Microsoft 365 Threat Management: PST Export via New-ComplianceSearchAction -Export
Flags M365 SecurityComplianceCenter activity that includes New-ComplianceSearchAction with -Export for PST content.
- Product
- m365
- Service
- threat_management
- Author
- Nikita Khalimonenkov (SigmaHQ), DRL 1.1
- Published
- 2022-11-17
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule alerts when Microsoft 365 SecurityComplianceCenter telemetry contains a PowerShell export command using New-ComplianceSearchAction with an -Export flag targeting PST content. Attackers may use compliance search exports to extract sensitive mailbox data for collection without necessarily triggering other eDiscovery-related alerts. The detection relies on matching event payload text for New-ComplianceSearchAction, Export, and pst.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Microsoft 365 Threat Management: PST Export via New-ComplianceSearchAction -Export"
id: 9fdfa6dd-0313-44d1-930b-a644d824f5eb
related:
- id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
type: similar
- id: 6897cd82-6664-11ed-9022-0242ac120002
type: derived
status: test
description: This rule alerts when Microsoft 365 SecurityComplianceCenter telemetry contains a PowerShell export command using New-ComplianceSearchAction with an -Export flag targeting PST content. Attackers may use compliance search exports to extract sensitive mailbox data for collection without necessarily triggering other eDiscovery-related alerts. The detection relies on matching event payload text for New-ComplianceSearchAction, Export, and pst.
references:
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2022-11-17
tags:
- attack.collection
- attack.t1114
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
Payload|contains|all:
- New-ComplianceSearchAction
- Export
- pst
condition: selection
falsepositives:
- Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored.
level: medium
license: DRL-1.1