ded9de49be",
  "InternalLogonType": 0,
  "Item": {
    "Id": "RgAAAAAXRoXzP5fNR6PyEo/HqixABwA7mE7t4w9CSqNKCbVE7kkMAAAAAAEPAAA7mE7t4w9CSqNKCbVE7kkMAABt2TLTAAAJ",
    "ImmutableId": "LgAAAAAdhAMRqmYRzZvIAKoAL8RaDQA7mE7t4w9CSqNKCbVE7kkMAABt2ebvAAAJ",
    "InternetMessageId": "<SA1PR16MB4707133E40F11D3AF6535600A2F32@SA1PR16MB4707.namprd16.prod.outlook.com>",
    "IsRecord": false,
    "ParentFolder": {
      "Id": "LgAAAAAXRoXzP5fNR6PyEo/HqixAAQA7mE7t4w9CSqNKCbVE7kkMAAAAAAEPAAAB",
      "Path": "\\Drafts"
    },
    "SizeInBytes": 2824,
    "Subject": "dw-harness-afc127f4 move-test"
  },
  "LogonType": 0,
  "LogonUserSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxGuid": "2bc72b5a-02f0-45d2-97a2-5f0152098603",
  "MailboxOwnerSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxOwnerUPN": "adminuser@example.onmicrosoft.com",
  "Operation": "Create",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "OrganizationName": "example.onmicrosoft.com",
  "OriginatingServer": "SA1PR16MB4707 (15.20.4200.000)\r\n",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "TokenObjectId": "11111111-1111-1111-1111-111111111111",
  "TokenTenantId": "00000000-0000-0000-0000-000000000001",
  "TokenType": "AadPft",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "10000000AAAAAAAA",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange"
}

References #

HardDelete

RecordType: ExchangeItem

Description

A mailbox item was permanently deleted (hard-deleted) and is not recoverable from the Deleted Items folder.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	5 detection rules	Splunk
`Workload`	5 detection rules	Splunk
`Folder.Path`	4 detection rules	Splunk
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`o365.audit.AffectedItems.Subject`	1 detection rule	Elastic

Common Indicators #

Field	Kind	Value	Rules	Vendors
`m365::Folder.Path` (splunk rule field)	in	`\\recoverable items\\deletions`	4 rules	splunk
`m365::Folder.Path` (splunk rule field)	in	`\\sent items`	4 rules	splunk
`subject` (splunk rule field)	in	`account recovery`	2 rules	splunk
`subject` (splunk rule field)	in	`banking`	2 rules	splunk
`subject` (splunk rule field)	in	`direct deposit`	2 rules	splunk
`subject` (splunk rule field)	in	`mfa `	2 rules	splunk
`subject` (splunk rule field)	in	`otp `	2 rules	splunk
`subject` (splunk rule field)	in	`passcode `	2 rules	splunk
`subject` (splunk rule field)	in	`password `	2 rules	splunk
`subject` (splunk rule field)	in	`pay-to`	2 rules	splunk
`Status` (splunk rule field)	eq	`delivered`	1 rule	splunk
`count` (splunk rule field)	gt	`50`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Exchange MFA Notification Email Deleted or Moved source low: Identifies when an MFA enrollment, registration, or security notification email is deleted or moved to deleted items in Microsoft 365 Exchange. Adversaries who compromise accounts and register their own MFA device often delete the notification emails to cover their tracks and prevent the legitimate user from noticing the unauthorized change. This technique is commonly observed in business email compromise (BEC) and account takeover attacks.T1070, T1070.008, T1098, T1098.005↳ also matches MoveToDeletedItems, SoftDelete

Splunk #

O365 Email Hard Delete Excessive Volume source: The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to…T1070, T1070.008, T1485↳ also matches Send, SendAs, SendOnBehalf
O365 Email Password and Payroll Compromise Behavior source: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches SoftDelete
O365 Email Receive and Hard Delete Takeover Behavior source: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor…T1070, T1070.008, T1114, T1114.001, T1485

Show 2 more (5 total) on the rules page

References #

MailboxLogin

RecordType: ExchangeItem

Description

A sign-in to a mailbox was recorded by Exchange mailbox auditing.

