Microsoft 365 Threat Management: High Volume File Deletion by a User
Alerts when Microsoft 365 threat telemetry shows a user successfully deleting an unusually large number of files.
FreeUnreviewedSigmamediumv1
microsoft-365-threat-management-high-volume-file-deletion-by-a-user-78a34b67
title: "Microsoft 365 Threat Management: High Volume File Deletion by a User"
id: c144460f-42da-4f07-8f15-a43afff380f1
status: test
description: This rule flags cases where Microsoft Cloud App Security reports a user deleting an unusual, large volume of files. Attackers may use bulk deletions to disrupt availability or cover tracks, so abnormal deletion volume is a useful impact-focused signal. The detection relies on threat management events from SecurityComplianceCenter indicating successful "Unusual volume of file deletion" activity.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml
author: austinsonger, Huntrule Team
date: 2021-08-19
modified: 2022-10-09
tags:
- attack.impact
- attack.t1485
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Unusual volume of file deletion
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 78a34b67-3c39-4886-8fb4-61c46dc18ecd
type: derived
What it detects
This rule flags cases where Microsoft Cloud App Security reports a user deleting an unusual, large volume of files. Attackers may use bulk deletions to disrupt availability or cover tracks, so abnormal deletion volume is a useful impact-focused signal. The detection relies on threat management events from SecurityComplianceCenter indicating successful "Unusual volume of file deletion" activity.
Known false positives
- Unknown
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.