huntrule

Microsoft 365 Cloud App Security: Successful Data Exfiltration to Unsanctioned Apps

Alerts on successful Cloud App Security reports of data exfiltration attempts using unsanctioned apps.

FreeUnreviewedSigmamediumv1
title: "Microsoft 365 Cloud App Security: Successful Data Exfiltration to Unsanctioned Apps"
id: 039d731e-1b63-4ed1-b8d3-57199e1af4ee
status: test
description: This rule flags cases where Microsoft Cloud App Security reports a successful event indicating data exfiltration activity to an app that is not sanctioned for your organization. Attackers may attempt to move sensitive information through unmanaged third-party services that are not covered by policy controls. The detection relies on Threat Management telemetry from Microsoft 365, specifically SecurityComplianceCenter events with the matching event name and success status.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Data exfiltration to unsanctioned apps
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2b669496-d215-47d8-bd9a-f4a45bf07cda
    type: derived

What it detects

This rule flags cases where Microsoft Cloud App Security reports a successful event indicating data exfiltration activity to an app that is not sanctioned for your organization. Attackers may attempt to move sensitive information through unmanaged third-party services that are not covered by policy controls. The detection relies on Threat Management telemetry from Microsoft 365, specifically SecurityComplianceCenter events with the matching event name and success status.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.