Example Audit Record #

{
  "ClientIP": "223.236.114.61",
  "ClientIPAddress": "223.236.114.61",
  "ClientInfoString": "Client=/owa/SuiteServiceProxy.aspx; Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36",
  "CreationTime": "2020-12-16T04:57:50",
  "ExternalAccess": false,
  "Id": "ef8f13e2-d588-483c-0a0c-08d8a17f2384",
  "InternalLogonType": 0,
  "LogonType": 0,
  "LogonUserSid": "S-1-5-21-2181005278-2312080842-1333184807-3028140",
  "MailboxGuid": "49277dc2-e091-4bf8-96a8-695246b9d09b",
  "MailboxOwnerSid": "S-1-5-21-2181005278-2312080842-1333184807-3028140",
  "MailboxOwnerUPN": "admin@a830edad9050849NDA3079.onmicrosoft.com",
  "Operation": "MailboxLogin",
  "OrganizationId": "2ed28a74-1f6f-4829-8530-fe359c77d35c",
  "OrganizationName": "a830edad9050849NDA3079.onmicrosoft.com",
  "OriginatingServer": "CY4PR12MB1445",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "SessionId": "4ffecc86-c88d-4521-be31-450c4daebbdc",
  "UserId": "admin@a830edad9050849NDA3079.onmicrosoft.com",
  "UserKey": "10037FFE8EC1E08E",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange"
}

References #

ModifyFolderPermissions

RecordType: ExchangeItem

Description

Permissions on a mailbox folder were modified, changing who can access the folder's contents.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`object`	2 detection rules	Splunk
`Operation`	2 detection rules	Splunk
`Workload`	2 detection rules	Splunk
`Item.ParentFolder.MemberUpn`	1 detection rule	Splunk

Example Audit Record #

{
  "ClientIP": "::1",
  "ClientIPAddress": "::1",
  "ClientInfoString": "Client=WebServices;Action=ConfigureGroupMailbox",
  "CreationTime": "2026-07-04T16:14:08Z",
  "ExternalAccess": true,
  "Id": "3e8a0b6b-cdee-4a26-217f-08ded9e74717",
  "InternalLogonType": 1,
  "Item": {
    "Id": "LgAAAABMYtd4GPx9R7PxdHNLUNBPAQAuIGs53Y6iSr2GkXQN/2i/AAAAAAEfAAAB",
    "ImmutableId": "ErrorDuringIdConversion",
    "ParentFolder": {
      "Id": "LgAAAABMYtd4GPx9R7PxdHNLUNBPAQAuIGs53Y6iSr2GkXQN/2i/AAAAAAEfAAAB",
      "MemberRights": "ReadAny, Create, EditOwned, DeleteOwned, EditAny, DeleteAny, Visible, FreeBusySimple, FreeBusyDetailed",
      "MemberSid": "S-1-8-3887482716-1326096224-1882406844-699167947-0",
      "MemberUpn": "Owner@local",
      "Name": "Team Chat",
      "Path": "\\Conversation History\\Team Chat"
    }
  },
  "LogonType": 1,
  "LogonUserSid": "S-1-5-80-447828073-3829008076-3733868015-3112024911-3885364408",
  "MailboxGuid": "e7b6475c-9f60-4f0a-bc3f-3370cb74ac29",
  "MailboxOwnerMasterAccountSid": "S-1-5-10",
  "MailboxOwnerSid": "S-1-5-21-2202824495-2635967380-1894632064-35782174",
  "MailboxOwnerUPN": "AllCompany.181245214720.zzjydiec@example.onmicrosoft.com",
  "Operation": "ModifyFolderPermissions",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "OrganizationName": "example.onmicrosoft.com",
  "OriginatingServer": "DS4PR16MB7145 (15.20.4200.000)\r\n",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "UserId": "S-1-5-80-447828073-3829008076-3733868015-3112024911-3885364408",
  "UserKey": "00000000-0000-0000-0000-000000000000",
  "UserType": 2,
  "Version": 1,
  "Workload": "Exchange"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`Item.ParentFolder.MemberUpn` (splunk rule field)	eq	`everyone`	1 rule	splunk
`group.name` (splunk rule field)	eq	`inbox`	1 rule	splunk
`group.name` (splunk rule field)	ne	`calendar`	1 rule	splunk
`group.name` (splunk rule field)	ne	`contacts`	1 rule	splunk
`group.name` (splunk rule field)	ne	`personmetadata`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Mailbox Inbox Folder Shared with All Users source: The following analytic detects instances where the inbox folder of an Office 365 mailbox is shared with all users within the tenant. It leverages Office 365 management activity events to identify when the 'Inbox' folder permissions are…T1114, T1114.002
O365 Mailbox Folder Read Permission Assigned source: The following analytic identifies instances where read permissions are assigned to mailbox folders within an Office 365 environment. It leverages the o365_management_activity data source, specifically monitoring the…T1098, T1098.002↳ also matches AddFolderPermissions

