Microsoft 365 audit logging disabled
Microsoft 365 unified audit logging was turned off (Set-AdminAuditLogConfig with UnifiedAuditLogIngestionEnabled = False, or a mailbox audit bypass).
What it detects
Microsoft 365 unified audit logging was turned off (Set-AdminAuditLogConfig with UnifiedAuditLogIngestionEnabled = False, or a mailbox audit bypass). Disabling cloud audit logs blinds the defender and is a strong indicator that an attacker with admin access is preparing to operate unobserved.
MITRE ATT&CK mapping
- T1562.008Impair Defenses: Disable or Modify Cloud Logs· Defense Evasion
False positives and triage
Legitimate audit-config changes are rare and should always be planned. Treat any disable of unified audit ingestion as high-priority until tied to an approved change; confirm who made it and whether their account shows other suspicious activity around the same time.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/cloud/m365_audit_logging_disabled.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_audit_logging_disabled
version: 1.0.0
status: stable
severity: high
confidence: 0.85
platforms: [application]
mitre_techniques: [T1562.008]
description: |
Microsoft 365 unified audit logging was turned off (Set-AdminAuditLogConfig with
UnifiedAuditLogIngestionEnabled = False, or a mailbox audit bypass). Disabling
cloud audit logs blinds the defender and is a strong indicator that an attacker
with admin access is preparing to operate unobserved.
match:
provider: Office365
event_action_any:
- Set-AdminAuditLogConfig
- Set-MailboxAuditBypassAssociation
raw_message_contains_any:
- "UnifiedAuditLogIngestionEnabled=False"
- "AuditBypassEnabled=True"
correlation_keys: [user_name]
false_positive_guidance: |
Legitimate audit-config changes are rare and should always be planned. Treat any
disable of unified audit ingestion as high-priority until tied to an approved
change; confirm who made it and whether their account shows other suspicious
activity around the same time.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.