Microsoft 365 eDiscovery purge
A compliance search action was run with a PURGE — evidence deleted across every mailbox the search matched, in one command.
What it detects
A compliance search action was run with a PURGE — evidence deleted across every mailbox the search matched, in one command.
This is destruction with administrative reach. An ordinary mass-delete touches one mailbox; a purge action applies the search's scope, so a single command can remove the same message from every recipient in the tenant. It is the cleanup step of a BEC: find the fraudulent thread with a search, then erase it everywhere before anyone reconciles the payment.
Distinct from the pack's other deletion rules because the blast radius is the search, not the mailbox, and because it usually arrives paired with the search that defined it — the two together tell the whole story.
MITRE ATT&CK mapping
False positives and triage
Purge is a real remediation tool: security teams use it to pull a phishing wave out of every mailbox after the fact, and that is both legitimate and common in a tenant with an active SOC. The two are told apart by WHAT was purged and by whom — a phishing cleanup targets an attacker's message and is run by the team that reported it, while an eviction of evidence targets the tenant's own correspondence (invoices, a payment thread) and is run by whoever else was already anomalous. Always retrieve the associated search's terms; a purge is only as interpretable as the query behind it.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/m365_ediscovery_purge.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_ediscovery_purge
version: 1.0.0
status: stable
severity: critical
confidence: 0.8
platforms: [application]
mitre_techniques: [T1070.008, T1485]
description: |
A compliance search action was run with a PURGE — evidence deleted across every
mailbox the search matched, in one command.
This is destruction with administrative reach. An ordinary mass-delete touches one
mailbox; a purge action applies the search's scope, so a single command can remove
the same message from every recipient in the tenant. It is the cleanup step of a
BEC: find the fraudulent thread with a search, then erase it everywhere before
anyone reconciles the payment.
Distinct from the pack's other deletion rules because the blast radius is the
search, not the mailbox, and because it usually arrives paired with the search
that defined it — the two together tell the whole story.
match:
provider: Office365
event_action_any:
- New-ComplianceSearchAction
- Set-ComplianceSearchAction
raw_message_contains_any:
- "Purge"
- "purge"
correlation_keys: [user_name]
false_positive_guidance: |
Purge is a real remediation tool: security teams use it to pull a phishing wave
out of every mailbox after the fact, and that is both legitimate and common in a
tenant with an active SOC. The two are told apart by WHAT was purged and by whom —
a phishing cleanup targets an attacker's message and is run by the team that
reported it, while an eviction of evidence targets the tenant's own correspondence
(invoices, a payment thread) and is run by whoever else was already anomalous.
Always retrieve the associated search's terms; a purge is only as interpretable as
the query behind it.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.