References #

MoveToDeletedItems

RecordType: ExchangeItem

Description

A mailbox item was moved to the Deleted Items folder.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`o365.audit.AffectedItems.Subject`	1 detection rule	Elastic

Common Indicators #

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`2-step`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`2fa`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`authenticator`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device activate`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device added`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device change`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device configure`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device enroll`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device register`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device setup`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device update`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`device verify`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`factor activate`	1 rule	elastic
`o365.audit.AffectedItems.Subject` (elastic rule field)	contains	`factor added`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Exchange MFA Notification Email Deleted or Moved source low: Identifies when an MFA enrollment, registration, or security notification email is deleted or moved to deleted items in Microsoft 365 Exchange. Adversaries who compromise accounts and register their own MFA device often delete the notification emails to cover their tracks and prevent the legitimate user from noticing the unauthorized change. This technique is commonly observed in business email compromise (BEC) and account takeover attacks.T1070, T1070.008, T1098, T1098.005↳ also matches HardDelete, SoftDelete

References #

Send

RecordType: ExchangeItem

Description

The mailbox user sent, replied to, or forwarded an email message (mailbox Send action).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	3 detection rules	Splunk
`Workload`	3 detection rules	Splunk
`Folder.Path`	2 detection rules	Splunk

Example Audit Record #

{
  "ActorInfoString": "Client=REST;python-requests/2.34.2[AppId=22222222-2222-2222-2222-222222222222];",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "IssuedAtTime": "2026-07-04T15:04:45Z",
    "UniqueTokenId": "pO6tpCIhWEeDjtm8HsIAAA"
  },
  "AppId": "00000003-0000-0000-c000-000000000000",
  "AuthType": "MSAuth1.0",
  "ClientAppId": "22222222-2222-2222-2222-222222222222",
  "ClientIP": "203.0.113.10",
  "ClientIPAddress": "203.0.113.10",
  "ClientInfoString": "Client=REST;;",
  "ClientRequestId": "4f090712-2278-4b01-b594-afd205ca5f2a",
  "CreationTime": "2026-07-04T15:09:46Z",
  "ExternalAccess": false,
  "HostAppId": "c999ed3e-27ae-4cb3-b3a2-46b056af63d3",
  "Id": "162e2810-3ab6-4a06-86bf-08ded9de493f",
  "InternalLogonType": 0,
  "Item": {
    "Id": "RgAAAAAXRoXzP5fNR6PyEo/HqixABwA7mE7t4w9CSqNKCbVE7kkMAAAAAAEPAAA7mE7t4w9CSqNKCbVE7kkMAABt2TLRAAAJ",
    "ImmutableId": "LgAAAAAdhAMRqmYRzZvIAKoAL8RaDQA7mE7t4w9CSqNKCbVE7kkMAABt2ebnAAAJ",
    "InternetMessageId": "<SA1PR16MB4707CF583F9878E07C434A1DA2F32@SA1PR16MB4707.namprd16.prod.outlook.com>",
    "ParentFolder": {
      "Id": "LgAAAAAXRoXzP5fNR6PyEo/HqixAAQA7mE7t4w9CSqNKCbVE7kkMAAAAAAEPAAAB",
      "Path": "\\Drafts"
    },
    "Recipients": [
      {
        "Address": "adminuser@example.onmicrosoft.com",
        "Name": "Admin User"
      }
    ],
    "RecipientsCount": 1,
    "SizeInBytes": 3094,
    "Subject": "dw-harness-afc127f4 audit test"
  },
  "LogonType": 0,
  "LogonUserSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxGuid": "2bc72b5a-02f0-45d2-97a2-5f0152098603",
  "MailboxOwnerSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxOwnerUPN": "adminuser@example.onmicrosoft.com",
  "Operation": "Send",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "OrganizationName": "example.onmicrosoft.com",
  "OriginatingServer": "SA1PR16MB4707 (15.20.4200.000)\r\n",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "SaveToSentItems": true,
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "TokenObjectId": "11111111-1111-1111-1111-111111111111",
  "TokenTenantId": "00000000-0000-0000-0000-000000000001",
  "TokenType": "AadPft",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "10000000AAAAAAAA",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`m365::Folder.Path` (splunk rule field)	in	`\\recoverable items\\deletions`	2 rules	splunk
`m365::Folder.Path` (splunk rule field)	in	`\\sent items`	2 rules	splunk
`Status` (splunk rule field)	eq	`delivered`	1 rule	splunk
`count` (splunk rule field)	gt	`50`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Email Send Attachments Excessive Volume source: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat…T1070, T1070.008, T1485↳ also matches SendAs, SendOnBehalf
O365 Email Hard Delete Excessive Volume source: The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to…T1070, T1070.008, T1485↳ also matches HardDelete, SendAs, SendOnBehalf
O365 Email Send and Hard Delete Suspicious Behavior source: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches any: Exchange mailbox activities (per-item) (catch-all), HardDelete, SendAs, SendOnBehalf, SoftDelete

References #

SendAs

RecordType: ExchangeItem

Description

A message was sent using the SendAs permission, sending as though it came from the mailbox owner; a common impersonation technique.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	3 detection rules	Splunk
`Workload`	3 detection rules	Splunk
`Folder.Path`	2 detection rules	Splunk

