Microsoft 365 sensitive repository search
A SharePoint, OneDrive or Exchange search for terms that name credentials, payment details or regulated data.
What it detects
A SharePoint, OneDrive or Exchange search for terms that name credentials, payment details or regulated data.
After taking an identity, an attacker does not need to break anything else — the tenant's own search index will find what they came for. They ask it for "password", "wire transfer", "banking", "payroll". The searches are indistinguishable from ordinary work except in WHAT was asked for, which is why the query text is the whole signal and why this rule exists once that text is readable.
MITRE ATT&CK mapping
False positives and triage
Legitimate searches hit these words constantly: IT staff search for "password reset" procedures, finance searches for "invoice", HR for "payroll". This rule is a lead, not a verdict, and on a large tenant it will fire daily. The signal is WHO — a search for credentials by an account with no business reason, from an unfamiliar IP, or during a session already flagged elsewhere. Correlate with what the account did next: a sensitive search followed by mass download or an inbox rule is the sequence that matters, and either of those has its own rule.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_sensitive_repository_search.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_sensitive_repository_search
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1213.002, T1213]
description: |
A SharePoint, OneDrive or Exchange search for terms that name credentials, payment
details or regulated data.
After taking an identity, an attacker does not need to break anything else — the
tenant's own search index will find what they came for. They ask it for "password",
"wire transfer", "banking", "payroll". The searches are indistinguishable from
ordinary work except in WHAT was asked for, which is why the query text is the whole
signal and why this rule exists once that text is readable.
match:
provider: Office365
event_action_contains_any:
- SearchQueryPerformed
- SearchQueryInitiatedSharePoint
- SearchQueryInitiatedExchange
raw_message_regex: "(?i)query=[^ ]*(password|passwd|credential|secret|private ?key|api[_ -]?key|bank|wire transfer|swift|iban|payroll|invoice|routing number|ssn|social security|passport|confidential)"
correlation_keys: [user_name]
false_positive_guidance: |
Legitimate searches hit these words constantly: IT staff search for "password reset"
procedures, finance searches for "invoice", HR for "payroll". This rule is a lead,
not a verdict, and on a large tenant it will fire daily. The signal is WHO — a search
for credentials by an account with no business reason, from an unfamiliar IP, or
during a session already flagged elsewhere. Correlate with what the account did
next: a sensitive search followed by mass download or an inbox rule is the sequence
that matters, and either of those has its own rule.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.