Microsoft 365 eDiscovery PST Export Alert (SecurityComplianceCenter Success Events)

Alerts on successful eDiscovery search/export activity that produces PST files in Microsoft 365.

FreeUnreviewedSigmamediumv1

microsoft-365-ediscovery-pst-export-alert-securitycompliancecenter-success-event-18b88d08

title: Microsoft 365 eDiscovery PST Export Alert (SecurityComplianceCenter Success Events)
id: 6ae29a8c-e779-4f61-b872-4a14b87eae1d
related:
  - id: 6897cd82-6664-11ed-9022-0242ac120002
    type: similar
  - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
    type: derived
status: test
description: This rule triggers when a user successfully starts an eDiscovery search or exports data resulting in a PST file from the search. PST exports can contain sensitive email content and other communications, making them a high-impact collection method for an attacker. The detection relies on Microsoft 365 SecurityComplianceCenter telemetry using the 'eDiscovery search started or exported' success event.
references:
  - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml
author: Sorina Ionescu, Huntrule Team
date: 2022-02-08
modified: 2022-11-17
tags:
  - attack.collection
  - attack.t1114
logsource:
  service: threat_management
  product: m365
  definition: Requires the 'eDiscovery search or exported' alert to be enabled
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: eDiscovery search started or exported
    status: success
  condition: selection
falsepositives:
  - PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
level: medium
license: DRL-1.1

What it detects

This rule triggers when a user successfully starts an eDiscovery search or exports data resulting in a PST file from the search. PST exports can contain sensitive email content and other communications, making them a high-impact collection method for an attacker. The detection relies on Microsoft 365 SecurityComplianceCenter telemetry using the 'eDiscovery search started or exported' success event.

Known false positives

PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.