Example Audit Record #

{
  "ActorInfoString": "Client=REST;Client=RESTSystem;Python-urllib/3.11[AppId=151b4737-5960-4f64-b94c-e7f890c955fa];",
  "AppAccessContext": {
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "151b4737-5960-4f64-b94c-e7f890c955fa",
    "IssuedAtTime": "2026-07-25T21:32:09",
    "UniqueTokenId": "UfJmJthOG0-myf6YW2gnAA"
  },
  "AppId": "00000003-0000-0000-c000-000000000000",
  "AuthType": "MSAuth1.0",
  "ClientAppId": "151b4737-5960-4f64-b94c-e7f890c955fa",
  "ClientIP": "203.0.113.10",
  "ClientIPAddress": "203.0.113.10",
  "ClientInfoString": "Client=REST;Client=RESTSystem;;",
  "ClientRequestId": "ba4f3dc4-4417-4ee9-ab39-f9bc4ea4b1ca",
  "CreationDate": "2026-07-25T21:37:10",
  "CreationTime": "2026-07-25T21:37:10",
  "ExternalAccess": false,
  "HostAppId": "c999ed3e-27ae-4cb3-b3a2-46b056af63d3",
  "Id": "4b8d0d8f-5918-433f-eac6-08deea94e258",
  "InternalLogonType": 0,
  "Item": {
    "Id": "RgAAAAAXRoXzP5fNR6PyEo/HqixABwA7mE7t4w9CSqNKCbVE7kkMAAAAAAEPAAA7mE7t4w9CSqNKCbVE7kkMAAB83/fxAAAJ",
    "ImmutableId": "ErrorDuringIdConversion",
    "InternetMessageId": "<SA1PR16MB4707AF614409B18A40D8FDB1A2CE2@SA1PR16MB4707.namprd16.prod.outlook.com>",
    "ParentFolder": {
      "Id": "LgAAAAAXRoXzP5fNR6PyEo/HqixAAQA7mE7t4w9CSqNKCbVE7kkMAAAAAAEPAAAB",
      "Path": "\\Drafts"
    },
    "Recipients": [
      {
        "Address": "adminuser@example.onmicrosoft.com",
        "Name": "Admin User"
      }
    ],
    "RecipientsCount": 1,
    "SizeInBytes": 3232,
    "Subject": "dwharn rt2probe1 SendAs probe"
  },
  "LogonType": 2,
  "LogonUserSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxGuid": "2bc72b5a-02f0-45d2-97a2-5f0152098603",
  "MailboxOwnerSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxOwnerUPN": "adminuser@example.onmicrosoft.com",
  "Operation": "SendAs",
  "Operations": "SendAs",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "OrganizationName": "example.onmicrosoft.com",
  "OriginatingServer": "SA1PR16MB4707 (15.20.4200.000)\r\n",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "SaveToSentItems": true,
  "SendAsUserMailboxGuid": "2da5bd57-8c8a-49c4-abf0-1764cf8d63c3",
  "SendAsUserSmtp": "dwharn-shared@example.onmicrosoft.com",
  "TokenObjectId": "dd86db54-3d88-43c1-a8a9-60841a369ec0",
  "TokenTenantId": "00000000-0000-0000-0000-000000000001",
