M365 PST Export via New-ComplianceSearchAction -Export in SecurityComplianceCenter

Flags M365 SecurityComplianceCenter activity that includes New-ComplianceSearchAction with -Export for PST content.

FreeUnreviewedSigmamediumv1

m365-pst-export-via-new-compliancesearchaction-export-in-securitycompliancecente-6897cd82

title: M365 PST Export via New-ComplianceSearchAction -Export in SecurityComplianceCenter
id: 9fdfa6dd-0313-44d1-930b-a644d824f5eb
related:
  - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
    type: similar
  - id: 6897cd82-6664-11ed-9022-0242ac120002
    type: derived
status: test
description: This rule alerts when SecurityComplianceCenter telemetry contains an invocation of New-ComplianceSearchAction with the -Export flag targeting PST content. Exporting PST files from Exchange/M365 can be used to collect email data outside normal user access patterns, making it a sensitive action to monitor. The detection relies on log entries where the payload includes the strings "New-ComplianceSearchAction", "Export", and "pst".
references:
  - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2022-11-17
tags:
  - attack.collection
  - attack.t1114
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    Payload|contains|all:
      - New-ComplianceSearchAction
      - Export
      - pst
  condition: selection
falsepositives:
  - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored.
level: medium
license: DRL-1.1

What it detects

This rule alerts when SecurityComplianceCenter telemetry contains an invocation of New-ComplianceSearchAction with the -Export flag targeting PST content. Exporting PST files from Exchange/M365 can be used to collect email data outside normal user access patterns, making it a sensitive action to monitor. The detection relies on log entries where the payload includes the strings "New-ComplianceSearchAction", "Export", and "pst".

Known false positives

Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.