Microsoft 365 sensitive folder staging
A run of mail moved out of folders whose NAME says the contents are financial or legal — payroll, contracts, vendors, investments, month-end statements.
What it detects
A run of mail moved out of folders whose NAME says the contents are financial or legal — payroll, contracts, vendors, investments, month-end statements.
What an attacker takes tells you what they are after, and it is the difference between a report that says "1,050 items were moved" and one that says "the payroll and vendor-contract folders were emptied". On the motivating case the destinations included \Inbox\HR_Payroll\Payroll, \Inbox\Contracts\Vendors and \Inbox\MonthEnd\A-FinStmts — visible in the evidence, unreachable from a rule until folder paths became addressable.
MITRE ATT&CK mapping
False positives and triage
Mailbox cleanup, an archive migration, or a retention policy all move mail in bulk and will match. The signal is the surrounding context, not the movement: an account with other findings, a client or address it has not used before, or movement into low-visibility folders rather than an archive. Confirm the user was not simply tidying up — a lead, not a verdict.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/cloud/m365_sensitive_folder_exfil_staging.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_sensitive_folder_staging
version: 1.0.0
status: stable
severity: high
confidence: 0.5
platforms: [application]
mitre_techniques: [T1114.002, T1074.001]
description: |
A run of mail moved out of folders whose NAME says the contents are financial or
legal — payroll, contracts, vendors, investments, month-end statements.
What an attacker takes tells you what they are after, and it is the difference
between a report that says "1,050 items were moved" and one that says "the
payroll and vendor-contract folders were emptied". On the motivating case the
destinations included \Inbox\HR_Payroll\Payroll, \Inbox\Contracts\Vendors and
\Inbox\MonthEnd\A-FinStmts — visible in the evidence, unreachable from a rule
until folder paths became addressable (ADR-053).
match:
provider: Office365
event_action_any:
- Move
- MoveToDeletedItems
- SoftDelete
- HardDelete
# Folder paths are nested under the moved item; both sides of the move are in
# the subtree, so a hit means the operation TOUCHED a sensitive folder.
ext:Folder_contains_any: &sensitive
# knowledge/business-context.yaml -> sensitive_mail_folders
- "payroll"
- "compensation"
- "contracts"
- "agreements"
- "vendors"
- "suppliers"
- "procurement"
- "invest"
- "finstmt"
- "financial"
- "monthend"
- "accounts payable"
- "banking"
- "legal"
- "litigation"
threshold:
count: 10
window_seconds: 3600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Mailbox cleanup, an archive migration, or a retention policy all move mail in
bulk and will match. The signal is the surrounding context, not the movement:
an account with other findings, a client or address it has not used before, or
movement into low-visibility folders rather than an archive. Confirm the user
was not simply tidying up — a lead, not a verdict (ADR-004).
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.