  "TokenType": "AadPft",
  "UserId": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "UserKey": "151b4737-5960-4f64-b94c-e7f890c955fa",
  "UserType": "Application",
  "Version": 1,
  "Workload": "Exchange"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`m365::Folder.Path` (splunk rule field)	in	`\\recoverable items\\deletions`	2 rules	splunk
`m365::Folder.Path` (splunk rule field)	in	`\\sent items`	2 rules	splunk
`Status` (splunk rule field)	eq	`delivered`	1 rule	splunk
`count` (splunk rule field)	gt	`50`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Email Hard Delete Excessive Volume source: The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to…T1070, T1070.008, T1485↳ also matches HardDelete, Send, SendOnBehalf
O365 Email Send and Hard Delete Suspicious Behavior source: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches any: Exchange mailbox activities (per-item) (catch-all), HardDelete, Send, SendOnBehalf, SoftDelete
O365 Email Send Attachments Excessive Volume source: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat…T1070, T1070.008, T1485↳ also matches Send, SendOnBehalf

References #

SendOnBehalf

RecordType: ExchangeItem

Description

A message was sent using the SendOnBehalf permission, sending on behalf of the mailbox owner.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	3 detection rules	Splunk
`Workload`	3 detection rules	Splunk
`Folder.Path`	2 detection rules	Splunk

Common Indicators #

Field	Kind	Value	Rules	Vendors
`m365::Folder.Path` (splunk rule field)	in	`\\recoverable items\\deletions`	2 rules	splunk
`m365::Folder.Path` (splunk rule field)	in	`\\sent items`	2 rules	splunk
`Status` (splunk rule field)	eq	`delivered`	1 rule	splunk
`count` (splunk rule field)	gt	`50`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Email Hard Delete Excessive Volume source: The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to…T1070, T1070.008, T1485↳ also matches HardDelete, Send, SendAs
O365 Email Send and Hard Delete Suspicious Behavior source: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches any: Exchange mailbox activities (per-item) (catch-all), HardDelete, Send, SendAs, SoftDelete
O365 Email Send Attachments Excessive Volume source: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat…T1070, T1070.008, T1485↳ also matches Send, SendAs

