LoFP / signals are generated by microsoft defender for office 365. false-positives may occur if legitimate user activity is misclassified as a threat.

Techniques

• T1204
• T1566

Sample rules

M365 Threat Intelligence Signal

• source: elastic
• technicques:
  • T1204
  • T1566

Description

Identifies Microsoft 365 audit logs generated for Threat Intelligence signals by Microsoft Defender for Office 365. This includes phishing and malware events, campaign-related threat detections, file-based threats in SharePoint, OneDrive, and Teams, as well as Microsoft Threat Intelligence Center (MSTIC) signals. These events provide early indicators of compromise attempts and can be correlated with other signals for threat hunting and detection.

Detection logic

event.dataset: "o365.audit" and
    event.code:(ThreatIntelligence or ThreatFinder or ThreatIntelligenceAtpContent or ThreatIntelligenceUrl or MSTIC or Campaign)