Possible PST Export Alert Via eDiscovery Alert (via threat_management)

title: Possible PST Export Alert Via eDiscovery Alert (via threat_management)
id: e31aac23-ae42-569f-88fa-c6940adbb997
status: stable
description: This rule detects when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide
author: Huntrule Team
date: 2026-06-30
tags:
    - attack.collection
    - attack.t1114
logsource:
    service: threat_management
    product: m365
    definition: Requires the 'eDiscovery search or exported' alert to be enabled
detection:
    selection:
        eventSource: SecurityComplianceCenter
        eventName: 'eDiscovery search started or exported'
        status: success
    condition: selection
falsepositives:
    - Unknown
level: medium