Microsoft 365 mailbox search targeting
A mailbox or compliance search was created or modified whose terms read like reconnaissance for valuable mail rather than an investigation. eDiscovery is…
What it detects
A mailbox or compliance search was created or modified whose terms read like reconnaissance for valuable mail rather than an investigation.
eDiscovery is a legitimate feature that an intruder with admin rights can point at the whole tenant. The distinguishing signal is not the search itself but WHAT it looks for: "password", "wire transfer", "invoice", "acquisition", "confidential" and the like are the vocabulary of someone hunting for money and credentials, not of a legal hold.
The pack already alerts on eDiscovery searches being RUN; this catches the query being written, which is earlier and states the attacker's intent in their own words — the search terms are the best evidence of objective an investigation gets.
MITRE ATT&CK mapping
False positives and triage
Legal, HR and compliance teams run keyword searches for exactly these words in the ordinary course of work — a fraud investigation genuinely searches for "invoice" and "payment", and an M&A matter genuinely searches for "acquisition". Treat the ACTOR as the discriminator: a compliance officer with a case reference is routine; the same search created by an account that has never touched eDiscovery, or shortly after a suspicious sign-in, is not. Check whether a corresponding export or purge action followed, since a search alone takes nothing.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_mailbox_search_targeting.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_search_targeting
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1114.002, T1213]
description: |
A mailbox or compliance search was created or modified whose terms read like
reconnaissance for valuable mail rather than an investigation.
eDiscovery is a legitimate feature that an intruder with admin rights can point
at the whole tenant. The distinguishing signal is not the search itself but WHAT
it looks for: "password", "wire transfer", "invoice", "acquisition", "confidential"
and the like are the vocabulary of someone hunting for money and credentials, not
of a legal hold.
The pack already alerts on eDiscovery searches being RUN; this catches the query
being written, which is earlier and states the attacker's intent in their own
words — the search terms are the best evidence of objective an investigation gets.
match:
provider: Office365
event_action_any:
- New-MailboxSearch
- Set-MailboxSearch
- New-ComplianceSearch
- Set-ComplianceSearch
raw_message_contains_any:
- "password"
- "wire transfer"
- "wiretransfer"
- "bank"
- "invoice"
- "acquisition"
- "confidential"
- "credential"
- "payment"
correlation_keys: [user_name]
false_positive_guidance: |
Legal, HR and compliance teams run keyword searches for exactly these words in the
ordinary course of work — a fraud investigation genuinely searches for "invoice"
and "payment", and an M&A matter genuinely searches for "acquisition". Treat the
ACTOR as the discriminator: a compliance officer with a case reference is routine;
the same search created by an account that has never touched eDiscovery, or shortly
after a suspicious sign-in, is not. Check whether a corresponding export or purge
action followed, since a search alone takes nothing.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.