Techniques
Sample rules
O365 Compliance Content Search Started
- source: splunk
- technicques:
- T1114
- T1114.002
Description
The following analytic detects when a content search is initiated within the Office 365 Security and Compliance Center. It leverages the SearchCreated operation from the o365_management_activity logs under the SecurityComplianceCenter workload. This activity is significant as it may indicate an attempt to access sensitive organizational data, including emails and documents. If confirmed malicious, this could lead to unauthorized data access, potential data exfiltration, and compliance violations. Monitoring this behavior helps ensure the integrity and security of organizational data.
Detection logic
`o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated
| rename user_id as user
| stats count earliest(_time) as firstTime latest(_time) as lastTime by Operation, ObjectId, ExchangeLocations, user, Query
|`security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)`
| `o365_compliance_content_search_started_filter`