Microsoft 365 search export downloaded
An eDiscovery search export was DOWNLOADED — the results of a search pulled out of the tenant as one archive.
What it detects
An eDiscovery search export was DOWNLOADED — the results of a search pulled out of the tenant as one archive.
This is the exfiltration step that defeats volume-based detection by design. Opening five hundred files trips a mass-access rule; pooling those same files into a compliance export and downloading one archive produces a handful of events. The data leaves in bulk while the per-item telemetry stays quiet.
The pack alerts on searches being created and run; this is the moment the results actually leave, which is the last point at which anything can be done about it. Critical because by the time this event exists the data is already outside the tenant.
MITRE ATT&CK mapping
False positives and triage
Legal and compliance teams download exports as their job, so the presence of this event is not itself the finding — WHO and WHEN are. Check the actor against the people who run eDiscovery in this tenant, the time against their working hours, and the source address against the corporate range. An export downloaded outside business hours, from an unfamiliar address, or by an account with no compliance role should be treated as data already gone. Pull the originating search's terms and scope: they say what was taken, which is the first thing an incident report needs.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_search_export_downloaded.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_search_export_downloaded
version: 1.0.0
status: stable
severity: critical
confidence: 0.7
platforms: [application]
mitre_techniques: [T1213.002, T1530]
description: |
An eDiscovery search export was DOWNLOADED — the results of a search pulled out
of the tenant as one archive.
This is the exfiltration step that defeats volume-based detection by design.
Opening five hundred files trips a mass-access rule; pooling those same files
into a compliance export and downloading one archive produces a handful of
events. The data leaves in bulk while the per-item telemetry stays quiet.
The pack alerts on searches being created and run; this is the moment the results
actually leave, which is the last point at which anything can be done about it.
Critical because by the time this event exists the data is already outside the
tenant.
match:
provider: Office365
event_action_any:
- SearchExportDownloaded
- ViewedSearchExported
- SearchExported
correlation_keys: [user_name, source_ip]
false_positive_guidance: |
Legal and compliance teams download exports as their job, so the presence of this
event is not itself the finding — WHO and WHEN are. Check the actor against the
people who run eDiscovery in this tenant, the time against their working hours,
and the source address against the corporate range. An export downloaded outside
business hours, from an unfamiliar address, or by an account with no compliance
role should be treated as data already gone. Pull the originating search's terms
and scope: they say what was taken, which is the first thing an incident report
needs.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.