References #

SoftDelete

RecordType: ExchangeItem

Description

A mailbox item was soft-deleted (moved to the Recoverable Items / Deleted Items dumpster and recoverable by the user).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Splunk
`Workload`	2 detection rules	Splunk
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`Folder.Path`	1 detection rule	Splunk
`o365.audit.AffectedItems.Subject`	1 detection rule	Elastic

Common Indicators #

Field	Kind	Value	Rules	Vendors
`m365::Folder.Path` (splunk rule field)	in	`\\recoverable items\\deletions`	1 rule	splunk
`m365::Folder.Path` (splunk rule field)	in	`\\sent items`	1 rule	splunk
`subject` (splunk rule field)	in	`account recovery`	1 rule	splunk
`subject` (splunk rule field)	in	`banking`	1 rule	splunk
`subject` (splunk rule field)	in	`direct deposit`	1 rule	splunk
`subject` (splunk rule field)	in	`mfa `	1 rule	splunk
`subject` (splunk rule field)	in	`otp `	1 rule	splunk
`subject` (splunk rule field)	in	`passcode `	1 rule	splunk
`subject` (splunk rule field)	in	`password `	1 rule	splunk
`subject` (splunk rule field)	in	`pay-to`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Exchange MFA Notification Email Deleted or Moved source low: Identifies when an MFA enrollment, registration, or security notification email is deleted or moved to deleted items in Microsoft 365 Exchange. Adversaries who compromise accounts and register their own MFA device often delete the notification emails to cover their tracks and prevent the legitimate user from noticing the unauthorized change. This technique is commonly observed in business email compromise (BEC) and account takeover attacks.T1070, T1070.008, T1098, T1098.005↳ also matches HardDelete, MoveToDeletedItems

Splunk #

O365 Email Password and Payroll Compromise Behavior source: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches HardDelete
O365 Email Send and Hard Delete Suspicious Behavior source: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove…T1070, T1070.008, T1114, T1114.001, T1485↳ also matches any: Exchange mailbox activities (per-item) (catch-all), HardDelete, Send, SendAs, SendOnBehalf

References #

Update

RecordType: ExchangeItem

Description

Update activity in Exchange mailbox, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "ActorInfoString": "Client=REST;python-requests/2.34.2[AppId=22222222-2222-2222-2222-222222222222];",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "IssuedAtTime": "2026-07-04T15:04:45Z",
    "UniqueTokenId": "pO6tpCIhWEeDjtm8HsIAAA"
  },
  "AppId": "00000003-0000-0000-c000-000000000000",
  "AuthType": "MSAuth1.0",
  "ClientAppId": "22222222-2222-2222-2222-222222222222",
  "ClientIP": "203.0.113.10",
  "ClientIPAddress": "203.0.113.10",
  "ClientInfoString": "Client=REST;;",
  "ClientRequestId": "ce23ec0b-1ca3-4b0e-aad7-555dd5f12c3a",
  "CreationTime": "2026-07-04T15:09:49Z",
  "ExternalAccess": false,
  "HostAppId": "c999ed3e-27ae-4cb3-b3a2-46b056af63d3",
  "Id": "769f1bb4-de68-47d7-e8e0-08ded9de4a9d",
  "InternalLogonType": 0,
  "Item": {
    "Id": "RgAAAAAXRoXzP5fNR6PyEo/HqixABwA7mE7t4w9CSqNKCbVE7kkMAAAAAAENAAA7mE7t4w9CSqNKCbVE7kkMAABt2T6TAAAP",
    "ImmutableId": "LgAAAAAdhAMRqmYRzZvIAKoAL8RaDQA7mE7t4w9CSqNKCbVE7kkMAABt2erfAAAP",
    "InternetMessageId": "<SA1PR16MB4707803C250B4D869491F367A2F32@SA1PR16MB4707.namprd16.prod.outlook.com>",
    "IsRecord": false,
    "ParentFolder": {
      "Id": "LgAAAAAXRoXzP5fNR6PyEo/HqixAAQA7mE7t4w9CSqNKCbVE7kkMAAAAAAENAAAC",
      "Path": "\\Calendar"
    },
    "SizeInBytes": 4710,
    "Subject": "dw-harness-afc127f4 calendar test (updated)"
  },
  "LogonType": 0,
  "LogonUserSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxGuid": "2bc72b5a-02f0-45d2-97a2-5f0152098603",
  "MailboxOwnerSid": "S-1-5-21-2202824495-2635967380-1894632064-31996139",
  "MailboxOwnerUPN": "adminuser@example.onmicrosoft.com",
  "ModifiedProperties": [
    "MapiSubject",
    "NormalizedSubjectInternal"
  ],
  "Operation": "Update",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "OrganizationName": "example.onmicrosoft.com",
  "OriginatingServer": "SA1PR16MB4707 (15.20.4200.000)\r\n",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "TokenObjectId": "11111111-1111-1111-1111-111111111111",
  "TokenTenantId": "00000000-0000-0000-0000-000000000001",
  "TokenType": "AadPft",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "10000000AAAAAAAA",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange"
}

