Microsoft 365 eDiscovery search
A Microsoft 365 content / eDiscovery / audit search was created or exported (Security & Compliance Center).
What it detects
A Microsoft 365 content / eDiscovery / audit search was created or exported (Security & Compliance Center). Attackers and malicious insiders abuse compliance search to hunt a tenant's mail and documents for valuable data and then export it — a stealthy, admin-grade collection-and-exfiltration path that looks like normal compliance activity. Seen in the sample as AuditSearchCreated and AuditSearchExportJobCreated.
MITRE ATT&CK mapping
False positives and triage
Compliance and legal teams run content searches legitimately. The signal is a search or export by an account not on the compliance team, an unusually broad search scope, or an export right after a suspicious sign-in. Confirm the actor and the search's scope and destination.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_ediscovery_search.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_ediscovery_search
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1114.002, T1213]
description: |
A Microsoft 365 content / eDiscovery / audit search was created or exported
(Security & Compliance Center). Attackers and malicious insiders abuse
compliance search to hunt a tenant's mail and documents for valuable data and
then export it — a stealthy, admin-grade collection-and-exfiltration path that
looks like normal compliance activity. Seen in the sample as AuditSearchCreated
and AuditSearchExportJobCreated.
match:
provider: Office365
event_action_any:
- AuditSearchCreated
- AuditSearchExportJobCreated
- New-ComplianceSearch
- New-ComplianceSearchAction
- SearchCreated
- SearchExported
- eDiscoverySearchStartedOrExported
correlation_keys: [user_name]
false_positive_guidance: |
Compliance and legal teams run content searches legitimately. The signal is a
search or export by an account not on the compliance team, an unusually broad
search scope, or an export right after a suspicious sign-in. Confirm the actor
and the search's scope and destination.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.