LoFP / users or system administrator cleaning out folders.

Techniques

• T1485

Sample rules

Microsoft 365 Unusual Volume of File Deletion

• source: elastic
• technicques:
  • T1485

Description

Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security.

Detection logic

event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Unusual volume of file deletion" and event.outcome:success