References #

UpdateInboxRules

RecordType: ExchangeItem

Description

An inbox rule was added, removed, or changed; inbox rules process Inbox messages by condition and are commonly abused for auto-forwarding or evidence deletion.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Sigma, Splunk
`OperationProperties`	1 detection rule	Sigma
`Parameters`	1 detection rule	Sigma
`Workload`	1 detection rule	Splunk

Example Audit Record #

{
  "CreationTime": "2024-03-27T22:25:09",
  "Id": "8c6e96d4-f00c-4ccf-98f0-08dc4eacc2f0",
  "Operation": "UpdateInboxRules",
  "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4",
  "RecordType": 2,
  "ResultStatus": "Succeeded",
  "UserKey": "100320030DF47B14",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange",
  "ClientIP": "120.1.121.43",
  "UserId": "user15@splunkresearch.com",
  "AppId": "00b41c95-dab0-4487-9791-b9d2c32c80f2",
  "ClientIPAddress": "120.1.121.43",
  "ClientInfoString": "Client=WebServices;python-requests/2.25.1;",
  "ExternalAccess": false,
  "InternalLogonType": 0,
  "LogonType": 0,
  "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764",
  "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859",
  "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764",
  "MailboxOwnerUPN": "user15@splunkresearch.com",
  "OperationProperties": [
    {
      "Name": "Actions",
      "Value": "ForwardToRecipientsAction"
    },
    {
      "Name": "Conditions",
      "Value": "ContainsBodyStringCondition"
    },
    {
      "Name": "Provider",
      "Value": "RuleOrganizer"
    },
    {
      "Name": "RemoveOutlookRuleBlob"
    },
    {
      "Name": "Name",
      "Value": "haags rule"
    },
    {
      "Name": "IsNew",
      "Value": "True"
    },
    {
      "Name": "IsDirty",
      "Value": "True"
    },
    {
      "Name": "RuleOperation",
      "Value": "Create"
    },
    {
      "Name": "ServerRule",
      "Value": {
        "ID": 0,
        "IDx": null,
        "ExecutionSequence": 10,
        "Level": 0,
        "StateFlags": 1,
        "UserFlags": 0,
        "Condition": {
          "Flags": 65537,
          "PropTag": {},
          "PropValue": {
            "PropTag": {},
            "PropType": 31,
            "Value": "gitlabs",
            "RawValue": "gitlabs"
          },
          "MultiValued": false,
          "Type": 3
        },
        "Actions": [
          {
            "Flags": 0,
            "Recipients": [
              {
                "Values": [
                  {
                    "PropTag": {},
                    "PropType": 258,
                    "Value": "AAAAAIErH6S+oxAZnW4A3QEPVAIAAAGAaABhAGEAZwBAAGUAdgBpAGwALgBjAG8AbQAAAFMATQBUAFAAAABoAGEAYQBnAEAAZQB2AGkAbAAuAGMAbwBtAAAA",
                    "RawValue": "AAAAAIErH6S+oxAZnW4A3QEPVAIAAAGAaABhAGEAZwBAAGUAdgBpAGwALgBjAG8AbQAAAFMATQBUAFAAAABoAGEAYQBnAEAAZQB2AGkAbAAuAGMAbwBtAAAA"
                  },
                  {
                    "PropTag": {},
                    "PropType": 31,
                    "Value": "haag@evil.com",
                    "RawValue": "haag@evil.com"
                  },
                  {
                    "PropTag": {},
                    "PropType": 3,
                    "Value": 0,
                    "RawValue": 0
                  },
                  {
                    "PropTag": {},
                    "PropType": 31,
                    "Value": "haag@evil.com",
                    "RawValue": "haag@evil.com"
                  },
                  {
                    "PropTag": {},
                    "PropType": 258,
                    "Value": "U01UUDpIQUFHQEVWSUwuQ09NAA==",
