Microsoft 365 SecurityComplianceCenter: User Restricted from Sending Email (Successful Event)

title: "Microsoft 365 SecurityComplianceCenter: User Restricted from Sending Email (Successful Event)"
id: e4df2531-0104-451c-a099-49a1885b5400
status: test
description: This rule flags successful events from the SecurityComplianceCenter where a user is restricted from sending email after exceeding service policy sending limits. Such restrictions can indicate abusive or automated sending behavior that triggers compliance controls. The detection relies on threat_management telemetry from Microsoft 365 capturing the specific eventSource, eventName, and success status in SecurityComplianceCenter.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml
author: austinsonger, Huntrule Team
date: 2021-08-19
modified: 2022-10-09
tags:
  - attack.initial-access
  - attack.t1199
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: User restricted from sending email
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ff246f56-7f24-402a-baca-b86540e3925c
    type: derived