Microsoft 365 eDiscovery PST Export or Search Started Success Alert
Alerts on successful eDiscovery search/export activity that produces PST files in Microsoft 365.
- Product
- m365
- Service
- threat_management
- Author
- Sorina Ionescu (SigmaHQ), DRL 1.1
- Published
- 2022-02-08
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule triggers on successful eDiscovery activity in Microsoft 365, specifically when an eDiscovery search starts or when a PST file is exported. Attackers may use eDiscovery and PST exports to collect sensitive mailbox content in bulk, so monitoring these events helps detect potential data collection. The detection relies on Microsoft 365 SecurityComplianceCenter threat management telemetry with the event name 'eDiscovery search started or exported' and a success status.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Microsoft 365 eDiscovery PST Export or Search Started Success Alert
id: 6ae29a8c-e779-4f61-b872-4a14b87eae1d
related:
- id: 6897cd82-6664-11ed-9022-0242ac120002
type: similar
- id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
type: derived
status: test
description: This rule triggers on successful eDiscovery activity in Microsoft 365, specifically when an eDiscovery search starts or when a PST file is exported. Attackers may use eDiscovery and PST exports to collect sensitive mailbox content in bulk, so monitoring these events helps detect potential data collection. The detection relies on Microsoft 365 SecurityComplianceCenter threat management telemetry with the event name 'eDiscovery search started or exported' and a success status.
references:
- https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml
author: Sorina Ionescu, Huntrule Team
date: 2022-02-08
modified: 2022-11-17
tags:
- attack.collection
- attack.t1114
logsource:
service: threat_management
product: m365
definition: Requires the 'eDiscovery search or exported' alert to be enabled
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: eDiscovery search started or exported
status: success
condition: selection
falsepositives:
- PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
level: medium
license: DRL-1.1