                    "RawValue": "U01UUDpIQUFHQEVWSUwuQ09NAA=="
                  },
                  {
                    "PropTag": {},
                    "PropType": 3,
                    "Value": 1,
                    "RawValue": 1
                  },
                  {
                    "PropTag": {},
                    "PropType": 31,
                    "Value": "SMTP",
                    "RawValue": "SMTP"
                  },
                  {
                    "PropTag": {},
                    "PropType": 31,
                    "Value": "haag@evil.com",
                    "RawValue": "haag@evil.com"
                  }
                ]
              }
            ],
            "UserFlags": 0,
            "ActionType": 7
          }
        ],
        "Name": "haags rule",
        "Provider": "RuleOrganizer",
        "ProviderData": "AQAAAAAAAAAq1HSglYDaAQ==",
        "IsExtended": false,
        "ExtraProperties": null,
        "Operation": 1
      }
    }
  ],
  "OrganizationName": "splunkresearch.com",
  "OriginatingServer": "MN2PR18MB3053 (15.20.4200.000)\r\n",
  "SessionId": "004b39b1-b0a8-4f90-91e4-67dd1b6ca5a8",
  "Item": {
    "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB",
    "ParentFolder": {
      "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB",
      "Name": "Inbox",
      "Path": "Not Available"
    }
  }
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`m365::OperationProperties` (sigma rule field)	contains	`forward`	1 rule	sigma
`m365::OperationProperties` (sigma rule field)	contains	`recipients`	1 rule	sigma
`m365::Parameters` (sigma rule field)	contains	`forwardasattachmentto`	1 rule	sigma
`m365::Parameters` (sigma rule field)	contains	`forwardingaddress`	1 rule	sigma
`m365::Parameters` (sigma rule field)	contains	`forwardingsmtpaddress`	1 rule	sigma
`m365::Parameters` (sigma rule field)	contains	`forwardto`	1 rule	sigma
`m365::Parameters` (sigma rule field)	contains	`redirectto`	1 rule	sigma
`m365::Parameters` (sigma rule field)	contains	`redirecttorecipients`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Mail Forwarding/Redirecting Activity In O365 source medium: Detects email forwarding or redirecting activity in O365 Audit logs.T1020, T1114, T1114.003, T1564, T1564.008

Splunk #

O365 New Email Forwarding Rule Enabled source: The following analytic identifies the creation of new email forwarding rules in an Office 365 environment via the UpdateInboxRules operation. It leverages Office 365 management activity events to detect rules that forward emails to…T1114, T1114.003

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.

Exchange mailbox activities (per-item)

any: Exchange mailbox activities (per-item) (catch-all)

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Splunk #

References #

Add-MailboxFolderPermission

Description

Detection Fields #

Related events #

Detection Rules #

Splunk #

Kusto #

References #

Add-MailboxPermission

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

References #

AddFolderPermissions

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Splunk #

References #

Create

Description

Example Audit Record #

References #

HardDelete

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

References #

MailboxLogin

Description

Example Audit Record #

References #

ModifyFolderPermissions

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Splunk #

References #

MoveToDeletedItems

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Elastic #

References #

Send

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Splunk #

References #

SendAs