Microsoft 365 mailbox audit retention reduced

A mailbox's audit RETENTION was changed with Set-Mailbox -AuditLogAgeLimit.

This is anti-forensics of the quietest kind. Turning auditing off is loud and already alerted on (m365_audit_logging_disabled); shortening how long the audit trail is KEPT leaves auditing switched on, so every posture check still reads green while the evidence ages out from under the investigation. An incident discovered three weeks later then has nothing to read.

Any change to this value is worth a look, not only a change to zero. The audit record shows the NEW limit and never the old one, so "reduced" cannot be decided from a single event — the operation itself is the signal, and the prior retention is something the analyst confirms against tenant policy.

• T1562.008Impair Defenses: Disable or Modify Cloud Logs· Defense Evasion
• T1070Indicator Removal· Defense Evasion

Retention is occasionally lowered on purpose — a licensing downgrade, a storage or compliance cleanup, or a tenant standardising on a shorter window. Three things separate that from tampering: whether the change was made by an admin who routinely administers Exchange, whether it landed on ONE mailbox (tampering usually targets the account under investigation) or across many (policy), and what the new value is — a drop to zero or to a day is not a compliance posture. Check it against the mailbox that other findings already point at; the same account appearing in both is the answer.

Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_mailbox_audit_retention_reduced.yaml, licensed under the Apache License 2.0.

id: cloud.identity.m365_mailbox_audit_retention_reduced
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1562.008, T1070]
description: |
  A mailbox's audit RETENTION was changed with `Set-Mailbox -AuditLogAgeLimit`.

  This is anti-forensics of the quietest kind. Turning auditing off is loud and
  already alerted on (`m365_audit_logging_disabled`); shortening how long the
  audit trail is KEPT leaves auditing switched on, so every posture check still
  reads green while the evidence ages out from under the investigation. An
  incident discovered three weeks later then has nothing to read.

  Any change to this value is worth a look, not only a change to zero. The audit
  record shows the NEW limit and never the old one, so "reduced" cannot be
  decided from a single event — the operation itself is the signal, and the prior
  retention is something the analyst confirms against tenant policy.
match:
  provider: Office365
  event_action_any:
    - Set-Mailbox
  raw_message_contains_any:
    - "AuditLogAgeLimit"
correlation_keys: [user_name, target_user_name]
false_positive_guidance: |
  Retention is occasionally lowered on purpose — a licensing downgrade, a storage
  or compliance cleanup, or a tenant standardising on a shorter window. Three
  things separate that from tampering: whether the change was made by an admin who
  routinely administers Exchange, whether it landed on ONE mailbox (tampering
  usually targets the account under investigation) or across many (policy), and
  what the new value is — a drop to zero or to a day is not a compliance posture.
  Check it against the mailbox that other findings already point at; the same
  account appearing in both is the answer.

• Microsoft 365 Purview policy tamperingSeverity high
• AWS security service disabledSeverity high
• Audit daemon stoppedSeverity high
• Security service stoppedSeverity high
• Security logging registry tamperingSeverity high
• AWS CloudTrail logging disabledSeverity high